Mobile Security Research Framework v0.3.10

Mobile Security Research Framework v0.3.10

Self-contained Mobile & IoT SAST / DAST / pentest toolkit (desktop app + CLI + MCP server).

Download

Windows: run MSRF-<version>-setup.exe, or unzip MSRF-windows-x86_64.zip. Linux and macOS: unzip the MSRF-*.zip for your OS and run msrf. Everything is bundled, nothing else to install. Each file has a matching .sha256 for verification.

Added

• Activity log (a new Activity tab), inspired by Core Impact's Executed Modules console: every task the app runs is recorded with its status, start and elapsed time, and a detail pane with three tabs, Output (the result), Log (errors or messages) and Parameters. The history is saved to the workspace so it survives a restart.
• One-Step Assessment: a new workflow engine that runs a whole static assessment in one call (scan an app, collect its findings, generate a report) and a dynamic smoke test (key Frida checks on the simulator). There is a One-Step button on the Static tab, and because every action is exposed on the CLI and the MCP server, an AI client can run these end-to-end too (workflow_static_assessment, workflow_dynamic_smoke).

Mobile Security Research Framework v0.3.9

Mobile Security Research Framework v0.3.9

Self-contained Mobile & IoT SAST / DAST / pentest toolkit (desktop app + CLI + MCP server).

Download

Windows: run MSRF-<version>-setup.exe, or unzip MSRF-windows-x86_64.zip. Linux and macOS: unzip the MSRF-*.zip for your OS and run msrf. Everything is bundled, nothing else to install. Each file has a matching .sha256 for verification.

Changed

• Dashboard redesigned. The engine table now shows just the name and status, with an "i" button per engine that opens its full details in a dialog. Alongside it are charts of the findings collected so far: counts by severity (bar and donut), findings by source, and an engine-readiness donut. Charts are drawn with QPainter (no extra dependency) and follow the light and dark theme.

Mobile Security Research Framework v0.3.8

Mobile Security Research Framework v0.3.8

Self-contained Mobile & IoT SAST / DAST / pentest toolkit (desktop app + CLI + MCP server).

Download

Windows: run MSRF-<version>-setup.exe, or unzip MSRF-windows-x86_64.zip. Linux and macOS: unzip the MSRF-*.zip for your OS and run msrf. Everything is bundled, nothing else to install. Each file has a matching .sha256 for verification.

Added

• Frida hooks tab rebuilt into Library, Custom hook and Multi-hook. Copy the current script to the clipboard or send it to the editor; in Custom, type or paste any Frida JavaScript and load or save it anywhere; in Multi-hook, list many classes and methods (and library hooks) and run them all on one app in a single injection. New engine actions back these: hooks save_script, hooks combine, and a source argument on hooks test.
• Settings tab: theme, workspace, log level, MobSF offline-profile toggles, proxy ports and emulator defaults, saved to the config file and restored next launch. Theme and emulator defaults apply immediately.
• Quality-of-life: drag an APK or IPA onto the window to analyse it; right-click any results table to copy rows as TSV, JSON or Markdown; a filter box on the Findings tab; the window remembers its size and position; file dialogs remember the last folder; File menu gains Open Workspace Folder and Settings (Ctrl+,).

Fixed

• CLI: a log level set in the config file or environment is no longer overridden by the default, and a bad --params value reports a clean error instead of a traceback.
• Findings: an unreadable store is backed up instead of being silently overwritten with an empty list.
• Frida test: a spawned app is killed if injection fails, so it is not left frozen on the device.
• App data: pull rejects device paths that escape the workspace.
• Internals: background processes no longer leak a file handle per start, and a fast command is never wrongly reported as timed out.

Changed

• Repository moved to github.com/keyuraghao/Mobile-Security-Research-Framework; links updated.

Mobile Security and Research Framework v0.3.7

Mobile Security and Research Framework v0.3.7

Self-contained Mobile & IoT SAST / DAST / pentest toolkit (desktop app + CLI + MCP server).

Download

Windows: run MSRF-<version>-setup.exe, or unzip MSRF-windows-x86_64.zip. Linux and macOS: unzip the MSRF-*.zip for your OS and run msrf. Everything is bundled, nothing else to install. Each file has a matching .sha256 for verification.

Fixed

• Emulator launch now checks first whether the PC can run an emulator (hardware virtualization, via emulator -accel-check). If it cannot, it stops straight away with step-by-step instructions for Windows, Linux or macOS instead of trying to launch.
• If the emulator closes right after starting, the app reports it at once with the reason from the log, instead of waiting up to 5 minutes.
• The emulator is started with -no-metrics when supported, so its usage-metrics banner (announced to become a blocking prompt) can never stall the launch.
• Boot checks talk to the emulator with adb -e, so a phone plugged in at the same time cannot confuse them.

