Releases · Ahmeth4n/renef

Renef v0.3.6

Dynamic Instrumentation Toolkit for Android ARM64

What's New

AI Integration: New ai command with multi-provider support (Ollama, OpenAI, Anthropic). Agentic tool calling lets the AI execute Renef commands to analyze the target before generating scripts. Use @path to inline file contents into prompts.
Spawn Gate (--pause): New flag that freezes the target process after injection via SIGSTOP, ensuring hooks are installed before app initialization (e.g. root detection in onCreate). No ptrace, undetectable. New resume command for manual control.
Python Binding Update: Added OS, File, Syscall, KCov wrappers, watch_start/stop, fixed basic.py example, 54 unit tests.
OS API: New OS global with getpid(), kill(), tgkill(), listdir().
Connection Stability and Hook Memory Fix: Stealth hooking via /proc/self/mem, connection liveness probe, auto-reconnect on send failure.
Strace API: Programmatic syscall tracing from Lua scripts via Syscall.trace(). Also available as standalone renef-strace binary — a ptrace-free syscall tracer using PLT/GOT hooking. Supports per-syscall onCall/onReturn callbacks, argument mutation, skip original, and category-based tracing (file, net, process).
KCOV Feature: Kernel code coverage collection via KCov.open() for coverage-guided fuzzing. Tracks which kernel code paths are hit during syscalls.
Hexdump API: Frida-style hexdump() for memory addresses, strings, byte tables and hook arguments. Also available as Memory.hexdump().
Hook Auto-Cleanup: All hooks are automatically uninstalled when the client disconnects.
Release Workflow: Added renef-strace and client-android (on-device ARM64 client) to build and release packages.
Fix missing cmd_resume and cmd_ai sources in Android client build (be49d5c)
Release notes changed (5c10d2f)
Version update (ad17113)
AI integration (533525c)
Spawn gate (--pause) added for early hook timing (7b3ff49)
Python binding update (aedfe81)
Os api added (d17ba63)
Connection stability and hook mem fixed (c809534)
Strace API added (e6b4649)
KCOV feature added (6843392)
Hexdump api added (bf4a790)
Hook remove feat added when connection closed (8518b91)
Add renef-strace and client-android to release workflow (5e25f1f)

Downloads

Platform-specific releases:

renef-v0.3.6-linux-x64.tar.gz - Linux x64 client + scripts
renef-v0.3.6-macos-x64.tar.gz - macOS Intel client + scripts
renef-v0.3.6-macos-arm64.tar.gz - macOS Silicon client + scripts
renef-v0.3.6-android-arm64.tar.gz - Android server + payload

All-in-one release:

renef-v0.3.6-all-platforms.tar.gz - All platforms + scripts

Verification

Verify downloads using SHA256 checksums in SHA256SUMS.txt

Quick Start

tar xzf renef-v0.3.6-linux-x64.tar.gz
cd renef-linux-x64

adb push ../renef-android-arm64/renef_server /data/local/tmp/
adb push ../renef-android-arm64/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server

adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit
adb shell /data/local/tmp/renef_server &
./renef

Documentation

System Requirements

Client:

Linux (x64) or macOS (Intel/Silicon)
libreadline (Linux/macOS)

Target Device:

Android 5.0+ (API 21+)
ARM64 architecture
Root access (for injection)

Dependencies

Built with:

