LockKnife : The Ultimate Android Security Research Tool - Your Complete Android Security Research Arsenal! 🗝️🔬🔒 Dive deep into Android security with this next-generation enterprise-grade command-line tool featuring AI-powered analysis, cryptocurrency wallet forensics, threat intelligence integration, Android 16 support, and 20+ specialized modules. Recover lock screen credentials, perform AI-driven behavior analysis, analyze crypto wallets, detect threats with real-time intelligence, extract Private Space data (Android 15+), analyze passkeys (Android 14+), orchestrate multi-device investigations, generate professional forensic reports, and conduct cutting-edge security research. Connect your device and unleash the full power of advanced Android security research! 🔒💫🚀
| Tag | Meaning |
|---|---|
| ✅ | Fully Working - Feature is complete and operational |
| 🔧 | Functional - Core functionality works, with some limitations |
| 🔬 | Partial - Basic implementation, results may be incomplete |
| 🚧 | Coming Soon - Placeholder/under development |
- Gesture Pattern Recovery ✅: Recover lock screen gesture patterns with hash mapping and visualization
- Dictionary Attack ✅: Use custom wordlists to recover alphanumeric passwords with parallel processing support
- Brute Force Attack ✅: PIN cracking for 4, 6, or 8-digit PINs with progress tracking
- Wi-Fi Password Extraction ✅: Recover saved WiFi passwords from WifiConfigStore.xml
- Locksettings Database Analysis ✅: Extract and analyze locksettings.db for newer Android versions
- Gatekeeper HAL Analysis ✅: Modern credential storage analysis and response monitoring
- Android 5 and Older ✅
- Android 6 to 9 ✅
- Android 10 to 13 ✅
- Android 14 (Credential Manager detection) 🔧
- Android 15 (Private Space detection) 🔧
- Android 16+ (Full compatibility mode) 🔧
- SMS Messages Extraction ✅: Pull and analyze mmssms.db with statistics
- Call Logs Extraction ✅: Full call history with type classification
- Wi-Fi Passwords ✅: Complete WiFi credential extraction
- WhatsApp Data ✅: Extract msgstore.db, contacts, and media files
- Telegram Data ✅: Database and configuration extraction
- Signal Data 🔧: Extraction support (limited by SQLCipher encryption)
- Browser Data ✅: Chrome, Firefox, Brave, Edge history, cookies, and credentials
- Bluetooth Pairing Keys ✅: Extract Bluetooth configuration and paired devices
- Device Snapshot Creation ✅: Capture file system for offline analysis
- Live Analysis ✅: Real-time device state analysis
- Custom Data Extraction ✅: Pull specific files or directories
- SQLite Database Analysis ✅: Extract and analyze any database
- Search Functionality ✅: Find sensitive information in snapshots
- App-Specific Extraction ✅: Specialized tools for popular messaging apps
- Process Monitoring 🔧: Real-time process listing and analysis
- Memory Mapping 🔧: Process memory inspection
- Frida Integration 🔬: Runtime instrumentation (requires Frida server on device)
- Anti-Debugging Detection 🔬: Identify debugging attempts
- Certificate Pinning Detection 🔧: Identify SSL pinning implementations
- Frida SSL Bypass 🔬: Runtime SSL bypass scripts (requires Frida)
- Network Interception Setup 🔧: MITM proxy configuration
- Burp Suite Integration 🔧: Proxy setup guidance
- Static Analysis ✅: Manifest parsing, permission analysis, resource inspection
- Code Analysis 🔧: DEX/SMALI inspection (requires external tools)
- Vulnerability Scanning 🔧: Automated security checks
- Malware Indicators 🔧: Suspicious pattern detection
- Signature Verification ✅: APK signature validation
- Traffic Capture ✅: Record network traffic with tcpdump (requires root)
- Protocol Analysis ✅: Analyze with tshark integration
- HTTP/DNS Analysis ✅: Request and query extraction
- Unencrypted Traffic Detection ✅: Identify insecure communications
- Memory Dumping 🔬: Process memory extraction (requires root)
