# Mira Mobile runtime detection workbench for iOS and Android.

## Why follow Mira Mira turns real runtime cases into reusable workflows, tools, and detection notes. ## Research Updates - [260520] Article: [Detecting root, emulators, and scrcpy-like projection through the audit logcat side channel](./knowledge/articles/en/audit-logcat-sidechannel-detect-root-emulator-projection.md) - [260520] Case: [Android high-PID shell proc audit side-channel hints at scrcpy projection](./knowledge/cases/en/2026/2026-05-20-android-high-pid-shell-audit-sidechannel-scrcpy.md) - [260520] Case: [Android emulator proc audit side-channel exposes qemu SELinux context](./knowledge/cases/en/2026/2026-05-20-android-emulator-proc-audit-sidechannel.md) - [260519] Case: [Android proc audit side-channel detects Magisk SELinux context](./knowledge/cases/en/2026/2026-05-19-android-proc-audit-magisk-sidechannel.md) ## Features - **App sandbox tools**: Use shell, PTY, screen capture, and file tools inside the Mira host app sandbox on Android and iOS. - **Frida tasks**: Run Java and native hooks with RPC for one-time runtime analysis. - **Relay and MCP**: Connect devices through Relay and let AI work in the same sessions through MCP. ## Getting Started - **Relay**: `PYTHONPATH=. python3 -m mira.relay.server --host 0.0.0.0 --port 8765 --advertise-url http://:8765` - **Browser**: Open `http://127.0.0.1:8765` on your desktop. - **Android**: [Download the latest APK](https://github.com/vwww-droid/Mira/releases/latest/download/mira-app-debug.apk), install it, then enter `http://:8765` in the app. - **iOS**: Verified on a real device running iOS 16.7.10. See [`docs/GETTING-STARTED.md`](./docs/GETTING-STARTED.md). - **AI**: `PYTHONPATH=. python3 -m mira.mcp.server --relay http://127.0.0.1:8765`. MCP config: [`docs/MCP.md`](./docs/MCP.md). The APK's offline Python/Frida runtime requires arm64-v8a and supports Android 10 through 15. Android 16 Java hooks are not supported, and no confirmed official Frida fix is available. See the [compatibility notes](./docs/notes/android-frida-gadget-compatibility-2026-09-05.md). ## Architecture - [Android application architecture and Java/C boundaries](./docs/ANDROID-ARCHITECTURE.md) - [Shared native PTY architecture](./docs/NATIVE-ARCHITECTURE.md) - [Repository layout](./docs/REPO-ARCHITECTURE.md) ## Contributing Mira welcomes issues and pull requests from mobile security researchers, reverse engineers, Frida users, MCP users, and device testers. - Read [`CONTRIBUTING.md`](./CONTRIBUTING.md) before opening a focused pull request. - Use the issue templates for bugs, security hardening, detection ideas, and device compatibility reports. - For security reports, read [`SECURITY.md`](./SECURITY.md) first. - Scanner-generated hardening PRs are welcome when they include repository-specific reachability reasoning and verification. Good starting points include native memory-safety review, Android and iOS device testing, Frida workflow examples, MCP client setup notes, and new reusable detection cases. ## Live Discovery Examples

Android Remote Frida	iOS Remote Frida
_{Remote shell, runtime inspection, and live Frida execution on Android.}	_{Equivalent PTY and Frida workflow adapted to the iOS iSH compatibility layer.}
Android LSPosed Trace	iOS Jailbreak Trace
_{Download original GIF} _{Construct a Frida path around the app classloader and surface LSPosed traces from runtime state.}	_{Download original GIF} _{Ask Claude to roam the live terminal and surface jailbreak-related traces in the device environment.}

## Public Relay Access ![Relay exposed through cpolar](./docs/public-deploy.png) With Relay, you can temporarily expose an authorized session beyond the local network for cloud devices, expert review handoff, and fast evidence sharing. ## Research Boundaries 1. Mira observes and interacts with the Mira host app sandbox. 2. Mira does not control unrelated third-party apps. 3. Mira does not provide system-wide remote control. 4. Mira does not provide root or jailbreak bypass capabilities. 5. Mira is not a production SDK or a silent background control channel. ## Acknowledgements - [lamda](https://github.com/firerpa/lamda): inspiration for the web workbench interaction model. - [Termux](https://github.com/termux/termux-app): Android terminal UX and extensible shell ecosystem. - [iSH](https://github.com/ish-app/ish): iOS-side Linux shell compatibility and syscall translation path. ## License `GPL-3.0-only`.