  ███╗   ██╗ ██████╗ ██╗██████╗
  ████╗  ██║██╔═══██╗██║██╔══██╗
  ██╔██╗ ██║██║   ██║██║██████╔╝
  ██║╚██╗██║██║   ██║██║██╔══██╗
  ██║ ╚████║╚██████╔╝██║██║  ██║
  ╚═╝  ╚═══╝ ╚═════╝ ╚═╝╚═╝  ╚═╝

desktop · adb · no root · mit

Your phone has 500 apps.
How many phone home?

NOIR reads what installed apps can collect and where they send it — permissions, endpoints, data flows — then hands you reversible fixes.

安卓隐私审计：谁在拿你的数据，发到哪里。

Download latest All releases Source

latest release · macOS / Windows / Linux · MIT

$ noir
  device   2509FPN0BC · android 16
  scan      501/501
  flagged  256 apps · 31 tracker domains
  plan     19 app-ops · rollback.txt

01 / What it does

Evidence, not vibes.

01Inventory every app holding INTERNET plus a sensitive permission.

02Extract endpoints from the APK itself, not from a permission label.

03Correlate permissions to data types — location, contacts, SMS, mic, screen — and to upload hosts.

04Act with app-ops that can be reverted, or a DNS list split into trackers / review / functional.

02 / Features

Small tool, sharp edges.

MANIFEST

Exported components

Binary AXML parsed locally: exporters without permission, cleartext traffic, backup, debuggable, targetSdk.

SHARED UID

One uid, union of grants

58 system packages can share a single Linux uid. NOIR shows who holds whose permissions.

DEEPSCAN

Code-level signals

Batch jadx over the riskiest apps, then score exec, dynamic loading, accessibility hijacking, screen capture and SDKs.

DNS

Tiered blocklists

Trackers are safe to import. Push, login, updates and payments are separated so you do not brick the phone.

TUI

Built for terminals

CJK-aligned dashboard, gradient bars, one redraw per APK, ASCII fallback for legacy consoles.

PORTABLE

Double-click builds

Bundled runtime on macOS, Windows and Linux. No JDK, no account, no telemetry.

03 / Demo

Run it here, simulated.

A full guided noir run: device detection, scan, dashboard, then reversible app-ops. Click Y at the prompts. Everything is simulated and stays on this page.

noir — zsh 100×18 · simulated tap Y · swipe →

JavaScript is off — run noir in your terminal to see this flow.

click Y / N in the terminal · simulated

04 / Install

Two ways in.

Portable

# download, unzip, double-click
→ Start NOIR.command   macOS
→ Start NOIR.bat       Windows
→ Start-NOIR.sh        Linux

# bundled runtime, no JDK needed

From source

$ git clone https://github.com/Verlintas/NOIR
$ cd NOIR
$ ./gradlew :cli:installDist
$ ./cli/build/install/noir/bin/noir --about

首次运行会问你要不要自动下载 adb / jadx；检测不到设备时会给出开发者模式与 USB 调试步骤，并等待 180 秒。

05 / Limits

What it does not do.

Static evidence only: it proves capability and endpoints, not that a transfer happened.
Scans base.apk; code shipped in split APKs is a known lower bound.
No root, so system apps are disabled or restricted, never physically removed.
Unsigned builds: Gatekeeper and SmartScreen will ask once.

06 / FAQ

Before you ask.

Do I need root?

No. Everything runs through adb shell. Uninstalling is limited to --user 0, so the system partition is never modified and a factory reset brings everything back.

Will it break my phone?

The default run is read-only. --apply only changes app-ops, each reversible with default; rollback.txt is written next to the report. Uninstalling is a separate, explicit command.

Does it upload anything?

No telemetry, no accounts, no analytics. Reports stay in your output directory. The only network access is noir setup downloading adb/jadx, and GitHub API calls on this page for the version and star count.

Why static analysis instead of traffic capture?

Static evidence answers “can this app read X and reach Y”, which works without root, without a VPN slot, and without trusting a certificate authority. It cannot prove that a transfer happened — pair it with DNS logs if you need that.

Why can't it remove system apps?

Without an unlocked bootloader and root, Android does not allow it. NOIR can disable or restrict them for the current user, and tells you exactly which app-op or domain is responsible.

What is DeepScan?

noir deepscan pulls the riskiest APKs, runs jadx in parallel, and scores code-level signals: Runtime.exec, dynamic dex loading, accessibility rewriting, screen capture, device-id reads and known SDKs. It is a triage tool, not a decompiler replacement.

Does it work on any Android?

Yes, as long as adb can see the device. It has been tested on Xiaomi/HyperOS, AOSP emulators and vendor ROMs. Vendor-specific heuristics live in the classifier and are easy to extend.

Why are some domains marked “functional”?

Push, login, updates, payments, app stores and cloud sync need their endpoints. Blocking them takes out notifications or sign-in. NOIR splits exports into trackers / review / functional so you do not brick the phone.

07 / What it is not

Adjacent, not equivalent.

	NOIR	Permission manager	Tracker database
sees	endpoints inside this APK	declared permissions	app-level labels
answers	which data can reach which host	who asked for what	“this app is known to track”
acts	reversible app-ops, DNS tiers	opens settings	nothing
needs	adb, no root	nothing	nothing

It is also not an antivirus, not a firewall, and not a cloud service. It is a static audit you run yourself.

08 / Source

Read it before you run it.

MIT licensed, no accounts, no network calls of its own. The only downloads are adb and jadx, and only when you say yes.

Star on GitHub All releases Share on X

09 / Contact

Talk to a human.

Bug reports and feature requests belong on GitHub. Vulnerabilities go through a private advisory. Everything else: email.

github@Verlintascode, releases, follow issuesreport a bugplease attach noir doctor securityprivate advisorydo not open a public issue x@Verlintasupdates & threads email…everything else

Your phone has 500 apps.How many phone home?