Slightly off topic. I looked at REA's Android reversing support and found it still uses jadx mcp. That kills large scale APK reversing. jadx takes tens of minutes to preprocess an APK, build a code relationship database, etc. Even headless mcp is no exception. I basically can't use it to analyze APKs at scale, like 100 large commercial APKs in a pipeline, or 100 preinstalled APKs from a phone ROM to hunt bugs.
So I built droidasc. No memory bloat, no parsing slowdown. Analysis is in milliseconds. Global xref on a 300MB APK takes 1.5 seconds. I used it with codex to analyze phones from 3 different brands and found 2 RCEs and 5 root bugs in a few days. I plan to detail these at Black Hat Asia 2027. A friend used droidasc to scan various bug bounty targets at scale and found 10+ RCEs. Way, way faster than jadx.
Interesting, might be fun to try my hand at it sometime. Is the best way to actually get the APKs to just download them from an apk mirror site.
Yes! APKMirror is a good choice. AndroZoo works too, but it's academic and you need to apply for API access.
APKPure is pretty good too, they don't have captchas for downloads so you can make a simple script to pull the APK from them based on the package name.
You should be able to get free APKs straight from Google via Aurora Store.
> REA still uses jadx MCP for Android reversing instead of my tool, which they've probably never even heard of. Here's my pitch:
Really?
In case you're not aware: my tool got accepted to Black Hat Europe 2026 and sparked discussion in the reversing community, the Black Hat committee said "your tool is very very highly rated", at Pwn2Own 2026 the Samsung RCE winner ch0pin personally recommended my tool, Chrome vulnerability researcher eternalsakura13 posted on X saying they used droidasc to find a bunch of vulnerabilities, and even just now, I'm still using droidasc to hunt for bugs in Honor. I think it has at least contributed something to the community, so what's wrong with me recommending this tool to others and helping others improve their reversing workflow?
Nothing!
Keep up the good work