Capstone 5.0.3
Lua 5.4.7
ASIO 1-30-2
Android NDK r26b

Renef v0.3.5

Dynamic Instrumentation Toolkit for Android ARM64

What's New

Syscall Tracing (renef-strace): New strace-like syscall tracing without ptrace, uses PLT/GOT hooking to intercept libc calls across all loaded libraries. Three usage modes:
- Standalone binary: renef-strace -p <pid> open,read,write,close
- Built-in shell command: renef-strace open,read,write,close
- Lua API: Syscall.trace("openat", "read", { onCall = function(info) print(info.formatted) end })
  Supports 35+ syscalls across 5 categories (file, network, memory, process, ipc), caller library filtering (-f libnative.so), category-based tracing (-c network), custom Lua callbacks with argument formatting, and fd-to-path resolution. Documentation ->
Android 9 (API 28) Support: Extended device support down to Android 9. Injection and spawn now work on older Android versions with architecture-specific shellcode.
PLT/GOT Hook Fixes: Major stability improvements for PLT/GOT hooking. Refactored GOT scanning and hook installation with proper wildcard caller support.
Thread.backtrace() Improvements: Backtrace tables now have a __tostring metamethod / print(Thread.backtrace()) works directly without manual iteration.
Spawn & Injection Optimization: Faster spawn and injection times with improved socket connection handling and attach flow.

Version update (bd418a8)
add renef-strace to release workflow (892519f)
Renef-strace build files changed (f269d1a)
Backtrace implementation changed (5eda705)
Renef strace added (93baf0e)
A9 version spawn problem fix (75dd70a)
pltgot-hook-fix (0b7c159)
Android 9 support added (c20d805)
Spawn and injection time optimization (1aaecc4)

Downloads

Platform-specific releases:

renef-v0.3.5-linux-x64.tar.gz - Linux x64 client + scripts
renef-v0.3.5-macos-x64.tar.gz - macOS Intel client + scripts
renef-v0.3.5-macos-arm64.tar.gz - macOS Silicon client + scripts
renef-v0.3.5-android-arm64.tar.gz - Android server + payload

All-in-one release:

renef-v0.3.5-all-platforms.tar.gz - All platforms + scripts

Verification

Verify downloads using SHA256 checksums in SHA256SUMS.txt

Quick Start

tar xzf renef-v0.3.5-linux-x64.tar.gz
cd renef-linux-x64

adb push ../renef-android-arm64/renef_server /data/local/tmp/
adb push ../renef-android-arm64/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server

adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit
adb shell /data/local/tmp/renef_server &
./renef

Documentation

System Requirements

Client:

Linux (x64) or macOS (Intel/Silicon)
libreadline (Linux/macOS)

Target Device:

Android 5.0+ (API 21+)
ARM64 architecture
Root access (for injection)

Dependencies

Built with:

Capstone 5.0.3
Lua 5.4.7
ASIO 1-30-2
Android NDK r26b

Renef v0.3.4

Dynamic Instrumentation Toolkit for Android ARM64

What's New

TUI Mode: Full terminal UI powered by FTXUI with Console, Hooks, Memory, Modules and Logs tabs. Launch with renef -m v.
Windows (WSL) Build Support: One-command build on Windows via build_wsl.bat. CMake now auto-downloads dependencies (capstone, asio) via FetchContent when local copies are not present.
Server Reconnection Fix: Fixed reconnection issues when the server drops or the client needs to re-attach. TCP and UDS transports now handle stale connections properly.
Up Key Sequence Fix: Fixed command history navigation in the CLI. Arrow key sequences are now parsed correctly.
File/Memory API Fixes: Fixed file API and improved memory scan/read reliability. Process module enumeration is now more robust.
Native Hook Improvements: Minor stability fixes for native ARM64 hooking.

Bump version to 0.3.4 (e9dd1f0)
Fix: CRLF line problem (c243ed8)
Windows WSL build support added (19ed084)
Minor fix (6eb8785)
Minor api fixes (file,memory) and readme updated (24893b0)
Up key sequence fixed (8c419ab)
Update license type and fix README formatting (12f6fad)
Server reconnection problem fixed (2cc538c)
Command adapter fixed (0509bf7)
TUI mode added (fea82a9)

Downloads

Platform-specific releases:

renef-v0.3.4-linux-x64.tar.gz - Linux x64 client + scripts
renef-v0.3.4-macos-x64.tar.gz - macOS Intel client + scripts
renef-v0.3.4-macos-arm64.tar.gz - macOS Silicon client + scripts
renef-v0.3.4-android-arm64.tar.gz - Android server + payload

