charles2gan / gda-android-reversing-tool

the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, data decryption, and encryption, etc.

ˇ GDA(GJoy Dex Analyzer)

GDA, an powerful Dalvik bytecode decompiler implemented in C++, which has the advantages of fast analysis and low memory&disk consumption and an stronger ability to decompiling the apk, dex, odex, oat, jar, class, aar files.

GDA is completely native software and works without any Setup and Java VM, it works well in any new windows system and virtual machine system without additional configuration. GDA Decompiler project started in 2013 and its first version 1.0 released in 2015 at GDA website.

GDA is also a powerful and fast reverse analysis platform. Which does not only supports the basic decompiling operation, but also many excellent features like Malicious behavior detection, Privacy leaking detection, Vulnerability detection, Path solving, Packer identification, Variable tracking analysis, Deobfuscation, Python& Java scripts, Device memory extraction, Data decryption and encryption etc.

All the features as follows:

𝕬 Interactive Operation:
    1. Cross-references for strings, classes, methods and fields;
    2. Searching for strings, classes methods and fields;
    3. Comments for java code;
    4. Rename methods,fields and classes;
    5. Save the analysis results in gda db file.
    ...
  
𝕭 Utilities for Assisted Analysis:
    1. Extracting DEX from ODEX;
    2. Extracting DEX from OAT;
    3. XML Decoder (Component filter);
    4. Algorithm tool(Support rolling encryption and almost all popular encryption algorithms);
    5. Device memory dump(Dump so, odex, dex, oat file);
    6. Path solving;
    7. Static vulnerability scanner;
    ...
    
𝕮 Good Features:
    1. Brand new dalvik decompiler in c++ with friendly GUI.
    2. Packers Recognition.
    3. Multi-DEX supporting.
    4. De-obfuscate.
    5. Malicious Behavior Scanning by API chains.
    6. Static vulnerability scanner based on stack state machine and dynamic rule interpreter.
    7. Taint analysis to preview the behavior of variables.
    8. Taint analysis to source the variables.
    9. APIs view with x-reference
    10. Deep URL extraction.
    11. Association of permissions with modules.
    12. Apk Forensics Analysis.
    13. Dual decompiler mode.
    14. Smart Rename.
    15. Device memory data dump, DEX file dump by memory searching.
    16. Support Frida to hook and call the selected method or class.
    17. Privacy leaking scanning.
    18. Sensitive Infomation extraction.
    19. Multi-DEX Merge.
    20. Path solving based on low-level intermediate representation(LIR).
    21. Junk instruction clearing.
    22. Support call-graph view.
    23. Smali instruction patch, apk repack and install.
    24. Support subclass and parentclass view.
    25. Support translation of the strings.
    ...

𝕲𝕯𝕬 shortcut key

shortcut	description
F5	Switch java to smali, pressing it again for back to java
F	Trace the args and return-value by dataflow analysis
X	Cross-referencing, locating callers (of strings, classes, methods, field)
Esc/◄/Backspace	Back to the last visit
►	Forward to the next visit
G	Jump to somewhere by you inputting offset
N	Rename the variable/method/class name
S	Search for all the elements by the given string
C	Comments. Only supports the Java code
DoubleClick	The cursor's placed at the method/str/field/class, and double-click to access objects
M	The cursor's placed at the Smali line and pressing the key 'M' to edit the instruction
▲ UP	Press 'up' key to access the up-method in the tree control
▼ Down	Press 'down' key to access the down-method in the tree control
D	Dump the binary data of methods, only supports the Smali window
Enter	The modification of edit boxes take effect
H	Show data in Hex
Ctr+H	Pop searching history window
Ctr+A	Select all
Ctr+C	Copy
Ctr+V	Paste, only for editable boxes
Ctr+X	Cut
Ctr+F	Find out the string of the code area
Ctr+S	Save the modifications into the GDA database file

ˇ Installing

No installation required, just double-click the bin and you can enjoy it. NOTE： This is not an open source project，at least，in the short term. You can use the free tools and some open source scripts published here.

