4

I came upon a sample that indirectly contains classes.dex with the magic "Dalvik dex file version 036". If not for the version, the file seems to be normal and JEB loads it without any problem.

But per official spec of DEX format the only allowed values are 035 and 037, with 038 in Android 8.0. Previously the text explicitly read (but not any more):

Due to a Dalvik bug present in older versions of Android, Dex version 036 has been skipped. Dex version 036 is not valid for any version of Android and never will be.

The same story is confirmed here - https://github.com/JesusFreke/smali/issues/484.

How Android behaves on such a dex? Does Dalvik simply load it silently or rejects? Or this is a known technique of concealing the file from analysis and the version is being corrected just before the dex is loaded?

2

I believe most versions of dalvik and art will reject the dex file and refuse to load it.

  • Thank you for the answer. Do you have any idea why somebody would create such a file? Is it a bug or some concealment technique? – Ilia Barahovski Mar 21 '17 at 19:28
  • There was a short time around the JB timeframe (iirc) where the platform used this version. – JesusFreke Mar 21 '17 at 23:22
0

Definitely, this file would not be executed on new'ish platforms, but could be accepted on some older ones (which ones/vendors would be an interesting trivia to research), per this comment in dex_file.cc:

// Dex version 036 skipped because of an old dalvik bug on some versions of android where dex // files with that version number would erroneously be accepted and run.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.