android-protector-triage

What problem does it solve?

Standard Android reverse engineering and vulnerability scanning workflows produce false negatives and false confidence when targeting APKs packed with commercial protectors like DexProtector, AppSealing, Jiagu, or Promon Shield, as most first-party code and assets are encrypted and invisible to static scanners.

Core Features & Use Cases

• Commercial Protector Detection: Identifies packed APKs using APKiD rules, native library signals, and asset entropy checks for common commercial packers.
• DexProtector Structural Unpacking: Recovers the libdp.so binary from arm64-v8a DexProtector-protected APKs without an Android device, enabling reverse engineering of the protector's native payload.
• Protector-Aware Adjacency Analysis: Triages exposed attack surface that survives packing, including manifest components, vendored third-party crypto libraries, network security config, and protected asset fingerprints.
• Use Case: A red teamer assessing a financial services APK packed with DexProtector uses this skill to first detect the packer, unpack the native payload, and identify exposed weak cryptographic primitives in vendored libraries before handing off to standard semantic vulnerability scanning workflows.

Quick Start

Use the android-protector-triage skill to analyze the provided Android APK file, detect any commercial protector present, and run the appropriate triage workflow for the identified packer.