Verlintas/NOIR

What it does

NOIR is a desktop CLI/TUI that connects to an Android phone over adb and turns "what could this phone leak" into a reproducible report. It inventories apps holding both network and sensitive permissions, extracts URLs from APK dex files on the device, classifies vendors (Xiaomi, Google, Tencent, Amap, etc.) and domains into categories such as telemetry, ads, location or keyboards, and combines permissions with endpoints into a risk score. It also maps permission sets to data types (location, contacts, SMS, calls, microphone, camera, screen, app list, device IDs, files, calendar, accounts) and pairs them with reporting domains to show which data may flow where. Shared UIDs such as android.uid.system are merged back into each package, and AndroidManifest.xml is parsed for exported components without permission protection, cleartext traffic, backups, debuggable flags and targetSdk.

Recommendations are split into safe automatic appops actions, items needing manual review, and things to leave alone; every action gets a rollback command. An optional deep/deepscan path pulls a single APK, decompiles it with jadx, and greps for risky calls like Runtime.exec, DexClassLoader, setApplicationEnabledSetting, MediaProjection, WebView bridges, accessibility/notification listeners and device-admin usage README lines 25–35.

It targets people auditing their own device or an authorized one. It does not run in the cloud, needs no account, does not modify system partitions or require root, and only uninstalls when --aggressive or --purge is explicitly used README lines 36–43.

Quick start

Install in one of two ways:

1. Download the portable package for your platform from Releases (noir-v0.1.1-macOS-portable.zip, noir-v0.1.1-Windows-portable.zip, noir-v0.1.1-Linux-portable.zip, plus SHA256SUMS.txt). Unzip and double-click Start NOIR.command on macOS, Start NOIR.bat on Windows, or run Start-NOIR.sh on Linux after chmod +x. The launcher bundles its own runtime, so no Java install is required. macOS may block the command file (right-click → Open, or clear quarantine), and Windows SmartScreen may prompt. adb and jadx are not bundled; the first run asks whether to download them into ~/.noir/tools README lines 136–169.
2. Build from source, which needs JDK 17+, Android platform-tools, and jadx only for deep:

git clone https://github.com/Verlintas/NOIR
cd NOIR
./gradlew :cli:installDist
./cli/build/install/noir/bin/noir --about

Then connect a phone with USB debugging enabled and run:

noir doctor   # shows platform, java, adb, device and jadx paths
noir          # guided wizard: checks adb, waits for a device, scans, renders dashboard

The wizard asks two or three yes/no questions and finishes with a dashboard. To scan without prompts or to inspect actions first, use noir scan, noir ui, noir auto (dry-run plan), noir auto --apply (safe appops only), or noir deepscan README lines 206–233. Output lands in noir-out/ as report.json, report.md, domains.txt and rollback.txt README lines 257–266. domains.txt can be imported into Pi-hole, AdGuard or a router; NOIR does not change DNS itself.

Constraints

• Supported hosts: macOS (Intel and Apple Silicon), Windows 10/11, and Debian/Ubuntu. iOS is not supported, because the audit depends on Android dumpsys and the APK format.
• Requires JDK 17+ and Android platform-tools (adb); jadx is needed only for deep/deepscan. Paths can be overridden with --adb / --jadx.
• Without root, everything runs through adb shell permissions. Uninstalls are --user 0 only, so the APK stays in the system partition and can return after OTA or factory reset. System apps are usually flagged for manual review rather than true removal.
• Default behavior is fully read-only. --apply changes appops, and can be reverted with default; rollback.txt records the commands. Uninstalling via noir block prints the pm install-existing recovery command first.
• NOIR does not make network requests itself; no telemetry, version check or crash reporting. External downloads happen only in noir setup (adb/jadx) and jadx runs locally. Reports may contain package names and endpoints from your device, so review before sharing README lines 267–273.
• Results are static evidence — an app has a capability and code contains an endpoint — and do not prove that a specific transmission occurred README lines 344–349.
• Results are cached in ~/.noir/endpoints.tsv keyed by package name plus APK path; when an app updates and the path changes it is re-analyzed.
• Licensed MIT README lines 350–352.

HotRepo's take

NOIR appeared on the HotRepo new-project list on 2026-11-02, gaining 416 stars in about 22 hours (from 113 to 529 in the sampled curve), with forks up by 30. The growth is concentrated in the final hours of that window, and no GitHub all-language daily rank is recorded for it, so the recorded data supports a single strong burst rather than a sustained trend. What stands out technically is the choice to do endpoint extraction on the device side with adb shell unzip | strings | grep so hundreds of APKs are not pulled back to the desktop, plus explicit handling of shared UIDs such as android.uid.system README lines 299–305. Those choices fit the stated scope — a local, read-only-first audit tool — rather than a general-purpose security scanner.