Home / Unlabelled / FRIDA-DEXDump - Fast Search And Dump Dex On Memory

FRIDA-DEXDump - Fast Search And Dump Dex On Memory


Features
  1. support fuzzy search broken header dex.
  2. fix struct data of dex-header.
  3. compatible with all android version(frida supported).
  4. support loading as objection plugin ~
  5. pypi package has been released ~

Requires
  • frida: pip install frida
  • [optional] click pip install click

Installation

From pypi
pip3 install frida-dexdumpfrida-dexdump -h

From source
git clone https://github.com/hluwa/FRIDA-DEXDumpcd FRIDA-DEXDump/frida-dexdumppython3 main.py -h

Usage

  • Run frida-dexdump or python3 main.py to attach current frontmost application and dump dexs.

  • Or, use command arguments:

    -n: [Optional] Specify target process name, when spawn mode, it requires an application package name. If not specified, use frontmost application.-p: [Optional] Specify pid when multiprocess. If not specified, dump all.-f: [Optional] Use spawn mode, default is disable.-s: [Optional] When spawn mode, start dump work after sleep few seconds. default is 10s.-d: [Optional] Enable deep search maybe detected more dex, but speed will be slower.-h: show help.

  • Or, loading as objection plugin

    1. clone this repo and move frida_dexdump into your plugins folder, eg: 
      git clone https://github.com/hluwa/FRIDA-DEXDump ~/Downloads/FRIDA-DEXDump;mv ~/Downloads/FRIDA-DEXDump/frida_dexdump ~/.objection/plugins/dexdump
    2. start objection with -P or --plugin-folder your plugins folder, eg: 
      objection -g com.app.name explore -P ~/.objection/plugins
    3. run command:
      1. plugin dexdump search to search and print all dex
      2. plugin dexdump dump to dump all found dex.



Source: feedproxy.google.com
FRIDA-DEXDump - Fast Search And Dump Dex On Memory FRIDA-DEXDump - Fast Search And Dump Dex On Memory Reviewed by Anonymous on 5:32 AM Rating: 5

Tags