3

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder

├───app_dexprotector
│       823517D25836B88F1C499C02370A047E.dat
│       823517D25836B88F1C499C02370A047E.dex
│
├───app_outdex
│       libdexprotector.bpqn57.12456.so
│
├───cache
└───lib
        libiconv.so
        libzbarjni.so

and all the files are the same except app_outdex file and when I start the app app_dexprotector folder will be modified after that a file will create on app_outdex then will delete immediately I create a copy of that file with Termux and inotify-wait and the interesting part is always the size of the file is different i searched the java code of the app and there is only an application class with a huge bytecode array and one native method like this :

    public static native int tfAHDD(Object obj, int I, int i2, int i3, int i4, int i5, int i6, int i7, int i8);

the whole class is so long but it's only because of the byte array this is the link of the class my main questions are why the file has different sizes every time and why there are not other native methods? how the app will run this method and finally how can I analysis this .so file

  • Did you analyze the Java code with Apktool or dex2jar? – Biswapriyo Apr 3 at 4:23
  • @Biswapriyo there is nothing to analyze only an application class and i upload it and you can see it too i can understand how the app loads classes without calling in java – Amin Apr 3 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.