Script DexIntercept: DexProtector Bypass 1.0

[Ian]

Hey guys,

Cheers for checking out the thread.
In this one I hope to give you a little something out of the ordinary when it comes to Android reverse engineering - something a bit more advanced.

So a few days ago I cam across a version of iMPlayer which has not been made public which was modified, themed and connecting to a panel which I found interesting - after attempting to reach out to the owner to try and get my hands on it for my own use (as you do.) It became apparent that wasn't going to be the case - so I set out too modify the modified version to be able to connect to my own hosted panel.

Upon checking out the classes.dex I quickly noticed that something unusual had been done to the APK, I'm not talking about obsfucation like ProGuard or anything like that, that sort of issue can be resolved in seconds, no, this was something much nicer - DexProtector.

Now DexProtector when used will encrypt the Dex files of an APK and decrypt it/them on runtime in the case of a Davlik type Dex it will decrpyt it to an actual .dex archive using DexOpt. In the case of this application (ART) it will decrpyt too an .odex or .dat as I found, which was just an .odex in a different wrapper. This is done by using Dex2Oat and easily converted back to an unoptimized .dex using - you guessed it - Oat2Dex, see here.

Now this tool DexIntercept uses a cut down version of inotify-await for Android, see here. Which will look out for filed being made by the application and 'steal' them away before the application can then delete them again which is what DexProtector is programmed to do. From there you can then either directly edit the .dex or convert the .odex/.dat to .dex and edit away to create a DRM free version of the application.

Hopefully someone will have fun with this as I have, please don't pester me for instructions on how to use!
Thanks again for reading!
- Ian.

Note: I've included the APK for those who seek to learn how this works and would like to target other protected applications.
Helpful Information:

To view the content, you need to Sign In or Register.

 

[MrAnhell]

I also been looking more into implayer. Very nice!

 

[MrAnhell]

@Ian may i ask what was done to the apk included besides what is defined in your description?

 

[Ian]

@Ian may i ask what was done to the apk included besides what is defined in your description?

Youll notice the lack of Dexes to acutally do with iMPlayer itself, only DexProtect (you can use MTManagers anti-confuse to remove the iIlIilIii obfuscation making it readable. The 2 dexes for iMplayer are actually encrypted in the /assets/ folder and without a private key wont be accessible however DexProtector has to decrypt these to allow the app to run and what it does is decrypt the dexes on runtime and stores them in the /data/.. folder on the device. The app will grab that decrypted dex/odex whatever for you to do what ever you like with.

Not just for iMPlayer - this is just an example of some lad who got too cheeky when it didnt have to go this far. You know how it is..

 

[MrAnhell]

Youll notice the lack of Dexes to acutally do with iMPlayer itself, only DexProtect (you can use MTManagers anti-confuse to remove the iIlIilIii obfuscation making it readable. The 2 dexes for iMplayer are actually encrypted in the /assets/ folder and without a private key wont be accessible however DexProtector has to decrypt these to allow the app to run and what it does is decrypt the dexes on runtime and stores them in the /data/.. folder on the device. The app will grab that decrypted dex/odex whatever for you to do what ever you like with.

Not just for iMPlayer - this is just an example of some lad who got too cheeky when it didnt have to go this far. You know how it is..

Nice! Im sure it'll come in handy for me. I've managed to unlock most premium Settings only atm in v1.8.0.1 there is lots more to do ?

 

[keeney]

Nice! Im sure it'll come in handy for me although i have managed to unlock most premium settings in v1.8.0.1 already, there is lots more to do ?

sorry to jump on post MrAnhell do you have any plans to release this premium mod you've done?

 

[MrAnhell]

sorry to jump on post MrAnhell do you have any plans to release this premium mod you've done?

I personally just want a working hardcode without the need of a panel. My hopes are high to share something Good for you guys, but i'm still learning atm ?

 

[MarkusP87]

Hello,

does it still works for the actual DexProtector?

 

[guetteur]

Hello,

does it still works for the actual DexProtector?

Try it, and leave a feedback ?