ˇ False positive report

For copyright protection, GDA is protected by an authorized VMP, which may lead to false positives of some anti-virus software. Please ignore or add GDA to the white list. GDA does not have any malicious behavior.

GDA is embedded with ADB and gdump (used to dump device memory data), as well as vul rules, source-taint rules, api fingerprint etc. so, you will see some file in directory %APPDATA%/GDA. this behavior releasing the other executable files also be identified as a virus by some AVs.

ˇ Supported platforms

Only for windows

ˇ Usage:

Just drag a file into GDA, that's done.

If your files are .jar/.class/.aar files, you need the java support the dx tool. Please make sure that the java works properly.

When the analyzed jar file size is too big, it maybe takes a long time to analysize, please be patient.

FAQ Summary

Brief Guide

How to search what you need

Support For Frida

Python Script

GDA Privacy Leak

GDA Path Solver

GDA APK Forensic

GDA Static Taint Analysis

Batch Decryption Of APP Strings

GDA Vulnerability Scanner

GDA: Capture the Flag in CTF

GDA: DEX Static Patch Technology Based on Smali Just-in-time Compilation

ˇ Color theme:

Only support GDA3.75+, Other version do not use this theme file. Usage:click on menuFile->Import Color Config,choosing a theme file and reboot GDA.

Download Here

gda-android-reversing-tool's Issues

执行Gdump错误

root@omega:/data/local/tmp # ./Gdump
./Gdump
error: only position independent executables (PIE) are supported.

可以像JEB一样 找到接口所有的重装方法吗

可以像JEB一样 找到接口所有的重装方法吗

can this tool write apk with signatue?

can your tool write apk with signature?

Decompilation Bug

I ran into a bug to which I don't quite know how to reproduce it.

I'm analyzing the version 177.0.0.30.119 from Instagram (x86) (download here).

In the class X.0bP, method A00, the class X.0cU will be constructed. It's right after the switch statement (location 0313 in smali-view) in the method. This is where the problem lies. The smali code says, the class X.0cU should be constructed using invoke-direct/range {v16 ... v38}, so with arguments/parameters from v17 to v38. But the Java-code only shows a "blank" constructor with no arguments.

There are also other bugs (probably) related to this. In instructions prior to this, you can see method calls whos value is immediately discarded such as Boolean.valueOf(true) or Long.valueOf(...). Looking at the smali code, you can see that the return values of these are used to construct X.0cU (locations 02b8 and 02d4).

However, looking at X.0cU directly reveals that the constructor takes seemingly no parameters. But the constructor body uses registers v2 through v22 to assign its class-members.

I'm not sure where the root of this bug lies but it would be nice if this could be fixed.

GDA Not Recognize Classes

CalebFenton/simplify#140
Sample from this issue when decompile with GDA only show 1 class in L/ package while JEB show many more classes. So GDA simply not recognizing those classes

闪退

在反编译某一款apk时，GDA闪退。apktool jadx jeb3都没问题，有点针对？
apk地址:链接：https://pan.baidu.com/s/1qrOBRgN21DE86P0du0jkbQ 提取码：r72e

提示"计算机内存不足"的问题

目标apk：抖音_14.7.0
拖入apk到GDA3.90中，分析完成后提示"计算机内存不足",实际上此时计算机的内存占用率才30%左右。
GDA3.90之前的版本，均卡在99%的进度不动。希望能加以修复

How do I increase the window size?

I ran into the problem, it is not possible to increase the window size, tried using Altmove but it does not help. This is a very strange decision on your part. In the search box too. How do I resize the window?

