NOIR is a command-line tool that connects over ADB to audit Android applications, app manifests, and network endpoints without requiring root access or cloud uploads. It parses binary XML, correlates dangerous permissions with telemetry or tracking domains, and generates risk scores and executable rollback commands locally. You can run a quick interactive scan or invoke deep checks using jadx to inspect specific APKs.
It is worth running if you want an actionable inventory of what installed apps can access and where they might phone home. The catch is that static endpoint extraction from dex strings will flag dead domains and false positives, requiring you to manually triage the output. It is not an automated firewall or a substitute for network traffic inspection.
more: https://github.com/Verlintas/NOIR
my other side: ivo.blogspot.com
Leave a Reply