Repolode
Submit
Verlintas

Verlintas/NOIR

A desktop CLI that audits an Android phone over adb, listing app permissions, reporting endpoints and data flows, with reversible fixes.

View on GitHub
Stars
2,740
Forks
257
Open issues
0
Last commit
yesterday

What is it?

NOIR is a desktop audit tool for Android devices connected over adb. It lists apps that hold both network and sensitive permissions, extracts URLs from each APK's dex files on the device, and classifies apps by vendor and category. It then maps permissions to the kinds of data they can access, such as location, contacts, SMS or the app list, and pairs them with the domains each app reports to, so you can see which data may flow where.

The tool scores risk and produces recommended actions, separating changes that are safe to automate from those needing manual review. Automated changes are limited to app-ops adjustments, each with a generated rollback command; uninstalling apps requires an explicit flag. The optional deep command pulls a single APK, decompiles it with jadx, and searches for high-risk calls such as Runtime.exec or DexClassLoader.

NOIR runs locally with no telemetry or account, does not need root, and writes reports in JSON and Markdown along with a domain list importable into Pi-hole or AdGuard. It supports macOS, Windows and Debian/Ubuntu. Its findings are static evidence and do not prove that a particular transfer happened.

Key features

  • 01Lists apps holding both network and sensitive permissions, with the data each permission can reach.
  • 02Extracts reporting endpoints on the device, returning only small text results to the computer.
  • 03Scores and classifies apps by vendor and category such as telemetry or advertising.
  • 04Parses AndroidManifest for exported components, cleartext traffic, backup and debuggable flags.
  • 05Applies app-ops changes only with rollback commands; uninstalling requires an explicit flag.
  • 06Exports a domain list for Pi-hole or AdGuard.

Use cases

  • Checking which preinstalled apps on your own Android phone send data to third-party domains.
  • Reviewing an app's decompiled code for risky calls before trusting it.
  • Generating a domain blocklist to load into a home DNS filter.
  • Reversibly restricting background app operations on a personal device.

Quick start

  1. 1

    Clone the repository from GitHub

    git clone https://github.com/Verlintas/NOIR
  2. 2

    Build the CLI from the project folder

    ./gradlew :cli:installDist
  3. 3

    Run NOIR to print its about information

    ./cli/build/install/noir/bin/noir --about

Things to know

  • Targets Android phones only; iOS is not supported.
  • Building from source requires JDK 17+ and adb, and the phone must have USB debugging enabled.
  • Results are static evidence and cannot prove that a specific data transfer happened.
  • The deep command also needs jadx installed separately.

In collections

Android ADB and debloat toolsCLI & terminal toolsPrivacy & local-first toolsAndroid apps & phone tools

Topics

#android#privacy#security-audit#adb#reverse-engineering#debloat#cli#telemetry#android-privacy#android-security

FAQ

What is NOIR?
A desktop CLI that audits an Android phone over adb, listing app permissions, reporting endpoints and data flows, with reversible fixes. NOIR is a desktop audit tool for Android devices connected over adb. It lists apps that hold both network and sensitive permissions, extracts URLs from each APK's dex files on the device, and classifies apps by vendor and category. It then maps permissions to the kinds of data they can access, such as location, contacts, SMS or the app list, and pairs them with the domains each app reports to, so you can see which data may flow where.
Is NOIR free to use? What license does it have?
NOIR is open source under the MIT license. Check the license terms before using it in commercial products.
Is NOIR still maintained?
Actively maintained. The last commit to NOIR was on Nov 6, 2026.
What can I use NOIR for?
Checking which preinstalled apps on your own Android phone send data to third-party domains. Reviewing an app's decompiled code for risky calls before trusting it. Generating a domain blocklist to load into a home DNS filter. Reversibly restricting background app operations on a personal device.
How do I install NOIR?
Clone the repository from GitHub: git clone https://github.com/Verlintas/NOIR Build the CLI from the project folder: ./gradlew :cli:installDist Run NOIR to print its about information: ./cli/build/install/noir/bin/noir --about
Where can I get NOIR?
The source code and installation instructions are on GitHub: https://github.com/Verlintas/NOIR

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects