Unpacking a Numeric-Brand Packer, Bypassing Frida Detection, and Repacking
Unpacking a numeric-brand packer, bypassing its Frida detection, and repacking the app with a valid signature for further analysis, with the tools and offsets documented.
Tag: smali
DEX VMP 101: Recovering Android DEX Virtualization and a Security Assessment
DEX VMP 101: recovering Android DEX virtualization from a real app, walking the unpacking and smali reconstruction, then assessing its security, and the code traced down to the core.
Instrumenting an Android App to Dump Bluetooth AES Keys and Ciphertext
Instrumenting an Android app with smali edits to dump Bluetooth AES keys and ciphertext via logcat, a clean way to capture encrypted traffic without hooks.
Reverse Engineering a VPN Accelerator's Protection Stack: Root Detection, Encryption, and Device-ID Rotation
Reverse engineering a VPN accelerator's protection stack: root and proxy detection, AES encryption, and the device-ID rotation scheme that keeps it ahead of bans.
A Hardened App's One Fatal Flaw: Token Verification Anchored to a Spoofable android_id
How a heavily hardened app's VIP token fell apart: its server-side verification was anchored to a spoofable android_id, so rotating the device ID mints unlimited fresh tokens.
FART: Automated Unpacking on ART via Active Invocation (Android 9.0 Source Adapted)
A deep dive into FART, the DEX unpacker that dumps Android apps by actively invoking every method in ART, with the Android 9.0 source adapted and the core anti-tamper workarounds explained.