- Memory Leak Detection 🔬: Basic allocation analysis
- Heap/Stack Analysis 🔬: Memory inspection capabilities
- Kernel Module Analysis 🔧: Inspect loaded modules
- SELinux Policy Analysis 🔧: Review security policies
- Security Feature Assessment 🔧: Evaluate hardening status
- AVC Denial Monitoring 🔧: Track access denials
- Application Scanning ✅: Check installed apps for suspicious indicators
- Permission Analysis ✅: Identify dangerous permission combinations
- Package Analysis ✅: Verify app signatures and sources
- System File Scanning 🔧: Check for compromised system files
- Network Malware Detection 🔧: Analyze connections for malicious activity
- YARA Integration 🔬: Pattern matching (requires YARA installation)
- System Vulnerabilities 🔧: Check for known Android security issues
- App Vulnerabilities 🔧: Analyze installed apps for flaws
- Configuration Issues 🔧: Identify insecure settings
- TEE Analysis 🔧: Trusted Execution Environment assessment
- Hardware-Backed Keystore 🔧: Secure key storage analysis
- Secure Element Analysis 🔬: eSE/UICC evaluation
- Biometric Hardware 🔧: Fingerprint/face recognition assessment
- Bootloader Assessment ✅: Lock status and OEM unlock detection
- Firmware Extraction 🔧: Partition dumping capabilities
- Boot Image Analysis 🔬: Inspect boot images
- Verified Boot Status ✅: Check integrity verification
- Google Drive 🔬: Synced data detection (limited extraction)
- Samsung Cloud 🔬: Samsung account detection
- Cloud Configuration 🔧: Backup settings analysis
🔬 Note: These features are newly added and provide foundational analysis capabilities. As they are under active development, results may be incomplete. Some features generate reports based on available data analysis.
- Password Pattern Prediction 🔧: Statistical analysis-based password guessing
- Behavioral Anomaly Detection 🔧: Process and network anomaly identification
- Malware Classification 🔧: Pattern-based risk scoring
- User Activity Analysis 🔬: App usage pattern detection
- Security Assessment 🔬: Risk forecasting and posture evaluation
- Data Correlation 🔬: Cross-reference extracted data
- Wallet Detection ✅: Identify crypto wallet apps (Coinbase, Binance, MetaMask, etc.)
- Wallet Data Extraction 🔧: Extract wallet app data (requires root)
- Transaction History 🔬: Transaction data analysis
- Seed Phrase Recovery 🔬: Attempt recovery (heavily encrypted)
- Private Key Extraction 🔬: Key extraction attempts
- Exchange App Analysis 🔧: Forensics for exchange applications
- NFT & DeFi Analysis 🔬: Token and protocol detection
- IOC Detection 🔧: Indicators of Compromise identification
- App Reputation Analysis 🔧: Check apps against threat databases
- URL/Domain Analysis 🔬: Domain reputation (requires API keys)
- File Hash Lookup 🔬: VirusTotal integration (requires API key)
- IP Reputation 🔬: IP address checking
- CVE Vulnerability Check 🔬: Known vulnerability detection
- Real-Time Threat Feeds 🔬: Integration with VirusTotal, AlienVault OTX (requires API keys)
- Private Space Detection ✅: Identify Private Space usage
- User Profile Analysis ✅: Detect multiple isolated profiles
- Private App Listing 🔧: List apps in Private Space
- Data Extraction 🔧: Extract from isolated profiles (requires root)
- Security Analysis 🔧: Assess Private Space implementation
- Isolation Boundary Testing 🔬: Test app isolation
- Credential Manager Detection ✅: Identify modern credential storage
- Passkey Data Extraction 🔧: Extract passkey metadata (requires root)
- WebAuthn Analysis 🔧: Analyze web authentication credentials
- FIDO2 Support 🔬: Security key detection
- Biometric Binding 🔬: Analyze passkey-biometric associations
- Device Scanning ✅: Detect all connected devices
- Parallel Information Gathering ✅: Simultaneous data collection
- Synchronized Extraction 🔧: Parallel data extraction
- Cross-Device Correlation 🔬: Find relationships between devices
