MobSF/Mobile-Security-Framework-MobSF v4.6.4

on GitHub

v4.6.4 Changelog

This release adds direct .dex static analysis, replaces wkhtmltopdf/pdfkit and http-tools with xhtml2pdf and a built-in mitmproxy Web Traffic viewer, removes 9 single-use dependencies, and includes several static and dynamic analysis fixes.

• Features or Enhancements

  • Added direct static analysis support for standalone Android .dex files
  • Replaced http-tools with mitmproxy and added a built-in authenticated live Web Traffic viewer with dark mode and upstream proxy replay ("Send to Fuzzer")
  • Replaced wkhtmltopdf and pdfkit with pure-Python xhtml2pdf and confined PDF asset resolution with ResourceAccessPolicy
  • Updated the AppSec security score calculation to use a baseline-anchored monotonic formula
  • Added 26 new Android permissions to the Android permissions knowledge base
  • Replaced 9 single-use dependencies (six, distro, shelljob, colorlog, svgutils, arpy, macholib, bleach, rsa) with Python standard library or existing packages
  • Optimized Dockerfile layers and bumped OpenJDK to 24.0.2 and JADX to 1.5.6

• Bug Fixes

  • Fixed Android 10/11 emulator and Genymotion frida-server startup crashes by staging and executing fd_server from /data/local/tmp/mobsf
  • Fixed Android live logcat streaming by filtering on the package's effective UID(s) and keeping the Stop/Continue Streaming button responsive
  • Fixed Mach-O debug symbol stripping detection by checking N_STAB (0xe0) symbol table entries
  • Skipped redundant JADX per-DEX fallback decompilation when Java output is already generated
  • Prevented duplicate native library (.so) analysis of apktool_out copies
  • Fixed multi-file uploads on the home page to trigger static analysis in both synchronous and asynchronous queue modes
  • Added a fallback to macOS sips for iOS CgBI icon conversion when xcrun -sdk iphoneos pngcrush is unavailable

What's Changed

• fix(macho): detect stripped debug symbols via N_STAB bits by @ajinabraham in #2743
• fix(appsec): use baseline-anchored monotonic security score formula by @ajinabraham in #2744
• feat(android): add direct static analysis support for DEX files by @ajinabraham in #2745
• chore(docker): optimize Dockerfile layers and bump OpenJDK 24.0.2 & JADX 1.5.6 by @ajinabraham in #2746
• fix(jadx): skip redundant per-DEX fallback when Java output is generated by @ajinabraham in #2748
• fix(home): trigger static analysis for multi-file uploads in sync and async modes by @ajinabraham in #2749
• feat(pdf): replace wkhtmltopdf and pdfkit with xhtml2pdf by @ajinabraham in #2747
• fix(ios): fallback to macOS sips when xcrun iphoneos pngcrush is unavailable by @ajinabraham in #2750
• Do not analyse apktool's copy of native libraries. by @captainrogers69 in #2752
• feat(dynamic): replace http-tools with mitmproxy and add live HTTP traffic viewer by @ajinabraham in #2753
• fix(dynamic): execute emulator frida-server from /data/local/tmp by @ajinabraham in #2754
• chore: bump version to 4.6.4, update deps, and replace 9 single-use dependencies by @ajinabraham in #2755
• chore: dark-mode Web Traffic styles, Android permissions KB, and cleanup by @ajinabraham in #2756
• chore: Dockerfile, licenses, and README cleanup by @ajinabraham in #2757

Full Changelog: v4.6.2...v4.6.4