All-in-one release:

renef-v0.3.4-all-platforms.tar.gz - All platforms + scripts

Verification

Verify downloads using SHA256 checksums in SHA256SUMS.txt

Quick Start

tar xzf renef-v0.3.4-linux-x64.tar.gz
cd renef-linux-x64

adb push ../renef-android-arm64/renef_server /data/local/tmp/
adb push ../renef-android-arm64/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server

adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit
adb shell /data/local/tmp/renef_server &
./renef

Documentation

System Requirements

Client:

Linux (x64) or macOS (Intel/Silicon)
libreadline (Linux/macOS)

Target Device:

Android 5.0+ (API 21+)
ARM64 architecture
Root access (for injection)

Dependencies

Built with:

Capstone 5.0.3
Lua 5.4.7
ASIO 1-30-2
Android NDK r26b

Renef v0.3.3

Dynamic Instrumentation Toolkit for Android ARM64

What's New

Agent Path Fix: Fixed an issue where the agent file was being deleted by unlink() after injection, causing crashes and injection failures on subsequent runs. The payload path is now consistent across all injection stages. See PR #13 for details.
**Java Hook **: Added support in callbacks to skip calling the original method entirely. Essential for void methods that throw exceptions (e.g., ) and prevents ART stack walk crashes on Android 16 when multiple hooked methods are nested.
onEnter Arg Modification Fix: Fixed a bug where modifying arguments in (e.g., ) had no effect. The args table is now read back after the Lua callback, and changes are written to the saved registers.
ExceptionClear for All Hooks: now unconditionally clears pending Java exceptions after calling the original method. Previously this only worked when an callback was registered.
Android 16 Conscrypt Support: Added (byte[][]) signature variant for , which changed from long[] to byte[][] on Android 16.
Network Security Config Hooks: Added and hooks with Socket/SSLEngine overloads for full Android Network Security Config bypass coverage.
Java API Additions (v0.3.1+):
- — Register Java classes at runtime with Lua-backed method implementations
- — Create Java arrays from Lua tables
- — Access raw ART pointer from JavaInstance userdata
SSL Unpin Script: Updated with 30+ bypass targets including Conscrypt, OkHttp3, Squareup, Trustkit, Apache, Netty, Fabric, Appmattus, Cordova, WebView, Cronet, and more.
Version update (2000ca6)
Java API minor fix (fed60ef)

Downloads

Platform-specific releases:

renef-v0.3.3-linux-x64.tar.gz - Linux x64 client + scripts
renef-v0.3.3-macos-x64.tar.gz - macOS Intel client + scripts
renef-v0.3.3-macos-arm64.tar.gz - macOS Silicon client + scripts
renef-v0.3.3-android-arm64.tar.gz - Android server + payload

All-in-one release:

renef-v0.3.3-all-platforms.tar.gz - All platforms + scripts

Verification

Verify downloads using SHA256 checksums in SHA256SUMS.txt

Quick Start

tar xzf renef-v0.3.3-linux-x64.tar.gz
cd renef-linux-x64

adb push ../renef-android-arm64/renef_server /data/local/tmp/
adb push ../renef-android-arm64/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server

adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit
adb shell /data/local/tmp/renef_server &
./renef

Documentation

System Requirements

Client:

Linux (x64) or macOS (Intel/Silicon)
libreadline (Linux/macOS)

Target Device:

Android 5.0+ (API 21+)
ARM64 architecture
Root access (for injection)

Dependencies

Built with:

