We Can Still Crack You! General Unpacking Method For Android Packer (no Root)
summary
Claims a general, no-root unpacking method that successfully recovers decrypted classes.dex from ~100 real-world Android packers (DexGuard, Ijiami, Bangcle, APKProtect, LEF, Bank, etc). Method uses the APK's wait-for-debug flag and JDWP injection to insert an unpacker and detach, then performs targeted hooking native open/dlopen calls and other APIs to capture temporary files or in-memory DEX, bypasses anti-debug/anti-trace/emulator and integrity checks via redirection and hooks, and repackages a working APK after dumping.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:26Android Packer Overview
- 2:38Dynamic Loading Techniques
- 3:48Packing Mechanism Analysis
- 5:48Memory Patching Mechanisms
- 7:02Logical Unpacking Methods
- 8:56Anti-Analysis Challenges
- 11:17Unpacking via Hooking
- 12:57Bypassing Integrity Checks
- 14:42Unpacking DexGuard
- 16:12Unpacking Jiagu/LeF
- 17:15Unpacking Demo Prep
- 17:51Unpacking Demo: Bangcle
- 25:56Unpacking Demo: APKProtect
- 31:22Conclusion and Q&A
related talks
37mPack your Android: Everything you need to know about Android Boxing
47mAttacking Android Applications
47mSecuring Android Applications
38mReverse Engineering is not just for hackers
33mReverse - Engineering apps on the device - how far can we go?
37mThe Art of Hiding Sensitive Info in Plain Sight
29mA day in the life of a mobile reverse engineer
28mSecure Development whit Android