Added

• Check PC support button on the Emulator tab (and emulator accel-check on the CLI/MCP); Status now shows whether hardware acceleration is available.

Mobile Security and Research Framework v0.3.6

Mobile Security and Research Framework v0.3.6

Self-contained Mobile & IoT SAST / DAST / pentest toolkit (desktop app + CLI + MCP server).

Download

Windows: run MSRF-<version>-setup.exe, or unzip MSRF-windows-x86_64.zip. Linux and macOS: unzip the MSRF-*.zip for your OS and run msrf. Everything is bundled, nothing else to install. Each file has a matching .sha256 for verification.

Changed

• Removed every em-dash and en-dash from the app and the repo: technique labels now read like "Enumerate: devices" and "Device: capture logcat", status messages like "Analysis complete: score 36/100", and the Help, docstrings and comments use normal punctuation.
• CHANGELOG, README, CONTRIBUTING and SECURITY keep each sentence, bullet and paragraph on one line instead of breaking lines mid-sentence, so release notes read cleanly on GitHub.
• README screenshots regenerated to match.

Mobile Security and Research Framework v0.3.5

Mobile Security and Research Framework v0.3.5

Self-contained Mobile & IoT SAST / DAST / pentest toolkit (desktop app + CLI + MCP server).

Download

Windows: run MSRF-<version>-setup.exe, or unzip MSRF-windows-x86_64.zip. Linux and macOS: unzip the MSRF-*.zip for your OS and run msrf. Everything is bundled, nothing else to install. Each file has a matching .sha256 for verification.

Changed

• Emulator works the normal Android SDK way. Launch opens the standard emulator in its own window (like Android Studio). Root-only flags are no longer used for a normal launch; Magisk, LSPosed and Xposed modules moved to an optional Advanced section.
• The Emulator tab now has an Activity box (what is running and for how long, with a warning if a step goes quiet), a progress bar, and a Live log that streams every line each step writes. The log is also saved to logs/emulator.log (Open log file / Copy path buttons, and emulator log_tail on the CLI/MCP) so a hang can be diagnosed.
• Findings tables sort by severity rank (high, warning, info) instead of alphabetically, most severe first by default.

Fixed

• The app no longer "refreshes itself": the background connection check is quiet (no progress-bar flash) and runs every 30 s instead of 6 s, and on Windows no console window flashes when the app runs adb or other tools.
• Rooted all-in-one no longer starts a second emulator; it stops and waits before restarting after rooting.
• Emulator downloads show progress and use a .part file, so an interrupted download can no longer leave a broken file that gets reused.
• Long emulator steps are killed by their timeout even if they print nothing.
• Dynamic tab: with Target = Simulator, the Enumerate techniques now answer from the simulator instead of failing with "device not found"; hardware-only techniques explain that a device or the emulator is needed.
• File browser shows AndroidManifest.xml and other compiled XML as readable XML (decoded from Android binary XML); other binary files show a proper hex dump.
• Disabled primary buttons now look disabled.

Docs

• All README screenshots regenerated from the current build by the new packaging/capture_screenshots.py (real DIVA scan, neutral paths). README download section, tab list and emulator description brought up to date.

Mobile Security and Research Framework v0.3.4

Mobile Security and Research Framework v0.3.4

Self-contained Mobile & IoT SAST / DAST / pentest toolkit (desktop app + CLI + MCP server).

Download

Windows: run MSRF-<version>-setup.exe, or unzip MSRF-windows-x86_64.zip. Linux and macOS: unzip the MSRF-*.zip for your OS and run msrf. Everything is bundled, nothing else to install. Each file has a matching .sha256 for verification.

Changed

• Renamed the package, command and pip distribution from mobiot to msrf to match the product name (Mobile Security and Research Framework). The CLI/MCP command is now msrf (with msrf-mcp and msrf-gui), the Python package is msrf, the pip distribution and wheel are msrf-<version>, environment variables use the MSRF_ prefix, and MCP tools are msrf_*. Release titles and all downloadable app files already use the product name / MSRF-*.

Mobile Security and Research Framework v0.3.3

Mobile Security and Research Framework v0.3.3

Self-contained Mobile & IoT SAST / DAST / pentest toolkit (desktop app + CLI + MCP server).