Capstone 5.0.3
Lua 5.4.7
ASIO 1-30-2
Android NDK r26b

Renef v0.3.2

Dynamic Instrumentation Toolkit for Android ARM64

What's New

Agent Path Fix: Fixed an issue where the agent file was being deleted by unlink() after injection, causing crashes and injection failures on subsequent runs. The payload path is now consistent across all injection stages. See PR #13 for details.
**Java Hook **: Added support in callbacks to skip calling the original method entirely. Essential for void methods that throw exceptions (e.g., ) and prevents ART stack walk crashes on Android 16 when multiple hooked methods are nested.
onEnter Arg Modification Fix: Fixed a bug where modifying arguments in (e.g., ) had no effect. The args table is now read back after the Lua callback, and changes are written to the saved registers.
ExceptionClear for All Hooks: now unconditionally clears pending Java exceptions after calling the original method. Previously this only worked when an callback was registered.
Android 16 Conscrypt Support: Added (byte[][]) signature variant for , which changed from long[] to byte[][] on Android 16.
Network Security Config Hooks: Added and hooks with Socket/SSLEngine overloads for full Android Network Security Config bypass coverage.
Java API Additions (v0.3.1+):
- — Register Java classes at runtime with Lua-backed method implementations
- — Create Java arrays from Lua tables
- — Access raw ART pointer from JavaInstance userdata
SSL Unpin Script: Updated with 30+ bypass targets including Conscrypt, OkHttp3, Squareup, Trustkit, Apache, Netty, Fabric, Appmattus, Cordova, WebView, Cronet, and more.
Some API fixes for Lua script side (cdca3de)
Lua script execution fix (eea12cd)
Java registerClass() and array() apis added (e9a3d9b)
fix: resolve macOS binary corruption and add automatic code signing (887d062)
Wrong folder/file name fixed (af25e74)

Downloads

Platform-specific releases:

renef-v0.3.2-linux-x64.tar.gz - Linux x64 client + scripts
renef-v0.3.2-macos-x64.tar.gz - macOS Intel client + scripts
renef-v0.3.2-macos-arm64.tar.gz - macOS Silicon client + scripts
renef-v0.3.2-android-arm64.tar.gz - Android server + payload

All-in-one release:

renef-v0.3.2-all-platforms.tar.gz - All platforms + scripts

Verification

Verify downloads using SHA256 checksums in SHA256SUMS.txt

Quick Start

tar xzf renef-v0.3.2-linux-x64.tar.gz
cd renef-linux-x64

adb push ../renef-android-arm64/renef_server /data/local/tmp/
adb push ../renef-android-arm64/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server

adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit
adb shell /data/local/tmp/renef_server &
./renef

Documentation

System Requirements

Client:

Linux (x64) or macOS (Intel/Silicon)
libreadline (Linux/macOS)

Target Device:

Android 5.0+ (API 21+)
ARM64 architecture
Root access (for injection)

Dependencies

Built with:

Capstone 5.0.3
Lua 5.4.7
ASIO 1-30-2
Android NDK r26b

Renef v0.3.1

Dynamic Instrumentation Toolkit for Android ARM64

What's New

Java API (Java.use, wrapper:call, wrapper:new, instance:call)
Direct access to Java classes from Lua scripts. Supports class loading, instance creation, and calling both static and instance methods via JNI. All primitive types and Object conversions are handled automatically. Falls back to the application's ClassLoader for app-specific classes not visible to the system classloader.
```
local System = Java.use("java/lang/System")
local time = System:call("currentTimeMillis", "()J")

local StringBuilder = Java.use("java/lang/StringBuilder")
local sb = StringBuilder:new("()V")
sb:call("append", "(Ljava/lang/String;)Ljava/lang/StringBuilder;", "Hello")
```
Verbose Mode (-v / --verbose)
Shows agent debug output from logcat during spawn, attach, and script loading (l). Useful for troubleshooting injection and hook issues.
```
./build/renef -s com.example.app -v
```
```
renef> spawn com.android.settings -v
OK 21401
renef (com.android.settings)> 
```
Version update to 0.3.1 (5f97ded)
Java API calls added (869e135)
Verbose mode added (1eb2619)

Downloads

Platform-specific releases:

renef-v0.3.1-linux-x64.tar.gz - Linux x64 client + scripts
renef-v0.3.1-macos-x64.tar.gz - macOS Intel client + scripts
renef-v0.3.1-macos-arm64.tar.gz - macOS Silicon client + scripts
renef-v0.3.1-android-arm64.tar.gz - Android server + payload

