BlackDex v3.2 releases: Android unpack tool

by do son · Published August 2, 2021 · Updated January 10, 2022

BlackDex

BlackDex is an Android unpack tool, it supports Android 5.0~12 and need not rely to any environment. BlackDex can run on any Android mobile phone or emulator, you can unpack APK File in several seconds.

This project supports almost all the Android systems above 5.0, it has a high successful rate to dump DexFile quickly and conveniently. Generally, it only takes a few seconds to unpack an installed app. For the APK File that is not installed on your device, BlackDex will spend some time copying files, the length of time depending on file size.

Principle

BlackDex unpacks APK File by DexFile cookie. In theory, it supports all version Android systems that use ART (Android Runtime). But it may vary from a few special devices. We do not have enough resources to execute a lot of testing, if you have problems with this project, please open an issue on GitHub.

Deep Unpacking

BlackDex will fix the DexCode in deep unpacking mode, it can load DexCode which was pointed to other Memory Blocks into DexFile. By this way, we can restore some methods which were erased with NOP. But it can not fix all methods. For example, some applications restore the instructions just before being executed. In this situation, BlackDex can not restore the instructions into DexFile. Deep Unpacking does not include the operation of decryption and executing methods. This feature was still in the test phase, it is possible that the following cases will occur, may the NOP has no longer exists in this world!

1. BlackDex will take more time to unpack an app, it is expected to take a few minutes or more.

2. The target application is possible to crash when BlackDex is unpacking it(Environment detection, etc).

3. The failure rate of unpacking will be increased.

4. It may not always fix all methods successfully.