Documentation

Rutken docs

Rutken is a fast security analyzer. Android is the flagship surface, and it does both static analysis (decompile, rules, data-flow/taint, SCA/CVE matching) and dynamic analysis (live capture, TLS unpin, active intervention, a no-repack hooking engine), offense and defense in one tool. The same engine is actively building out coverage for Linux ELF binaries, container images, CI/CD pipelines, and Windows PE; macOS (Mach-O) is on the roadmap. These docs read in order, so start at the top and work down, or jump straight to the reference.

New here? Start with the first scan.

Install the launcher, pick the free Community edition, and run rutken app.apk rules, and you'll be reading findings in a minute. Then try the Proving Grounds, a set of deliberately vulnerable practice apps with full walkthroughs.

Install & first scan →

Get started

01Install & first scanOne-line install, picking an edition, the target-then-verb model, and your first rules scan. 02Proving GroundsIntentionally-vulnerable practice apps with end-to-end CLI walkthroughs.

Core

03Static analysisThe parse → IR → CFG → rules → data-flow/taint pipeline, and everything the finding model can tell you. 04Dynamic & network captureOn-device hooking, the four ways to read plaintext, agent delivery, intercept and repeater. 05The desktop GUIA guided tour of every view with real Pro Plus screenshots: static graph, triage, SCA, dynamic capture, attack surface, reports, plugins, and the MCP agent. 06TLS pinning bypassThe mechanism behind each pin and the exact command that defeats it, per stack. 07Remediation & reportingFixes, patching and re-signing, report formats, and CI gating. 08Platforms & operationsContainers, binaries, parity, the REST API and MCP server, and the desktop GUI.

Reference

09CLI referenceEvery command and flag, the two invocation shapes, formats, exit codes, and gating. 10Detection rulesThe full catalog of built-in rules and data packs, with ids, severities, and triggers. 11Network: by stackCapture and pinning coverage organised by network stack. 12Network: by TLS versionCoverage organised by TLS version. 13Network: by HTTP versionCoverage organised by HTTP version.

Plugins

14Writing a Rutken pluginThe rule-pack JSON schema and matcher grammar, the taint catalog, finding what to match, validation, and submitting to the public plugins repo.