GDA Searching

This version is missing under Types: All Strings bzw: All

使用定义计数法是什么方法

你好，看到有关GDA的介绍，里面谈到是通过使用定义计数法实现数据流分析，能不能介绍一下，实在没有找到相关资料，谢谢

Instagram

Instagram

Originally posted by @kj9lj in #37 (comment)

BUG，包名和类名相同时，不显示包。

反编译时，如果包下面有一个a包，还有一个a类。a包不会在列表中显示，这是个bug

windows defender Virus detected !!

Could you let me know which part of your software triggered the detection?

Support Java jar files

Is there any way to open the java jar file...?

The exe triggers tons of malware warnings

check virustotal

GDA Crash

Step to reproduce:

1: open any dex and use python script
2.: again use python script
3: gda crash with error

GDA Crashing when renaming variables

When i try to rename variables like p0, p1 .. etc it crashes.

Can you fix it pls?

unpacking apk

hi dev , packer detection is just awesome . if there can be a option to unpack those packers it will be a great work . thanks

Windows Issues

There are some issues with the GDA window itself on windows.

• The "recent searches" window is not in its own window (so you can select it on the taskbar). It also appears on every desktop.

• Clicking on the icon in the taskbar while the window is in focus doesn't do anything (it should be minimized).

• ALT and space doesn't do anything.

• The window isn't resizable.

• There's no dialog to save if there are changes/renamed variables once the application is closed.

• Not sure if it's really happening, but it feels like the window is still rendering while it can't be seen, so it needs more processing power.

Maybe there are more issues related to the window behaving different compared to others.

GDA Searching all Types Program is Crashing

If you click on GDA Searching and select all under Types, the program crashes!

希望能在mac或者乌班图上运行

能获取h5封装的apk中的url吗?

能获取h5封装的apk中的url吗?

scripts don't work

when i use python scripts, it have no response, and when i load again, it crashed, just like last issues has said.
when i load java scripts, program tell me that i should use javac to complile it(which script i load is Example1Getting),so i load the Example1Getting.class, and program tell me that i didn't have a java env, so i tell program where the jvm.dll is, then it loading and loading and crashed.
maybe is the problem of java version?

3.85打开大文件失败

GDA3.85打开大文件会直接崩溃闪退

no connection to the process when working with a dump

There is no connection to the process when working with a dump. I tried it on three phones. The program simply does not respond. what could be the problem?

括号丢失反编译错误

& 和 << 在一起的时候括号会丢失导致实际运算变了
正确的应该是（jeb反编译）
out.write((p1.length & 1) << 7 | v2.length);
gda 反编译结果
out.write(p1.length & 1 << 7 | v2.length);

Does not deobfuscate

I try to deobfuscate small dex which was heavily obfuscated, but nothing was changed after it finished.
I am missing something?
classes3.zip

v3.79/3.80 打开大文件崩溃

GDA3.8
0x4366D6 mov byte ptr [EBX+EDX],0
EBX是malloc申请的内存,打开大文件如果申请内存失败,再写入[EBX+EDX] 就崩了

Selecting Text

This isn't an important feature, but it would be nice if one could double click on text and have it selected like in other editors.

打开Android jar/aar文件报错

使用GDA打开Android jar/aar提示select dx.bat in android sdk path
选择完毕之后提示dx cannot process current jar/class file, please check it

virus

it shows a trojan win32/occamy.c

无法提取V2签名应用的签名信息

使用V2方式签名的应用，GDA签名信息无法提取出来。提示

Instruction Edit

If you select Instruction Edit and change a jump, the program crashes at Export Modified Dexs ...

兄弟，没有行号

兄弟，没有行号，行号在逆向分析里面很重要

反编译超大方法失败

样本:QQ邮箱5.7.2
下载地址:https://www.wandoujia.com/apps/246975

能支持多dex文件输入吗？

类似问题:

• skylot/jadx#936
• Konloch/bytecode-viewer#276

Show Method Arguments in X-Ref

During compilation, some "pipelines" put commonly used strings in a global string "table" (or multiple). This "table" is essentially a big method with a switch-case statement deciding on the input which string to return.

