android-unpacking

What problem does it solve?

When reverse engineering hardened Android applications, opening the APK in jadx only shows packer stub classes instead of the actual business logic, making further analysis impossible without first unpacking the app to retrieve the real decrypted code.

Core Features & Use Cases

• Runtime DEX Dumping: Uses frida-dexdump to scan process memory and dump decrypted DEX files after the packer has finished decrypting the app's code at runtime, effective against whole-release packers including Tencent Legu, Bangcle, and 360 hardening solutions.
• Multi-DEX Support: Correctly handles and outputs multiple dumped DEX files for multi-DEX apps, which can be directly loaded into jadx for static analysis.
• Troubleshooting Guidance: Includes clear limitations, timing requirements for dumps, and fallback solutions for common issues like Frida detection blocking the dump process.

Quick Start

Use the android-unpacking skill to dump the decrypted DEX files from the running hardened Android app so you can load them into jadx to inspect the app's real business logic.