APKiD icon indicating copy to clipboard operation
APKiD copied to clipboard

[DETECTION] Failed to detect dexprotector

Open Diniboy1123 opened this issue 3 years ago • 0 comments

Provide the file Please attach the file to this issue if possible. If not possible, please add url or link to download the file. If neither of the above are possible, add hash which can be found online (e.g. - via VT) for download.

I have shared the APK with one of the contributors

If you do no fill in this section, the issue with be closed due to lack of the bare minimum of information needed for people to reproduce. We CANNOT test things if you don't tell use what to test

Describe the detection issue Please describe what was expected to be detected, a packer, protector, obfuscator, antidebug, etc? What supporting information can you provide to aid in why you believe this should be detected as such? Is the protector known, if so, please provide reference links to any site/marketing material/etc.

The APK uses dexprotector which I could confirm using an unlink overwrite method in frida. The file in question is called libdexprotector.20385.so. However the tool is unable to detect that this was indeed obfuscated at all.

APKiD current results... Please provide current output from APKiD on this file. Include the APKiD header which provides the version, e.g. -

[+] APKiD 2.1.3 :: from RedNaga :: rednaga.io
[*] ./myapp.apk!classes.dex
 |-> anti_vm : Build.FINGERPRINT check, Build.MANUFACTURER check
 |-> compiler : dx
[*] ./myapp.apk!classes10.dex
 |-> anti_vm : Build.MANUFACTURER check
 |-> compiler : dx
[*] ./myapp.apk!classes11.dex
 |-> compiler : dx
[*] ./myapp.apk!classes2.dex
 |-> anti_debug : Debug.isDebuggerConnected() check
 |-> anti_vm : Build.BOARD check, Build.FINGERPRINT check, Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check, possible Build.SERIAL check
 |-> compiler : dx
[*] ./myapp.apk!classes3.dex
 |-> anti_vm : Build.FINGERPRINT check, Build.MANUFACTURER check, Build.TAGS check, SIM operator check
 |-> compiler : dx
[*] ./myapp.apk!classes4.dex
 |-> compiler : dx
[*] ./myapp.apk!classes5.dex
 |-> anti_debug : Debug.isDebuggerConnected() check
 |-> anti_vm : Build.HARDWARE check, Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check, Build.TAGS check, device ID check, possible Build.SERIAL check, possible VM check
 |-> compiler : dx
[*] ./myapp.apk!classes6.dex
 |-> anti_vm : Build.TAGS check, possible VM check
 |-> compiler : dx
[*] ./myapp.apk!classes7.dex
 |-> anti_vm : possible VM check, possible ro.secure check
 |-> compiler : dx
[*] ./myapp.apk!classes8.dex
 |-> anti_vm : Build.MANUFACTURER check
 |-> compiler : dx
[*] ./myapp.apk!classes9.dex
 |-> anti_vm : Build.FINGERPRINT check, Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check
 |-> compiler : dx

Additional context Add any other context about the problem here.

Diniboy1123 avatar Aug 19 '22 10:08 Diniboy1123