4

I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem.

But per official spec of DEX format the only allowed values are 035 and 037, with 038 in Android 8.0. Previously the text explicitly read (but not any more):

Due to a Dalvik bug present in older versions of Android, Dex version 036 has been skipped. Dex version 036 is not valid for any version of Android and never will be.

The same story is confirmed here - https://github.com/JesusFreke/smali/issues/484.

How Android behaves on such a dex? Does Dalvik simply load it silently or rejects? Or this is a known technique of concealing the file from analysis and the version is being corrected just before the dex is loaded?

Improve this question

2 Answers 2

Reset to default
2

I believe most versions of dalvik and art will reject the dex file and refuse to load it.

Improve this answer
2
  • Thank you for the answer. Do you have any idea why somebody would create such a file? Is it a bug or some concealment technique?
    – Ilia Barahovsky
    Mar 21, 2017 at 19:28
  • There was a short time around the JB timeframe (iirc) where the platform used this version.
    – JesusFreke
    Mar 21, 2017 at 23:22
0

Definitely, this file would not be executed on new'ish platforms, but could be accepted on some older ones (which ones/vendors would be an interesting trivia to research), per this comment in dex_file.cc:

// Dex version 036 skipped because of an old dalvik bug on some versions of android where dex // files with that version number would erroneously be accepted and run.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.