checkpointsw / android_unpacker Goto Github PK

Hey there,

I'd like to let you know that I tested android_unpacker on a few packers. For some reason no OAT data was created in the /data/data/<package_name> area. I verified that the AVD's libart.so was correctly modified by pulling it from the system folder and disassembled it looking for the changes like the added fstream include and the _unpacked_oat string.

Here are the hashes of the malware I tried to unpack:

BangCLE:
35c0a075cbc6135d957bd10769e3a620 - banksteal
eefd2101e6a0b016e5a1e9859e9c443e - feejar

Please check if the code that you have uploaded on GitHub does indeed work for you. For me, there are no results whatsoever, although setting up the unpacker is a rather time consuming task.

Please let me know which samples did you use to test your AVD and post their hashes.
Thank you!

Regards,
Disane

I write the LOG to trace the code.


logcat only shows the oat LOG,no dex LOG.

But both dex and oat dumped. Where is wrong?

Thank you.

I copy unpacker.patch to /art, then I used the command git apply unpacker.patch but I got the below error.
"I have followed your instruction step by step"
unpacker.patch:29: trailing whitespace.
//------------------------------------------------------------------
unpacker.patch:30: trailing whitespace.

unpacker.patch:37: trailing whitespace.

unpacker.patch:44: trailing whitespace.
}
warning: runtime/dex_file.cc has type 100755, expected 100644
error: patch failed: runtime/dex_file.cc:26
error: runtime/dex_file.cc: patch does not apply

Dear Developer,

For readability and Search Engine Optimization (SEO) it would be great if you could do the followings:

• Please provide more than 10 words in the "About" field