skills.rest
warterbili
warterbiliCOMMUNITY
Explore all skills by this author →
Website𝕏@lsdwaterbiliGitHub

android-unpacking

Dump decrypted DEX files from hardened Android apps using frida-dexdump.

Updated Aug 23, 2026
Search Tags:#reverse-engineering#apk-analysis#android-unpacking#frida-dexdump#dex-dump#packer-bypass#jadx-integration
One-click install
npx skills add https://github.com/warterbili/AUTO_REVERSE --skill android-unpacking
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: android-unpacking
Source: https://github.com/warterbili/AUTO_REVERSE/tree/main/skills/android/android-unpacking
Command: npx skills add https://github.com/warterbili/AUTO_REVERSE --skill android-unpacking

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

When reverse engineering hardened Android applications, opening the APK in jadx only shows packer stub classes instead of the actual business logic, making further analysis impossible without first unpacking the app to retrieve the real decrypted code.

Core Features & Use Cases

  • Runtime DEX Dumping: Uses frida-dexdump to scan process memory and dump decrypted DEX files after the packer has finished decrypting the app's code at runtime, effective against whole-release packers including Tencent Legu, Bangcle, and 360 hardening solutions.
  • Multi-DEX Support: Correctly handles and outputs multiple dumped DEX files for multi-DEX apps, which can be directly loaded into jadx for static analysis.
  • Troubleshooting Guidance: Includes clear limitations, timing requirements for dumps, and fallback solutions for common issues like Frida detection blocking the dump process.

Quick Start

Use the android-unpacking skill to dump the decrypted DEX files from the running hardened Android app so you can load them into jadx to inspect the app's real business logic.

Frequently Asked Questions about android-unpacking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I unpack an Android app that uses Tencent Legu or 360 hardening?▼

To unpack a hardened Android app, you must dump the decrypted DEX files from the app's process memory at runtime using frida-dexdump, which effectively bypasses Tencent Legu, Bangcle, and 360 whole-release packers.

What do I need to dump decrypted DEX files from a running Android app?▼

Dumping decrypted DEX files requires a connected Android device with the target app installed and a running frida-server to scan process memory after the packer finishes decrypting the code.

Can I dump multiple DEX files from a hardened multi-DEX Android application?▼

Yes, the unpacking process correctly handles multi-DEX apps by scanning process memory and outputting multiple dumped DEX files that can be directly loaded into static analysis tools.

What should I do if the target app detects Frida and blocks the DEX dump?▼

If the target app detects Frida and blocks the DEX dump, you should consult the provided troubleshooting guidance for timing requirements and fallback solutions to bypass the detection.

How do I analyze the real business logic after dumping decrypted DEX files?▼

After dumping decrypted DEX files, you can directly load the retrieved DEX files into jadx to inspect the application's real functional code and perform static analysis.

Related Skills

Explore More Software Engineering Skills→
asnar00asnar00
1

eos-deploy-usb

Build and deploy Android APKs to USB-connected devices via ADB.

Community
Advanced
philo-grovesphilo-groves
12

maxtac-re-jadx

Reverse engineer Android APKs and DEX files with Jadx.

Community
Advanced
hardw00thardw00t
90

android-pentest

Automate Android app pentesting with static APK analysis and Frida instrumentation.

Community
Advanced
duanbiao2000duanbiao2000
3

memory-forensics

Extract artifacts from Windows, Linux, and macOS memory dumps using Volatility.

Community
Advanced