Example

public static String 9C4.A00(int p0)	//method@000f28
{
   switch (p0){	
       case 0:	
         return "null cannot be cast to non-null type android.view.ViewGroup";
       case 1:	
         return "DirectFragment.DIRECT_FRAGMENT_ARGUMENT_THREAD_ID";
       case 2:	
         return "null cannot be cast to non-null type android.app.Activity";
       case 3:	
         return "DirectFragment.ENTRY_POINT";
       case 4:	
         return "direct_quick_reply_camera_fragment";
       case 5:	
         return "onRealtimeEventPayload exception";
       case 6:	
         return "primary_button";
       // ...
   }
}

Now when using X-Ref, all the calls to this method are returned, but each call "requests" a different string. So one would need to check each call to find the use of a given string.

Feature Request

There are two possibilities for a solution that come to my mind.

1. Inline these calls. Which seems reasonable, but may not be desired by the user as the code gets changed. It seems like this could be done with a plugin/script.

2. Show arguments to a method call. This is the least destructive way of solving this: For simple methods and method calls (only accepting a few arguments and all of them are primitives, and for calls: all arguments are static) show the call signature in the X-Ref window.

The window could show this for example:

methods	detail	calls
someMethod	com.MyClass	staticString(1, 2)
otherMethod	com.MyClass

Code:

someMethod() {
    staticString(1, 2);
}
otherMethod() {
    staticString(1, getArgument());
}

Method/Property-Call Search

When analyzing an apk, you not only have to find a class/string etc. but also calls to a method or property inside it.
So for example Method a() calls b(). Then right clicking (or similar) could allow a search for calls to b() and then reveal the call in a(). The same for properties. Property A.a is accessed in A.b() for example.
This would improve the the speed of working with GDA.

virus

it shows a trojan win32/occamy.c

搜索功能可以支持正则表达式吗？

RT

Win10报病毒

报：Trojan:Win32/Occamy.C

virus

it shows a trojan win32/occamy.c

Search for exact string

When searching for strings in an apk file, there's sometimes an exact camparison needed. In a relatively large app, searching e.g. for "update" will also return strings that include the word update (e.g. "updated", "will update"). This may exceed the capacity of the search, so matches are not shown.

My feature request would be that the search for a string would decide on what to check for:

"update" ➡ searches for exact strings of update
update ➡ searches for strings that include update

Additionally, /regex/i could test the string against a regex (/regex/i would match "RegEx" and "regex" but not "reg ex").

Any chance for Linux support?

I tried wine and it doesn't work 😢

how to buy

I need to change the default browser address in apk, Its umebrowser.apk
i want to buy your pro version, but never got any response,

i sent you an email but never got respond ,

can you please look at this link and tell if possible to change the default browser home address

GDA purchase

Program detected by Windows Defender as Win32/Occamy.C trojan

So you've given some explanation about AV warnings being triggered by the "adb.exe file and the gdump file in %APPDATA%/GDA", however your explanation really doesn't add up. Windows still keeps detecting even the latest version (3.72) as containing Win32/Occamy.C (and not for an unpacked program called adb.exe, but in the executable, GDA3.72.exe itself!), which isn't really explained by the fact that the "bin file is packed by Themida". Instead it could be explained by the following line that I found in my netstat output after I ran the program:

  TCP    192.168.1.49:62250     123.112.20.158:9090    CLOSE_WAIT
 [GDA3.72.exe]

Why does your program try to connect to an IP in Beijing, CN (the IP of www.gda.wiki as I learned)?

How to modify instructions directly?

I tried to modify the instruction directly (①) , but it had no effect. I can only modify bytecodes to modify instruction (②)
using GDA3.68

如何搜索自己的注释？

如题

Where exactly is the source?

In each release, you write the Source code (zip) but in fact, there is no code source!
Can you explain?
I'm a user and a fan of your program and also like to read the source code.