- Comparative Analysis 🔬: Compare security postures
- Multi-Device Timeline 🔬: Unified event reconstruction
- Executive Summary ✅: High-level reports for stakeholders
- Technical Reports ✅: Detailed technical analysis
- Timeline Reports 🔧: Event timeline reconstruction
- Security Assessment Reports ✅: Comprehensive security reports
- Evidence Collection Reports ✅: Chain of custody documentation
- Compliance Reports 🔬: GDPR, HIPAA (template-based)
- Multiple Formats 🔬: PDF/HTML export (requires pandoc)
- Live device activity monitoring
- Process activity dashboards
- Network traffic visualization
- System resource tracking
- Alert notifications
- Detect connected IoT devices
- Bluetooth LE device scanning
- Smart home protocol analysis
- IoT communication monitoring
- Security assessment
- Install community plugins
- Browse plugin marketplace
- Custom plugin development
- Plugin security scanning
- Auto-update capability
-
Operating System: macOS, Linux, Windows (WSL)
-
Shell: Bash-compatible environment
-
Android Device: ADB debugging enabled
-
Required:
- ADB (Android Debug Bridge)
- Android SDK Platform-Tools
- openssl for encryption features
-
Recommended:
- sqlite3 for database analysis (Android 10+)
- GNU Parallel for faster attacks
- tshark for network analysis
- Root access on device for advanced features
Memory Analysis:
- gdb/lldb for debugging capabilities
- valgrind for memory leak detection
Kernel Analysis:
- Kernel headers for inspection
- SELinux policy tools
Malware Analysis:
- ClamAV or similar antivirus
- YARA for pattern matching
Network Analysis:
- tcpdump for traffic capture
- nmap for network scanning
Threat Intelligence:
- VirusTotal API key
- AlienVault OTX API key
Reports:
- pandoc for PDF/HTML export
To use LockKnife : The Ultimate Android Security Research Tool, follow these steps:
-
Connect your Android device to your computer with USB debugging enabled.
-
Run the following command in your terminal:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/ImKKingshuk/LockKnife/main/LockKnife.sh)"For advanced debugging and verbose output, use:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/ImKKingshuk/LockKnife/main/LockKnife.sh)" -- --debugTo create a default configuration file:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/ImKKingshuk/LockKnife/main/LockKnife.sh)" -- --create-config=~/.config/lockknife/lockknife.conf
Follow the on-screen prompts to select your device and choose the desired features.
LockKnife looks for configuration files in the following locations (in order):
./lockknife.conf(current directory)$HOME/.config/lockknife/lockknife.conf(user config directory)/etc/lockknife.conf(system-wide config)
You can also specify a custom config file using the --config=FILE command-line option.
See lockknife.conf for all 100+ configurable options including:
- Attack settings (wordlist, parallel jobs, PIN length)
- Forensics settings (snapshot directories, PCAP filters)
- App-specific extraction options
- Advanced analysis depth settings
- Threat intelligence API keys
- Report generation preferences
LockKnife : The Ultimate Android Security Research Tool is developed for research and educational purposes. It should be used responsibly and in compliance with all applicable laws and regulations. The developer of this tool is not responsible for any misuse or illegal activities conducted with this tool.
Password recovery tools should only be used for legitimate purposes and with proper authorization. Using such tools without proper authorization is illegal and a violation of privacy. Ensure proper authorization before using LockKnife for password recovery or data extraction. Always adhere to ethical hacking practices and comply with all applicable laws and regulations.
This project is licensed under the GPL-3.0-or-later License.