MEDUSA : A Comprehensive Framework For Dynamic Mobile Application Analysis

MEDUSA is an extensible and modularized framework designed to automate dynamic analysis processes for Android and iOS applications.

Built on the FRIDA instrumentation toolkit, MEDUSA provides a wide range of tools to enhance penetration testing, malware analysis, and application security reviews.

Key Features

1. Extensive Module Library:
   • Over 90 modules tailored for diverse tasks such as SSL pinning bypass, UI restriction bypass, class enumeration, and monitoring of encryption processes, intents, HTTP communications, and more.
   • Modules can be combined to create custom scripts for specific use cases.
2. Dynamic Monitoring:
   • Tracks API calls commonly used in malware (e.g., spyware, click fraud).
   • Monitors sensitive operations like file uploads, clipboard tracking, and personal data exfiltration.
3. Automation:
   • Simplifies complex tasks like creating Frida hooks or analyzing large-scale applications.
   • Automates repetitive processes such as setting up MITM proxies or patching APKs.
4. Memory Inspection:
   • Enables interactive memory read/write/search for in-depth application analysis.
5. Stheno Subproject:
   • Focused on intent monitoring, Stheno integrates seamlessly with MEDUSA for specialized tasks like tracking Android intents.

To install MEDUSA:

1. Clone the repository: bashgit clone https://github.com/Ch0pin/medusa.git
2. Navigate to the directory and install dependencies: bashpip install -r requirements.txt

• medusa.py: The core script for adding/removing hooks and running modules.
• mango.py: Assists with APK analysis, attack surface enumeration, and proxy configuration.
• Docker Support: Run MEDUSA in a containerized environment for added flexibility: bashdocker build -t medusa:tag1 ./ docker run --name medusa --net=host --rm -it medusa:tag1
• Linux or macOS (Windows not supported).
• Python 3 (latest release recommended).
• Rooted device or emulator with ADB and FRIDA server running.

On macOS, readline compatibility issues may arise. Resolve this by installing gnureadline:

bashpip install gnureadline

MEDUSA is widely used for:

• Penetration testing.
• Malware unpacking and analysis.
• Bypassing security mechanisms like root detection and SSL pinning.

Its modularity and automation capabilities make it an indispensable tool for mobile application security professionals.