search

strazzere / android-unpacker

Android Unpacker presented at Defcon 22: Android Hacker Protection Level 0
Apache License 2.0
1.12k stars 331 forks source link

An error while unpack APKProtect based APP #18

Closed JonathanHouten closed 9 years ago

JonathanHouten commented 9 years ago

HI，

An error came across with me while i unpacking an APKProtect.com based app

+++++++++++++++++++++

255|root@A0001:/ # /data/local/tmp/kisskiss com.huawei.cloudwifi
[] Android Dalvik Unpacker/Unprotector - diff@lookout.com [+] Hunting for com.huawei.cloudwifi [+] 4185 is service pid [+] 4218 is clone pid [+] Attempting to detect packer/protector... [] Nothing special found, assuming Bangcle... [+] Unpacked odex found in memory! [+] Attempting to dump memory region 0xbea9c000 to 0xbea9c000 [!] pread seems to have failed! [!] An issue occured trying to dump the memory to a file!'''

+++++++++++++++++++++

and Why kisskiss think this is an bangcle based app?(I unpacked it as common app and saw "apkprotect.com" folder . )

Sha-1:bf7a31fc4920d9b0dfafe3e78f29fe4be3751c0 Other information: ARMv7 Processor rev 1(v7I) Android 4.4.4 (CM-11.0) SELinux:Enabled

By the way, you can download this apk form http://pan.baidu.com/s/1i3zwf8h

strazzere commented 9 years ago

You have two issues;

  1. The apk is not packed, though it was "protected" using an older version of APKProtect, this means only bad code was injected into it.
  2. The device you are running it on likely is not allowing ptrace to attach due to SELinux. This can be solved by running it on a different device without SELinux enabled.