NOIR
What is NOIR?
NOIR is a desktop application that audits Android devices for privacy leaks. It runs through adb without requiring root access. The tool scans installed applications to identify which ones hold internet access and sensitive permissions, extracts network endpoints directly from the APK files, and maps how data types like location or contacts connect to upload hosts. It then provides reversible fixes using app-ops settings and tiered DNS blocklists.
The software performs static analysis rather than live traffic capture. It exports manifest details, analyzes shared Linux UIDs across system packages, and offers a deep scan feature that uses JADX to score code-level risks like dynamic loading or accessibility hijacking. Users can separate tracker domains from functional services like push notifications or payments to avoid breaking device functionality. All reports are saved locally, and the tool includes a terminal-based dashboard with ASCII fallback support.
NOIR features
- Scans APKs for permissions and network endpoints without root
- Maps data types to upload hosts using static analysis
- Applies reversible app-ops changes and tiered DNS blocklists
- Exports manifest details including cleartext traffic and debug flags
- Analyzes shared Linux UIDs across system packages
- Runs code-level risk scoring with JADX for dynamic loading and SDKs
- Provides a terminal dashboard with CJK alignment and ASCII fallback
- Ships as a portable executable with bundled runtime on all supported OS
Who uses NOIR and for what
- Audit personal Android phones to see which apps collect location or contacts
- Review enterprise mobile deployments for unauthorized data exfiltration paths
- Block tracker domains while keeping push notifications and login services active
- Verify that system apps do not share sensitive permissions through shared UIDs
- Generate local privacy reports for compliance checks without uploading data
NOIR FAQ
Does NOIR require root access?
No. The tool runs entirely through adb shell commands. It cannot remove system apps but can disable or restrict them for the current user. A factory reset restores everything. The website does not mention performance impact after running the tool.
Will applying fixes break my phone?
Default runs are read-only. The apply command only changes app-ops settings, which are reversible. A rollback file is generated next to the report. Uninstalling requires a separate explicit command. The website does not say if third-party antivirus software will flag the executable.
Does NOIR send any data to servers?
No. There is no telemetry, accounts, or analytics. Reports stay in your output directory. Network access is only used to download adb and JADX when requested, plus GitHub API calls for version checks. The website does not specify minimum Android OS versions beyond testing on Xiaomi/HyperOS and AOSP emulators.
How does NOIR differ from traffic capture tools?
Static analysis proves an app can read certain data and reach specific hosts without needing root or a VPN slot. It cannot prove that a transfer actually occurred. Users should pair it with DNS logs if they need that level of detail. The website does not say if it supports iOS devices.
Comments (0)
Comments and upvotes open when this product launches on ProductPerch.
More Security launches
Find out who's calling: worldwide spam call database
HOL GuardOpen source · verified
Approve or block AI coding agent actions on your machine
Share encrypted text and clean files before sending
Fraud, AML & cybersecurity compliance for Saudi Arabia
