/ZjDroid

Android app dynamic reverse tool based on Xposed framework.

Primary LanguageJavaApache License 2.0Apache-2.0

ZjDroid

Android app dynamic reverse tool based on Xposed framework.

I. ZjDroid Introduction

ZjDroid is a reverse tool based on Xposed Framewrok. It can do following tasks:

  1. Dump dex from memory;

  2. Reverse app protect(packer) by key pointer to BakSmali in Dalvik;

  3. Monitor dangerous API;

  4. Dump specific memory;

  5. Obtain DEX info of APK;

  6. Obtain class info of DEX file;

  7. Dump Dalvik java heap info;

  8. Run Lua scripts in target process.

II. ZjDroid commands

  1. Obtain DEX info of APK: am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"dump_dexinfo"}'

  2. Obtain class info of DEX file: am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"dump_class","dexpath":"*****"}'

  3. Decompile DEX by memory pointer, save it to file: am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"backsmali","dexpath":"*****"}' This command can unpack most of popular packers(app protect) Exception: For ApkProtect has anti-modify, following actions are needed for unpack ApkProtect: a. Create a directory (e.g. /data/local) and chmod to 777; b. Copy zjdroid.apk to this dir, rename it to zjdroid.jar; c. Edit /data/data/de.robv.android.xposed.installer/conf/modules.list, set module file to zjdroid.jar; d. reboot the phone.

  4. Dump specific DEX in memory and save it to file (in odex format which can be decompiled on PC) am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"dump_dexfile","dexpath":"*****"}'

  5. Dump specific memory to file am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"dump_mem","start":1234567,"length":123}'

  6. Dump Dalvik heap to file, the file can be analyzed by java heap analysis tool. am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"dump_heap"}'

  7. Run Lua script in target process Call java code in Lua script. Use case: a. Used to call decrypt method dynamically to do decryption. b. Used to trigger specific code logic. am broadcast -a com.zjdroid.invoke --ei target pid --es cmd '{"action":"invoke","filepath":"****"}' luajava usage: http://www.keplerproject.org/luajava/

  8. Monitor dangerous API.

III. Command result:

  1. Check command result: adb shell logcat -s zjdroid-shell-{package name}

  2. Check API monitor result: adb shell logcat -s zjdroid-apimonitor-{package name}