All-in-one release:

renef-v0.3.1-all-platforms.tar.gz - All platforms + scripts

Verification

Verify downloads using SHA256 checksums in SHA256SUMS.txt

Quick Start

tar xzf renef-v0.3.1-linux-x64.tar.gz
cd renef-linux-x64

adb push ../renef-android-arm64/renef_server /data/local/tmp/
adb push ../renef-android-arm64/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server

adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit
adb shell /data/local/tmp/renef_server &
./renef

Documentation

System Requirements

Client:

Linux (x64) or macOS (Intel/Silicon)
libreadline (Linux/macOS)

Target Device:

Android 5.0+ (API 21+)
ARM64 architecture
Root access (for injection)

Dependencies

Built with:

Capstone 5.0.3
Lua 5.4.7
ASIO 1-30-2
Android NDK r26b

Renef v0.3.0

Dynamic Instrumentation Toolkit for Android ARM64

What's New

Gadget Mode (-g <pid>): Run renef on non-rooted devices by embedding libagent.so into APK
Unified Commands: Agent now uses same command names as CLI (exec, la, md, hookn)
Makefile helpers: make gadget-forward PID=<pid>, make forward-list, make forward-clean

Usage

# Patch APK with libagent.so, install, then:
make gadget-forward PID=$(adb shell pidof com.example.app)
./build/renef -g <pid>

Version updated to 0.3.0 (a9d57f6)
Gadget mode added for non-root devices (3379a81)

Downloads

Platform-specific releases:

renef-v0.3.0-linux-x64.tar.gz - Linux x64 client + scripts
renef-v0.3.0-macos-x64.tar.gz - macOS Intel client + scripts
renef-v0.3.0-macos-arm64.tar.gz - macOS Silicon client + scripts
renef-v0.3.0-android-arm64.tar.gz - Android server + payload

All-in-one release:

renef-v0.3.0-all-platforms.tar.gz - All platforms + scripts

Verification

Verify downloads using SHA256 checksums in SHA256SUMS.txt

Quick Start

tar xzf renef-v0.3.0-linux-x64.tar.gz
cd renef-linux-x64

adb push ../renef-android-arm64/renef_server /data/local/tmp/
adb push ../renef-android-arm64/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server

adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit
adb shell /data/local/tmp/renef_server &
./renef

Documentation

System Requirements

Client:

Linux (x64) or macOS (Intel/Silicon)
libreadline (Linux/macOS)

Target Device:

Android 5.0+ (API 21+)
ARM64 architecture
Root access (for injection)

Dependencies

Built with:

Capstone 5.0.3
Lua 5.4.7
ASIO 1-30-2
Android NDK r26b

@AbhiTheModder

Renef v0.2.4

Dynamic Instrumentation Toolkit for Android ARM64

What's New

Agent Path Fix: Fixed an issue where the agent file was being deleted by unlink() after injection, causing crashes and injection failures on subsequent runs. The payload path is now consistent across all injection stages. See PR #13 for details.

Tested on PC and Termux environments across Google Pixel and Xiaomi Redmi devices. All injection and hook operations verified stable.

Thanks to @AbhiTheModder and @fatalSec for their feedback and contributions.

Version updated to 0.2.4 (33ab784)
fix: unlink() removed (2f0ccb6)
fix: duplicate agent paths (a0532bb)
Added injected app PID/pkg name to the CLI (a5e66a4)
fix: shellcode payload and agent path resolution (fa3e6b3)

Downloads

Platform-specific releases:

renef-v0.2.4-linux-x64.tar.gz - Linux x64 client + scripts
renef-v0.2.4-macos-x64.tar.gz - macOS Intel client + scripts
renef-v0.2.4-macos-arm64.tar.gz - macOS Silicon client + scripts
renef-v0.2.4-android-arm64.tar.gz - Android server + payload

All-in-one release:

renef-v0.2.4-all-platforms.tar.gz - All platforms + scripts

Verification

Verify downloads using SHA256 checksums in SHA256SUMS.txt

Quick Start

tar xzf renef-v0.2.4-linux-x64.tar.gz
cd renef-linux-x64

adb push ../renef-android-arm64/renef_server /data/local/tmp/
adb push ../renef-android-arm64/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server

adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit
adb shell /data/local/tmp/renef_server &
./renef

