unpack Manager
Important
The unpacking function is mainly for processing the first-generation integral shell and the second-generation extracted shell. Native java codes such as vmp and dex2c cannot be processed.
Shelling management is mainly for more flexible directional shelling. Depending on the sample, various problems may be encountered during the shelling process, such as the shelling process crashes, or the shelling process does not enter normally, or the shelling process fails. The correct application code is still not displayed in the file. You need to adjust the options or unpacking timing according to the situation you encounter. The following is the shelling management function interface.
Start unpacking
turn on the option of unpacking function, and the target application will unpack itself during the startup process.
For a deeper call chain
the corresponding bin file and the complete class list of the corresponding dex file will be generated after startup. After the unpacking is completed, all dex files will be automatically repaired and merged. It can also be fixed manually in the function. After this function is turned on, you can cooperate with the module management function to allow the function to be executed at a deeper level and get the real code before interpretation and execution.
Blocked active calls
when the shelling process is executed during the startup process, but soon due to other reasons other than active calls, the application crashes. In this case, blocking active calls can be used to unpack it on the main thread. . Avoid crashes caused by other threads
Unpacking whitelist
during the unpacking process, each line of content in the whitelist will be fuzzy matched, and if there is no match, it will be skipped. Generally used to remove the dex file where the specified class is located.
Unpacking blacklist
during the unpacking process, each line in the blacklist will be fuzzy matched, and any matching will be skipped. It is generally used for functions that will directly close the application when running, or cause a crash. For example, the unpacking process always crashes after executing a certain function. Or a system class or third-party library can determine unprotected functions. You can try to blacklist this function
Whitelist path selection
the above whitelist function is based on traversing all dex class lists, and then fuzzy matching the classes that belong to the whitelist for active calling. The whitelist file selected by the path must contain the complete class name, and the file will be traversed directly to process all classes in it. The complete class list file of the dex file produced by the deeper call chain above can also be used as a whitelist file.