Need help with nathan?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

209 Stars 50 Forks MIT License 9 Commits 12 Opened issues


Android Emulator for mobile security testing

Services available


Need anything else?

Contributors list

  _   _       _   _
 | \ | |     | | | |
 |  \| | __ _| |_| |__   __ _ _ __
 | . ` |/ _` | __| '_ \ / _` | '_ \
 | |\  | (_| | |_| | | | (_| | | | |
 |_| \_|\__,_|\__|_| |_|\__,_|_| |_|

Nathan Emulator - Mobile Security Lab 2016


Nathan is a 5.1.1 SDK 22 AOSP Android emulator customized to perform mobile security assessment.

Supported architectures: * x86 * arm (soon)

The emulator is equipped with the Xposed Framework and the following pre-installed modules: * SSLUnpinning, to bypass SSL Certificate pinning. * Inspeckage, to perform the dynamic analysis of an application. * RootCloak, to bypass root detection.

The following tools are already installed: * #SuperSU: Superuser access management tool * Drozer: Comprehensive security and attack framework for Android


  • Only python 2.7.x required
  • Hooking ready with Xposed
  • Pre-installed tools for application analysis
  • Fully customizable
  • Snapshot and restore of user data


Download Nathan core scripts from git:

$ git clone
$ cd nathan
Init Nathan for the first time (for downloading firmware files)
$ ./ init 
If a proxy is required to download files, the parameter -dp is available :
$ ./ init -dp
The init command downloads all the files required to run use Nathan Emulator.


To start Nathan:

$ ./ start

To redirect the traffic through a proxy (es., the parameter -p can be used:

$ ./ start -p

To create a snapshot of current user image data with a label (current in this case):

$ ./ snapshot -sl current 

To restore the emulator to the snapshot with label current:

$ ./ restore --rl current

To get a list of available snapshots to restore:

$ ./ restore --ll  

Every time the emulator is started, a temporary copy of system image is created and each changes made to system data is lost when the emulator is powered off.
To keep permanent the changes, the command freeze is available:

$ ./ freeze  

To push files from a folder to a running Nathan emulator, the command push is available:

$ ./ push -f folder   

The complete list of command is: ``` usage: [-h] [-v] [-a ARCH] {init,start,snapshot,restore,freeze,push} ...

optional arguments: -h, --help show this help message and exit -v, --verbose Show emulator/kernel logs -a ARCH, --arch ARCH Select architecture (arm/x86) - Default = x86

Command to run: {init,start,snapshot,restore,freeze,push} init Download and init Nathan emulator start Start Nathan emulator snapshot Create userdata image snapshot restore Restore userdata image snapshot freeze Freeze temporary system image push Push files to Nathan emulator ``` The parameter -h for each command shows specific options.

Nathan Customization

The emulator can be easily customized by pushing files in system partition and freezing it.
The example script

shows how to customize the emulator with Google Apps.

Unknown issue

Please run

./ -v start
or look at nathan.log to show the log messages.

Know Issue on Kali Linux Rolling 2016.1

libGL error: unable to load driver:
libGL error: driver pointer missing
libGL error: failed to load driver: i965
libGL error: unable to load driver:
libGL error: driver pointer missing
libGL error: failed to load driver: i965
libGL error: unable to load driver:
libGL error: failed to load driver: swrast

The issue is related to in PATH_NATHAN/sdk/tools/lib64/ and can be resolved with the following command:

cd ~/nathan/sdk/tools/lib64/libstdc++
ln -sf /usr/lib/x86_64-linux-gnu/ 

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.