Documentation

System Requirements

Client:

Linux (x64) or macOS (Intel/Silicon)
libreadline (Linux/macOS)

Target Device:

Android 5.0+ (API 21+)
ARM64 architecture
Root access (for injection)

Dependencies

Built with:

Capstone 5.0.3
Lua 5.4.7
ASIO 1-30-2
Android NDK r26b

@AbhiTheModder

Renef v0.2.3

Dynamic Instrumentation Toolkit for Android ARM64

What's New

Java String Return Value Support: Read and modify Java String return values in onLeave callbacks. The retval parameter now includes both raw pointer (retval.raw) and string value (retval.value). Use JNI.string() to create new strings.

-- Test script for Java String return values
-- Target: com.example.reneftestapp

print("[*] Starting Java String hook test...")

-- Hook childHook - modify return value
hook("com/example/reneftestapp/MainActivity", "childHook", "(Ljava/lang/String;)Ljava/lang/String;", {
    onEnter = function(args)
        print("[+] childHook called")
        print("    this = " .. string.format("0x%x", args[1]))
        print("    param (jstring ref) = " .. string.format("0x%x", args[2]))
    end,
    onLeave = function(retval)
        print("[+] childHook onLeave")
        print("    Original: \"" .. (retval.value or "nil") .. "\"")

        -- Modify the return value!
        local newValue = "HOOKED BY RENEF!"
        print("    Replacing with: \"" .. newValue .. "\"")

        return JNI.string(newValue)
    end
})

-- Hook parentHook - just observe
hook("com/example/reneftestapp/MainActivity", "parentHook", "(Ljava/lang/String;)Ljava/lang/String;", {
    onEnter = function(args)
        print("[+] parentHook called")
        print("    this = " .. string.format("0x%x", args[1]))
        print("    param (jstring ref) = " .. string.format("0x%x", args[2]))
    end,
    onLeave = function(retval)
        print("[+] parentHook onLeave")
        print("    Return (raw ref): " .. string.format("0x%x", retval.raw))
        if retval.value then
            print("    Return (string): \"" .. retval.value .. "\"")
        end
        return retval.raw
    end
})

print("[+] Hooks installed!")
print("[*] childHook return value will be replaced with 'HOOKED BY RENEF!'")

Android Client for Termux: Run renef client directly on device without a PC. Build with make client-android and deploy with make deploy-local.

# Build Android client
make client-android
make deploy-local

# In Termux/ADB shell
su
/data/local/tmp/renef_server &
/data/local/tmp/renef --local

Nested Java Hook Support: Full support for recursive/nested Java method hooks with proper call stack tracking.
File API Fix: File.read() now correctly handles /proc files and other special files.

Thanks to @AbhiTheModder and @fatalSec for their feedback.

Version updated (4a3e12c)
Java onLeave() type-casting problem fixed (fb32602)
add termux / standalone build support (d40f96d)
funding.yml added (7c376b0)

Downloads

Platform-specific releases:

renef-v0.2.3-linux-x64.tar.gz - Linux x64 client + scripts
renef-v0.2.3-macos-x64.tar.gz - macOS Intel client + scripts
renef-v0.2.3-macos-arm64.tar.gz - macOS Silicon client + scripts
renef-v0.2.3-android-arm64.tar.gz - Android server + payload

All-in-one release:

renef-v0.2.3-all-platforms.tar.gz - All platforms + scripts

Verification

Verify downloads using SHA256 checksums in SHA256SUMS.txt

Quick Start

tar xzf renef-v0.2.3-linux-x64.tar.gz
cd renef-linux-x64

adb push ../renef-android-arm64/renef_server /data/local/tmp/
adb push ../renef-android-arm64/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server

adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit
adb shell /data/local/tmp/renef_server &
./renef

Documentation

System Requirements

Client:

Linux (x64) or macOS (Intel/Silicon)
libreadline (Linux/macOS)

Target Device:

Android 5.0+ (API 21+)
ARM64 architecture
Root access (for injection)

Dependencies

Built with:

Capstone 5.0.3
Lua 5.4.7
ASIO 1-30-2
Android NDK r26b

Renef v0.2.2

Dynamic Instrumentation Toolkit for Android ARM64

What's New

Nested Java Hook Support: Full support for recursive/nested Java method hooks. When a hooked method calls another hooked method, both hooks trigger correctly.

