Android dynamic reverse analysis tool ZjDroid -- shell Removal

Android dynamic reverse analysis tool ZjDroid -- shell Removal

 

Prerequisites:

1. Root mobile phone 1

2. Xposed Framework needs to be installed through Xposed installer (http://dl.xposed.info/latest.apk;

 

I. Introduction to ZjDroid

ZjDroid is a dynamic reverse analysis module based on Xposed Framewrok. The reverse analyzer can do the following through ZjDroid:
1. DEX File Memory dump
2. Memory BackSmali based on the key pointer of Dalvik, effectively cracking and reinforcing applications
3. dynamic monitoring of sensitive APIs
4. dump data in the specified memory area
5. Obtain the DEX information loaded by the application.
6. Obtain the loading class information of the specified DEX file.
7. dump Dalvik java heap information.
8. Run the lua script dynamically in the target process.

2. ZjDroid commands

1. obtain the information about the DEX file currently loaded by the APK:
Adb shell am broadcast-a com. zjdroid. invoke -- ei target pid -- es cmd '{action: dump_dexinfo }'

2. Get the specified DEX file and include the loadable Class Name:
Adb shell am broadcast-a com. zjdroid. invoke -- ei target pid -- es cmd '{action: dump_class, dexpath :*****}'

4. dynamically decompile the specified DEX according to the memory pointer related to Dalvik and save it as a file.
Adb shell am broadcast-a com. zjdroid. invoke -- ei target pid -- es cmd '{action: backsmali, dexpath :*****}'

This method can be shelled. Currently, most popular reinforcement protection methods are available. (Busy running due to mobile phone performance issues)
Exceptions:
Because ApkProtect has specific anti-modification detection, you need to make the following modifications to fix the protection:
(1) create a specific directory (such as/data/local) on the device and set chmod to 777.
(2)copy zjdroid.apk to this directory and change the file name to zjdroid. jar.
(3) Modify/data/de. robv. android. xposed. installer/conf/modules. list to zjdroid. jar.
Start the device.

5. Dump specifies the data in DEX memory and saves it to files (the data is in odex format and can be decompiled on pc ).
Adb shell am broadcast-a com. zjdroid. invoke -- ei target pid -- es cmd '{action: dump_dex, dexpath :*****}'

6. Dump data from the specified memory space area to the file
Adb shell am broadcast-a com. zjdroid. invoke -- ei target pid -- es cmd '{action: dump_mem, start: 1234567, length: 123 }'

7. Dump the Dalvik stack information to the file. The file can be analyzed and processed using the java heap analysis tool.
Adb shell am broadcast-a com. zjdroid. invoke -- ei target pid -- es cmd '{action: dump_heap }'

8. Call the Lua script dynamically at runtime
This function can dynamically call java code through the Lua script.
Use Cases:
You can call the decryption function dynamically to complete decryption.
It can trigger specific logic dynamically.
Adb shell am broadcast-a com. zjdroid. invoke -- ei target pid -- es cmd '{action: invoke, filepath :****}'

Usage of luajava:
Http://www.keplerproject.org/luajava/

8. Sensitive API call monitoring

3. view the execution result of related commands:

1. Command Execution result:
Adb shell logcat-s zjdroid-shell-{package name}

2. Monitoring output of sensitive API calls:
Adb shell logcat-s zjdroid-apimonitor-{package name}