|
1 | 1 | # FRIDA-DEXDump
|
2 | 2 |
|
3 |
| - |
| 3 | +`frida-dexdump` is a frida tool to find and dump dex in memory to support security engineers in analyzing malware. |
4 | 4 |
|
5 |
| -## Make JetBrains Great Again |
| 5 | +## Make Jetbrains Great Again |
6 | 6 |
|
7 | 7 | <p align="center">
|
8 | 8 | <img src = "https://resources.jetbrains.com/storage/products/company/brand/logos/jb_beam.png" width = 150>
|
9 | 9 | <img src = "https://resources.jetbrains.com/storage/products/company/brand/logos/PyCharm.png" width = 500>
|
10 | 10 | </p>
|
11 | 11 |
|
12 | 12 | ## Features
|
13 |
| -1. support fuzzy search broken header dex. |
14 |
| -2. fix struct data of dex-header. |
15 |
| -3. compatible with all android version(frida supported). |
16 |
| -4. support loading as objection plugin ~ |
17 |
| -5. pypi package has been released ~ |
18 |
| - |
19 |
| -## Requires |
20 | 13 |
|
21 |
| -- [frida](https://www.github.com/frida/frida): `pip install frida` |
22 |
| -- [optional] [click](https://pypi.org/project/click/) `pip install click` |
| 14 | +1. Support fuzzy search broken header dex(deep search mode). |
| 15 | +2. Compatible with all android version(frida supported). |
| 16 | +3. One click installation, without modifying the system, easy to deploy and use. |
23 | 17 |
|
24 | 18 | ## Installation
|
25 | 19 |
|
26 |
| -### From pypi |
| 20 | +``` |
| 21 | +pip3 install frida-dexdump |
| 22 | +``` |
| 23 | + |
| 24 | +## Usage |
27 | 25 |
|
28 |
| - pip3 install frida-dexdump |
29 |
| - frida-dexdump -h |
| 26 | +CLI arguments base on [frida-tools](https://github.com/frida/frida-tools), you can quickly dump the foreground application like this: |
30 | 27 |
|
31 |
| -### From source |
| 28 | +``` |
| 29 | +frida-dexdump -FU |
| 30 | +``` |
32 | 31 |
|
33 |
| - git clone https://github.com/hluwa/FRIDA-DEXDump |
34 |
| - cd FRIDA-DEXDump/frida-dexdump |
35 |
| - python3 main.py -h |
| 32 | +Or specify and spawn app like this: |
36 | 33 |
|
37 |
| -## Usage |
| 34 | +``` |
| 35 | +frida-dexdump -U -f com.app.pkgname |
| 36 | +``` |
38 | 37 |
|
39 |
| -- Run `frida-dexdump` or `python3 main.py` to attach current frontmost application and dump dexs. |
| 38 | +Additionally, you can see in `-h` that the new options provided by frida-dexdump are: |
40 | 39 |
|
41 |
| -- Or, use command arguments: |
42 |
| - ``` |
43 |
| - -n: [Optional] Specify target process name, when spawn mode, it requires an application package name. If not specified, use frontmost application. |
44 |
| - -p: [Optional] Specify pid when multiprocess. If not specified, dump all. |
45 |
| - -f: [Optional] Use spawn mode, default is disable. |
46 |
| - -s: [Optional] When spawn mode, start dump work after sleep few seconds. default is 10s. |
47 |
| - -d: [Optional] Enable deep search maybe detected more dex, but speed will be slower. |
48 |
| - -h: show help. |
49 |
| - ``` |
50 |
| - |
51 |
| -- Or, loading as objection plugin |
| 40 | +``` |
| 41 | +-o OUTPUT, --output OUTPUT Output folder path, default is './<appname>/'. |
| 42 | +-d, --deep-search Enable deep search mode. |
| 43 | +--sleep SLEEP Waiting times for start, spawn mode default is 5s. |
| 44 | +``` |
52 | 45 |
|
53 |
| - 1. clone this repo and move `frida_dexdump` into your plugins folder, eg: |
| 46 | +When using, I suggest using the `-d, --deep-search` option, which may take more time, but the results will be more complete. |
54 | 47 |
|
55 |
| - ``` |
56 |
| - git clone https://github.com/hluwa/FRIDA-DEXDump ~/Downloads/FRIDA-DEXDump; |
57 |
| - mv ~/Downloads/FRIDA-DEXDump/frida_dexdump ~/.objection/plugins/dexdump |
58 |
| - ``` |
| 48 | + |
59 | 49 |
|
60 |
| - 2. start objection with `-P` or `--plugin-folder` your plugins folder, eg: |
| 50 | +## Build and develop |
61 | 51 |
|
62 |
| - ``` |
63 |
| - objection -g com.app.name explore -P ~/.objection/plugins |
64 |
| - ``` |
| 52 | +``` |
| 53 | +make |
| 54 | +``` |
65 | 55 |
|
66 |
| - 3. run command: |
| 56 | +### Requires |
67 | 57 |
|
68 |
| - 1. ` plugin dexdump search ` to search and print all dex |
69 |
| - 2. ` plugin dexdump dump ` to dump all found dex. |
| 58 | +See [requirements.txt](https://github.com/hluwa/FRIDA-DEXDump/blob/master/requirements.txt) |
70 | 59 |
|
71 | 60 | ## Internals
|
72 | 61 |
|
73 |
| -[《深入 FRIDA-DEXDump 中的矛与盾》](https://mp.weixin.qq.com/s/n2XHGhshTmvt2FhxyFfoMA) |
| 62 | +[《深入 FRIDA-DEXDump 中的矛与盾》](https://mp.weixin.qq.com/s/n2XHGhshTmvt2FhxyFfoMA) |
0 commit comments