Download

Windows: run MSRF-<version>-setup.exe, or unzip MSRF-windows-x86_64.zip. Linux and macOS: unzip the MSRF-*.zip for your OS and run msrf. Everything is bundled, nothing else to install. Each file has a matching .sha256 for verification.

Added

• Windows installer: a proper Inno Setup installer (MSRF-<version>-setup.exe) built in CI alongside the portable bundle: Start-menu and optional desktop shortcuts, an opt-in "add to PATH" for the CLI/MCP, per-user workspace cleanup on uninstall, and the app icon. Attached to every release with a .sha256.
• Light / Dark / System theme: a Fusion-based theming system (View menu -> Theme) with palette + stylesheet for both modes, severity colours legible on either, persisted via QSettings. Follows the OS in System mode.
• Application icon / favicon shipped as icon.ico (multi-size) and icon.png, used for the window, the installer, and the built executable.

Changed

• Renamed to "Mobile Security and Research Framework" across the desktop app (window title, About dialog, display name), Help tab, installer and README. The package, CLI command and MCP server name remain msrf for compatibility.

Mobile Security and Research Framework v0.3.2

Mobile Security and Research Framework v0.3.2

Self-contained Mobile & IoT SAST / DAST / pentest toolkit (desktop app + CLI + MCP server).

Download

Windows: run MSRF-<version>-setup.exe, or unzip MSRF-windows-x86_64.zip. Linux and macOS: unzip the MSRF-*.zip for your OS and run msrf. Everything is bundled, nothing else to install. Each file has a matching .sha256 for verification.

Fixed

• Emulator setup now resolves an actually-available system image for the chosen API level (with type/ABI fallbacks) instead of failing on non-existent combos (e.g. API 7 has no x86_64 image); a new List images action/button shows what's installable. Clear error naming the API levels that do have images.

Added

• Full MobSF Frida script library exposed through the hooks engine (hooks.mobsf_scripts / mobsf_script_source, and hooks.test --mobsf-script): all ~118 MobSF-bundled scripts for Android and iOS (API monitor, SSL/root/ debugger/jailbreak bypasses, crypto & keychain dumps, activity/deeplink traces, biometric bypass, and the whole others/ library). The Dynamic (DAST) dropdown now offers 150+ techniques.
• On-device DAST techniques (adb): dast.install_app, pull_apk, logcat, dumpsys, screenshot, start_activity, activity_tester, deeplink, matching MobSF's device operations.
• Static-analysis rendering completeness: dedicated GUI tables for every analyzer that was previously Raw-JSON-only (APKID, behaviour, NIAP, permission-mapping, SBOM; emails + firebase folded into URLs), plus an iOS tab (Info.plist, ATS, Mach-O, dylib/framework, App Store).

Notes

• SAST already runs every MobSF analyzer for APK/IPA (msrf calls MobSF's apk_analysis_task/ipa_analysis_task directly). Remaining coverage items are specialised: source-zip / .aab / .appx / .so inputs (same analyzers, different container), a native TLS-tester harness, Frida-gadget APK patching for non-rooted, and the full iOS dynamic (Corellium/jailbroken-SSH) subsystem.

Mobile Security and Research Framework v0.3.1

Mobile Security and Research Framework v0.3.1

Self-contained Mobile & IoT SAST / DAST / pentest toolkit (desktop app + CLI + MCP server).

Download

Windows: run MSRF-<version>-setup.exe, or unzip MSRF-windows-x86_64.zip. Linux and macOS: unzip the MSRF-*.zip for your OS and run msrf. Everything is bundled, nothing else to install. Each file has a matching .sha256 for verification.

Added

• Dockable live emulator screen: a side-by-side panel that mirrors a connected emulator/device (screencap polling, tap + hardware-key forwarding via the bundled adb) and can be floated into its own window, so it stays usable while working in any other tab (View menu / toolbar toggle).
• Emulator API-level dropdown spans API 7 (Android 2.1) to 35 (Android 15).
• In-app emulator flow guide on the Emulator and Help tabs (step-by-step provisioning).
• Automated releases: per-release notes generated from CHANGELOG.md and a .sha256 checksum attached for every asset; README status badges (CI, release, downloads, Python, platforms, license).

Fixed

• Emulator (and other) downloads failed with SSL: CERTIFICATE_VERIFY_FAILED in the standalone app; downloads now use httpx with the bundled certifi CA store.
• emulator setup now auto-downloads the Android command-line tools (using the bundled JRE) and installs the emulator + system image, instead of erroring when no SDK is present.
• LSPosed / Magisk / Xposed-module downloads resolve the latest release via the GitHub API (no more 404s), preferring release over debug builds.