Skip to content
Dynamic Instrumentation

Instrument Android at Runtime.

Lightweight ARM64 toolkit for security researchers. Hook functions, manipulate memory, and analyze native code - all without ptrace or TCP.

View on GitHubDocumentation
  • No ptrace
  • Unix Domain Sockets
  • Lua 5.4

Why Renef?

Less complexity. More control.

Renef was built for researchers who need something minimal, stealthy, and fully controllable.

Challenge
Our Approach

  • Heavy frameworks are hard to extend

    Minimal and focused - easy to understand and modify

  • TCP communication is easily detected

    Unix Domain Sockets - process-level isolation

  • ptrace triggers security checks

    memfd + shellcode injection avoids detection

  • Limited control over internals

    Full ownership - tweak anything you want

Architecture

How Renef Works

A lightweight client-server architecture with memfd-based injection.

  1. Client CLI

    macOS / Linux

  2. Server

    Android ARM64

  3. Target Process

    libagent.so + Lua

  1. 1
    Client CLI

    Client connects via TCP port 1907 (ADB-forwarded) to the server running on Android

  2. 2
    Server

    Server injects payload using memfd + shellcode - no ptrace required

  3. 3
    Target Process

    libagent.so executes Lua scripts inside the target process context

Features

Everything you need for ARM64 analysis

A focused toolkit with the capabilities that matter most.

renef · features

renef › feature/native_hooking

Native Hooking

PLT/GOT and inline trampoline hooks for ARM64. Intercept any native function with Capstone-based disassembly.

Use Cases

Real-world applications

Battle-tested techniques for security research and reverse engineering.

Intercept and modify certificate validation to analyze encrypted traffic.

SSL Pinning Bypass
hook("SSL_CTX_set_verify", {
  onEnter: (args) => {
    args[1] = SSL_VERIFY_NONE
  }
})
View example
Getting Started

Up and running in minutes

Clone, build, and start instrumenting Android apps.

Requires: macOS or Linux, ADB, Android device with ARM64 architecture

Terminal
  1. # Clone and build
    git clone https://github.com/Ahmeth4n/renefcd renef && make
  2. # Push server to device
    adb push server /data/local/tmp/adb shell chmod +x /data/local/tmp/server
  3. # Start server on device
    adb shell /data/local/tmp/server &
  4. # Forward port
    adb forward tcp:1907 localabstract:renef
  5. # Connect and start instrumenting
    ./renef -s com.byteria.keepsafe

Ready to instrument?

Renef is open source and free to use. Dive into the code, contribute features, or just use it in your security research.

View on GitHubRead the Docs
  • Open Source
  • ARM64 Native
  • Lua Scripting
  • No ptrace