SO Analyzer MCP
Provides specialized tools for analyzing Flutter applications, including Flutter version detection, SSL verification function location and patching, and one-click APK patching to bypass certificate validation for packet capture.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
SO Analyzer MCP
Native库(SO文件)分析工具,支持Flutter应用抓包。免费开源的IDA Pro替代品!
🎯 特色功能
✅ 反编译 - 支持radare2/Ghidra/轻量级模式
✅ 函数识别 - 识别所有函数(包括未导出)
✅ 调用图分析 - 生成DOT格式可视化
✅ 控制流图 - 基本块分析
✅ Flutter SSL绕过 - 一键完成
✅ 字符串加密检测 - 熵值分析+XOR检测
Related MCP server: OpenAPK
📊 工具总览 (30个)
SO基础分析 (8个)
工具 | 说明 |
| 检查分析环境 |
| 列出APK中的所有SO库 |
| 从APK提取SO文件 |
| 获取SO基本信息 |
| 获取导出函数列表 |
| 获取导入函数列表 |
| 提取字符串 |
| 搜索符号 |
Flutter专用 (6个)
工具 | 说明 |
| 检测是否是Flutter应用 |
| 获取Flutter版本 |
| 查找SSL验证函数 |
| ⭐智能定位SSL函数 |
| Patch SSL验证(绕过证书) |
| 一键patch Flutter APK |
二进制修改 (5个)
工具 | 说明 |
| 修改指定偏移的字节 |
| 搜索字节模式 |
| 查找并替换字节 |
| 反汇编代码 |
| 获取函数字节码 |
交叉引用分析 (4个)
工具 | 说明 |
| ⭐查找字符串交叉引用 |
| 根据地址查找函数 |
| 分析函数特征 |
| 获取代码段信息 |
⭐ 高级分析 (9个) - NEW!
工具 | 说明 |
| 识别所有函数(包括未导出) |
| 生成调用关系图 + DOT图 |
| 生成控制流图 + DOT图 |
| 全面函数分析 |
| ⭐反编译生成伪代码 |
| 字符串加密检测 |
| 数据流/寄存器追踪 |
| 检查radare2环境 |
| 检查Ghidra环境 |
安装
cd so-analyzer-mcp
pip install -r requirements.txtMCP配置
{
"mcpServers": {
"so-analyzer": {
"command": "python",
"args": ["K:/path/to/so-analyzer-mcp/run_server.py"]
}
}
}使用示例
# 1. 列出SO库
so_list_libs(apk_path="app.apk")
# 2. 检测Flutter
flutter_detect(apk_path="app.apk")
# 3. 提取SO文件
so_extract(apk_path="app.apk", lib_name="libflutter.so", arch="arm64-v8a")
# 4. 搜索SSL相关函数
so_search_symbol(so_path="libflutter.so", pattern="ssl")
# 5. 提取字符串
so_strings(so_path="libflutter.so", search="certificate")项目结构
so-analyzer-mcp/
├── so_analyzer/
│ ├── __init__.py
│ ├── config.py # 配置
│ ├── server.py # MCP服务器 (30个工具)
│ ├── so_utils.py # SO基础分析
│ ├── flutter_utils.py # Flutter专用工具
│ ├── flutter_utils_v2.py # Flutter SSL智能定位
│ ├── patch_utils.py # 二进制修改
│ ├── xref_utils.py # 交叉引用分析
│ ├── advanced_utils.py # 高级分析 (NEW!)
│ └── decompile_utils.py # 反编译工具 (NEW!)
├── radare2/ # radare2 (可选)
├── run_server.py # 启动脚本
├── requirements.txt
└── README.md依赖
必需:
mcp - MCP协议库
lief - 二进制文件解析库
capstone - 反汇编引擎
可选:
radare2 - 反编译 (推荐,~50MB)
Ghidra - 高质量反编译 (~400MB)
已完成功能 ✅
Flutter SSL Patch (一键绕过)
SO文件修改
反编译 (radare2/Ghidra/简单模式)
函数识别 (包括未导出)
调用图分析
控制流图
字符串加密检测
数据流分析
与 IDA Pro MCP 对比
功能 | IDA Pro MCP | SO Analyzer MCP |
反编译 | ✅ Hex-Rays | ✅ radare2 |
函数识别 | ✅ | ✅ |
调用图 | ✅ | ✅ |
控制流图 | ✅ | ✅ |
Flutter SSL | ❌ | ✅ 一键完成 |
APK操作 | ❌ | ✅ |
价格 | $1000+ | 免费 |
This server cannot be deployed
Maintenance
Related MCP Connectors
Scan Android and iOS apps for security issues: findings, MASVS mapping and pentest reports.
Evidence-oriented REA + Ghidra static-analysis workflows, read-only PE32 and Delphi VMT tools.
MCP server for static security analysis of Android source code
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Related MCP Servers
- AlicenseAqualityAmaintenanceEnables Android APK reverse engineering and Flutter runtime injection through a six-step pipeline of decompile, analyze, synthesize, inject, patch, and repackage. Provides MCP tools for authorized security research and penetration testing.943 npm5MIT
- FlicenseNot gradedqualityCmaintenanceEnables mobile application penetration testing with 83+ tools covering Frida instrumentation, APK analysis, decompilation, signing, emulator support, and system compatibility checks.1-
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to conduct authorized mobile banking reverse engineering and security research through 50+ MCP tools spanning APK analysis, Frida instrumentation, malware detection, Play Integrity bypass detection, no-root traffic interception, and evidence reporting.MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to dynamically instrument Android and iOS apps through Frida 17, exposing 40 tools for exploring apps, hooking Java/ObjC/native methods, tracing calls, bypassing SSL pinning, capturing TLS keys and plaintext, and inspecting memory. Results use Ghidra/IDA-style module+offset addresses and carry an evidence envelope, with optional UI automation through mobile-mcp.146 npm19MIT