Saturday, September 20, 2014

Unpacking APKProtect, Bangcle, LIAPP, Qihoo

Android packers getting more common, and if you're doing any significant amount of reversing, you're bound to come across one. While any serious reverser should 1.) familiarize themselves with how they work,  2.) unpack a few by hand, and 3.) write their own tool, it's always nice to kick back and pull something off the shelf. Or, at least, learn how someone else is doing it.

For this reason, I'd like to share with you the provocatively named android-unpacker from strazzere. Nothing says "i write c code" like a blunt and unambiguous project title!
https://github.com/strazzere/android-unpacker/tree/master/native-unpacker

From the readme, it already supports a few popular unpackers:
  • Bangcle (SecNeo)
  • APKProtect
  • LIAPP (preprelease demo)
  • Qihoo

13 comments :

  1. does android-unpacker support paid version of secneo?

    ReplyDelete
  2. I get this error when trying with ApkProtect

    + Attempting to detect packer/protector...
    * Nothing special found, assuming Bangcle...
    + Unpacked odex found in memory!
    + Attempting to dump memory region 0xb57c0000 to 0xb57cf000
    ! pread seems to have failed!
    ! An issue occured trying to dump the memory to a file!

    ReplyDelete
  3. Hallo,

    can you help me

    [05.12.2015 19:50:03] I: I: Using Apktool 2.0.2 on Beta_6.1.2197.apk
    [05.12.2015 19:50:03] I: I: Loading resource table...
    [05.12.2015 19:50:03] W: Exception in thread "main" brut.androlib.AndrolibException: Multiple res specs: attr/?

    LBE_Security_Master_Beta_6.1.2197.apk
    https://drive.google.com/file/d/0B4Uzb0COihYbMnhYVzI3RVdXR3M/view?usp=sharing

    ReplyDelete
    Replies
    1. if you're having trouble with apktool, you should ask them. i'm not sure what the problem there is, but if it's a bug, posting the error on the apktool github page is probably your best bet.

      Delete
  4. This comment has been removed by the author.

    ReplyDelete
  5. This comment has been removed by the author.

    ReplyDelete

  6. string name="?">转到主屏幕转到上一层级更多选项完成查看全部选择应用清除查询搜索查询搜索</string

    ReplyDelete
  7. http://i68.servimg.com/u/f68/18/23/59/53/lbe10.png

    ReplyDelete
  8. http://i68.servimg.com/u/f68/18/23/59/53/lbe10.png

    ReplyDelete

  9. string name="?">转到主屏幕转到上一层级更多选项完成查看全部选择应用清除查询搜索查询搜索</string

    ReplyDelete
  10. Very helpful suggestions that help in the optimizing website. thank for sharing the link.

    พี่มากพระโขนง

    ReplyDelete

Do NOT post about or link to specific apps!