Gurz

> [!INFO]
> The name **Gürz** (pronounced *gyurz*) is an old word for a heavy mace. I picked it because the tool is a blunt, heavy instrument for breaking malware apart.

[[Gurz]] is a desktop app for the #static-analysis of #android #malware. I built it in 2014 under a research grant as a #gui on top of the #androguard library, extending its backend to speed up the daily #reverse-engineering work.

It helps with writing signatures and quickly working through malicious #APK and #DEX files. I wrote it with #python and #pyside ( #qt ), so the interface stays responsive and multi-threaded. It also keeps a custom caching layer (`gzworkspace`) that serializes analyzed objects to disk, so reopening an earlier session is instant.

![Decompiled Source Code](/images/gurz/source_code.webp)
![Overview](/images/gurz/overview.webp)
![Manifest](/images/gurz/manifest.webp)
![Strings](/images/gurz/strings.webp)
![Internal Commands|0.5](/images/gurz/process.webp)
![Decompiled Class List](/images/gurz/class_names.webp)
![Hex](/images/gurz/hex.webp)