neonorbit / dexplore

A dex analyzer for finding obfuscated codes dynamically

🚦 As soon as you stop running, everyone else starts to catch up. 🚦

[email protected]

dexplore's Issues

Add documentation and examples

Smali source attribute as criterion for finding classes

Smali files can contain the filename they were compiled from in the .source attribute. Being able to use that as criterion for finding classes would be a nice addition.

Search for everything in the same loop

This is a critical performance improvement, this library is only efficient when looking for just one method. However, finding many methods and classes causes to loop through the same classes for every single search. Why not search for everything in the same loop?

Example

old code

Class<?> class1 = dexplore.findClass(
                DEX_FILTER,
                CLASS_FILTER).loadClass(classLoader)

Class<?> class2 = dexplore.findClass(
                DEX_FILTER,
                CLASS_FILTER).loadClass(classLoader)

new code

dexplore.addClass("class1",
                DEX_FILTER,
                CLASS_FILTER)
dexplore.addClass("class2",
                DEX_FILTER,
                CLASS_FILTER)

dexplore.setClassLoader(classLoader)
dexplore.setOnClassQueried((name, cls) -> { 
    switch(name) {
        case "class1":
            class1 = cls;
            break;
        case "class2":
            class2 = cls;
            break;
    }
})

dexplore.explore()

Search for parameter and return types

Would it be possible to also search for parameter and return types of methods?
That could make the results more distinct in cases where the method's references are mostly obfuscated themselves.

Deserialization error

An error was found when deserializing method parameters if they include Classes array(Class[])

• Target method:
  public final void a(Application arg9, String arg10, boolean arg11, Class[] arg12)
  .method public final a(Landroid/app/Application;Ljava/lang/String;Z[Ljava/lang/Class;)V
• Serialization result:
  <string name="app_center">m:lx.u.a.k:a:android.app.Application:java.lang.String:boolean:[Ljava.lang.Class;:void</string>
• Error:
  java.lang.IllegalArgumentException at io.github.neonorbit.dexplore.result.MethodData.deserialize(MethodData.java:169)

Deserialization works fine if there is only Ljava.lang.Class but breaks if there are [ and ; in string.

MethodData.loadMethod returns null on found method

Method Signature

com.facebook.messaging.msys.common.translator.AbstractMsysMessagesCollectionTranslator.A00(com.facebook.messaging.model.threadkey.ThreadKey,com.facebook.messaging.msys.common.translator.AbstractMsysMessagesCollectionTranslator,com.facebook.messengerorcacqljava.OrcaTempMessageList,X.5JD,com.facebook.xapp.messaging.capability.vector.Capabilities,com.google.common.collect.ImmutableSet,java.lang.Number,java.util.List,java.util.Map,int,int):com.facebook.messaging.model.messages.MessagesCollection

App

Messenger version v416 (download link)