I came upon a sample that indirectly contains classes.dex
with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem.
But per official spec of DEX format the only allowed values are 035 and 037, with 038 in Android 8.0. Previously the text explicitly read (but not any more):
Due to a Dalvik bug present in older versions of Android, Dex version 036 has been skipped. Dex version 036 is not valid for any version of Android and never will be.
The same story is confirmed here - https://github.com/JesusFreke/smali/issues/484.
How Android behaves on such a dex? Does Dalvik simply load it silently or rejects? Or this is a known technique of concealing the file from analysis and the version is being corrected just before the dex is loaded?