droid2web v0.3.24 23 Sep 2026

APK, APKM, DEX, AXML, ARSC inspection in the browser

No file loaded or drag & drop (multi-DEX OK)
Drop any file here to analyze APK, APKM, DEX (one or many), AXML, ARSC — type detected automatically

Contents

Upload or drop any file — type is auto-detected
Workspace
Decomp
No bytecode
Select a method to view instructions
No CFG
Select a single method to view its control-flow graph
No source yet
Select a method — or open All methods and click a method header / Open CFG
Ready to emulate
Select a method, then Step or Run
›
Decomp
Offset Hex Opcode Operands
No assembly
Open an ARM64 .so from Native or Files
No CFG
Select a function
No source yet
Select an ARM64 function to decompile
Manifest (APK) or XML (AXML)
Permissions
Load an APK with a Manifest to inspect permissions
Components
Load an APK with a Manifest to inspect components
File info
Strings (DEX)

String references: every const-string and encoded use of this text. Enter searches. ↑↓ move. Enter on a hit opens it.

Load a DEX or APK
MASTG Know
Load a DEX or APK, then click Scan

Findings

A · old Drop APK, APKM, or DEX
B · new Drop APK, APKM, or DEX
Compare two APKs, APKMs, or DEX files. Only Dalvik bytecode is matched — resources and the manifest are ignored.

Decode an APK to an editable project (dex-txt / manifest / res / apkpatch.yml), edit with syntax highlighting, rebuild and sign in the browser. dex-txt is assembled from scratch. Host aapt2 is unavailable — keep original resources.arsc or enable pure-Rust rebuild. Use the Device tab to install and debug on a phone.

No project loaded
Decode
Build / sign
Goauld (APK inject)

Pack libgoauld_agent.so + loader provider. Bundled arm64 agent is used if no file is chosen.

Project files
    Select a text file
    Saved projects (IndexedDB)
      Not connected
      1. 1 Connect
      2. 2 Pick app
      3. 3 Attach
      4. 4 Script / trace

      WebUSB ADB · Chrome/Edge · quit host adb first. Flow: connect → select package → Attach agent → ScriptLoad / Rpc / Post. The Contents panel on the left mirrors the phone while the console stays live — click it to start. Syscall trace needs root (detaches the agent).

      Apps

        Target

        Not attached

        If the APK already embeds the goauld agent: connect → (install/launch) → Attach agent. Stock apps need Live inject (root) first.

        Live inject root

        Stock apps without an embedded agent (Calculator, …): inject first, then Attach. Needs Magisk/su.

        Binary overrides (optional)

        Bundled arm64 goauld binaries are used by default.

        Quick trace

        For apps that already include the goauld agent. Interact with the app on the phone while tracing.

        Java / Android API agent · no root

        Auto-attach → ART invoke stubs → collect android-api events.

        Syscalls injector · root

        Detaches agent stream, pushes injector, runs PTRACE_SYSCALL (Magisk/su).

        Script & protocol

        Attach agent first
        Console 0
        Connect a phone, pick an app, then Attach — events and protocol traffic show here. Java API and syscall traces expand into structured rows.
        Not started

        Same WebUSB session as the Device tab. Quit host adb first. Detach the goauld agent before Start — one ADB stream at a time. Click the picture to type; Ctrl-V pastes. PNG saves the current frame; GIF and MP4 record until you click them again.

        RustPython Tab completes · help() lists every command · also droid.* Not loaded