// Java code
public String parentHook(String s) {
    return childHook(s);  // calls another hooked method
}

-- Both hooks work correctly
hook("com/example/App", "parentHook", "(Ljava/lang/String;)Ljava/lang/String;", {
    onEnter = function(args) print("[PARENT] onEnter") end,
    onLeave = function(ret) print("[PARENT] onLeave") return ret end
})
hook("com/example/App", "childHook", "(Ljava/lang/String;)Ljava/lang/String;", {
    onEnter = function(args) print("[CHILD] onEnter") end,
    onLeave = function(ret) print("[CHILD] onLeave") return ret end
})

Output:

[PARENT] onEnter
[CHILD] onEnter
[CHILD] onLeave
[PARENT] onLeave

File API Fix: File.read() now correctly handles /proc files and other special files.
macos build fixed (966c1a8)
version updated, release note changed (4051abf)
nested java hook fixed (3be0917)
readelf command changed to native elf parser (a86b0cd)

Downloads

Platform-specific releases:

renef-v0.2.2-linux-x64.tar.gz - Linux x64 client + scripts
renef-v0.2.2-macos-x64.tar.gz - macOS Intel client + scripts
renef-v0.2.2-macos-arm64.tar.gz - macOS Silicon client + scripts
renef-v0.2.2-android-arm64.tar.gz - Android server + payload

All-in-one release:

renef-v0.2.2-all-platforms.tar.gz - All platforms + scripts

Verification

Verify downloads using SHA256 checksums in SHA256SUMS.txt

Quick Start

tar xzf renef-v0.2.2-linux-x64.tar.gz
cd renef-linux-x64

adb push ../renef-android-arm64/renef_server /data/local/tmp/
adb push ../renef-android-arm64/libagent.so /data/local/tmp/.r
adb shell chmod +x /data/local/tmp/renef_server

adb forward tcp:1907 localabstract:com.android.internal.os.RuntimeInit
adb shell /data/local/tmp/renef_server &
./renef

Documentation

System Requirements

Client:

Linux (x64) or macOS (Intel/Silicon)
libreadline (Linux/macOS)

Target Device:

Android 5.0+ (API 21+)
ARM64 architecture
Root access (for injection)

Dependencies

Built with:

Capstone 5.0.3
Lua 5.4.7
ASIO 1-30-2
Android NDK r26b

Uh oh!

Releases: Ahmeth4n/renef

Renef v0.3.6

Renef v0.3.6

What's New

Downloads

Verification

Quick Start

Documentation

System Requirements

Dependencies

Uh oh!

Renef v0.3.5

Renef v0.3.5

What's New

Downloads

Verification

Quick Start

Documentation

System Requirements

Dependencies

Uh oh!

Renef v0.3.4

Renef v0.3.4

What's New

Downloads

Verification

Quick Start

Documentation

System Requirements

Dependencies

Uh oh!

Renef v0.3.3

Renef v0.3.3

What's New

Downloads

Verification

Quick Start

Documentation

System Requirements

Dependencies

Uh oh!

Renef v0.3.2

Renef v0.3.2

What's New

Downloads

Verification

Quick Start

Documentation

System Requirements

Dependencies

Uh oh!

Renef v0.3.1

Renef v0.3.1

What's New

Downloads

Verification

Quick Start

Documentation

System Requirements

Dependencies

Uh oh!

Renef v0.3.0

Renef v0.3.0

What's New

Usage

Downloads

Verification

Quick Start

Documentation

System Requirements

Dependencies

Uh oh!

Renef v0.2.4

Renef v0.2.4

What's New

Downloads

Verification

Quick Start

Documentation