search

strazzere / android-unpacker

Android Unpacker presented at Defcon 22: Android Hacker Protection Level 0
Apache License 2.0
1.12k stars 331 forks source link

Pread errors for bangcle packed samples #15

Closed niraminc closed 6 years ago

niraminc commented 9 years ago

Hi, Thanks for the cool project.

I tried using unpacker on some bangcle samples, and get following error (i printed additional details about the parameters to pread),

+++++++++++++

[+] Attempting to detect packer/protector... [*] Nothing special found, assuming Bangcle... [+] Unpacked odex found in memory! [+] Attempting to dump memory region 0xb6f1c000 to 0xb6f1d000 [!] pread seems to have failed!, fd : 3, read : -1, act : 4096, errno : 22 [!] An issue occured trying to dump the memory to a file!

+++++++++++++

Sample sha2's 841edbbe1afe874b2376c3a46d7a890ab068ea2f69c68ac397b3984446c7d6e2 d99b428c95ee0d29660282133659e70b7b0c6c192dc5ac00ab43b50c5eedb168

Any idea on this error? I use ARM emulator, Platform 4.4.2, API SDK 19.

Regards, Ram

strazzere commented 9 years ago

This is a new version of Bangcle;

image

Likely it's not supported yet (as you are seeing an error). That pread failure is also likely due to the memory being protected and unreadable.

strazzere commented 9 years ago

Confirmed, this appears to be "secneo"/"bangcle" with containerization.

niraminc commented 9 years ago

Ohh ok, Thanks for the details.

username13107 commented 9 years ago

I met the same problem,how to resolve this problem?

strazzere commented 9 years ago

@jiych What problem? That is a new unsupported version of secneo? That you have the same file to unpack? Or that pread isn't working?

Unless you're attempting to unpack the same binary, I suggest making a new issue with details about the file/environment/etc.

username13107 commented 9 years ago

pread return error,and it's errno is 5 environment: ARM emulator, Platform 4.4.2, API SDK 19. sample is here: https://www.dropbox.com/s/fkitaucm47hzrz6/MtkEditor.signed.apk?dl=0

strazzere commented 6 years ago

Spot checked d99b428c95ee0d29660282133659e70b7b0c6c192dc5ac00ab43b50c5eedb168 and this works fine.