BlackOuTv2/DexShell-Research
GitHub: BlackOuTv2/DexShell-Research
DexShell/DexProtectX Android打包器逆向研究工具
Stars: 6 | Forks: 0
# 🔬 DexShell Android Packer — 深度逆向工程
**对商业 Android Packer DexShell / DexProtectX 的完整逆向工程。**
v26 bytecode interpreter → v29 native AOT compiler。记录并绕过了全部 11 层防篡改保护。
[📊 **可视化研究 (HTML + 流程图)**](https://BlackOuTv2.github.io/DexShell-Research) · [🛠️ 工具](#-tools) · [🔓 绕过](#-bypass-techniques)
### 👤 研究员与联系方式
| | |
|---|---|
| **GitHub** | [@BlackOuTv2](https://github.com/BlackOuTv2) |
| **Telegram** | [@BlackOuTv1](https://t.me/BlackOuTv1) |
| **LinkedIn** | [linkedin.com/in/black0ut](https://www.linkedin.com/in/black0ut/) |
| **Instagram** | [@cyberxblackout](https://www.instagram.com/cyberxblackout/) |
| **研究类型** | 独立 Android 安全研究 |
| **研究范围** | 静态 + 动态分析，Frida instrumentation，native ARM64 反汇编 |
## 📋 目录
| | |
|---|---|
| [什么是 DexShell？](#what-is-dexshell) | [APK 结构](#apk-structure) |
| [Bootstrap 序列](#bootstrap-sequence) | [防篡改 (11 层)](#anti-tamper-mechanisms) |
| [VMP 架构](#vmp-architecture-v26-vs-v29) | [InstrumentationHijacker](#instrumentationhijacker-new-v29) |
| [DEX Header 混淆](#dex-header-obfuscation-new-v29) | [字符串加密](#string-encryption) |
| [Runic Unicode 命名](#runic-unicode-obfuscation-new-v29) | [网络与后端](#network--backend) |
| [发现的 AOSP 密钥](#aosp-platform-keys-found-in-apk) | [绕过技术](#bypass-techniques) |
| [构建的工具](#-tools) | [v26 → v29 差异对比](#v26--v29-diff) |
## 什么是 DexShell？
**DexShell**（以 [DexProtectX](https://dexprotectx.pro) 名称销售）是一款商业 Android Packer，通过以下方式保护应用 DEX：
- **DEX 加密** — 受保护的代码仅在运行时解密
- **VMP (虚拟机保护)** — v26：bytecode interpreter · v29：native AOT compilation
- **11 层防篡改** — 针对 Frida, Xposed, root, 调试器以及 MTE-aware 的检测
- **InstrumentationHijacker** — 替换 Android `Instrumentation` 以捕获分析框架
## APK 结构
```
DexShellx_V29.0.apk (33.74 MB)
├── assets/
│ ├── DexShell.mp3 ← 9.2MB XOR-encrypted VMP container
│ │ (3 embedded ELFs: arm64/arm32/x86, DT_SONAME=libdexshellx.so)
│ ├── dexshellx.pro ← Config: 2.6KB (v26) → 21KB (v29), DXHD5 format
│ ├── libVMDexShellx.so ← 465KB PairIP anti-tamper SDK (DT_SONAME=libpairipcore.so)
│ └── dexshell/arm64-v8a/
│ └── libdexshell.so ← Core loader, decrypted at runtime, XOR key: 27d39683cc50fcba
│
├── unknown/keys/ ← ⚠️ AOSP platform.pk8 / media.pk8 / shared.pk8 bundled
│
├── classes.dex ← DexShell runtime (only 15 visible classes in v29)
└── classes5–16.dex ← Protected app — method bodies replaced with N.invoke(idx) stubs
```
## Bootstrap 序列
```
App spawn
└─ DexShellxApplication.attachBaseContext()
├─ Load libVMDexShellx.so (PairIP)
│ └─ JNI_OnLoad: install all detection hooks
│ (dl_iterate_phdr · /proc scan · stat · opendir · tgkill)
│
├─ Load libdexshell.so (decrypted from assets at runtime)
│ ├─ Decrypt DexShell.mp3 → extract libdexshellx.so to txt/%s [encrypted on disk]
│ ├─ dlopen → decrypt in memory → valid ELF in RAM only
│ └─ ART ClassLinker::DefineClass → load 514 hidden classes
│
└─ Application.onCreate()
├─ InstrumentationHijacker.ᛱᲅ() [NEW v29]
│ └─ Reflect ActivityThread.mInstrumentation → swap ProxyInstrumentation
│ └─ Now monitors ALL activity calls, polls execStartActivity 28×/4s
│
└─ DREXz delayed_detection starts (~4s timer)
└─ K.ᛳᲆᛲ(Context, String)V → load protected app
```
## 防篡改机制
| # | 机制 | 库 | 检测方法 |
|---|-----------|---------|-----------------|
| 1 | `/proc/self/maps` 扫描 | libdexshell.so | 内存映射中的 Frida agent 区域名 |
| 2 | `TracerPid` 检查 | libdexshell.so | `/proc/self/status` 中的非零值 |
| 3 | **GOT 损坏陷阱** | libdexshell.so | 覆盖 libart GOT → 在 `0x77d61f0220` 处触发 SIGSEGV |
| 4 | `dl_iterate_phdr` | libVMDexShellx.so | ByteHook 枚举 ELFs 查找 frida-agent |
| 5 | `opendir/readdir` | libVMDexShellx.so | 扫描磁盘上的 Frida 文件目录 |
| 6 | `stat()` | libVMDexShellx.so | 文件系统上的 Frida 文件名 |
| 7 | `__system_property_get` | libVMDexShellx.so | `ro.debuggable`, `ro.build.tags` |
| 8 | `syscall(SYS_tgkill=131)` | libdexshell.so | 原始 syscall 绕过 `kill()` hook |
| 9 | **VMP dispatch 完整性** | libdexshellx.so | 黄金比例计数器 + 每个方法的 LR thunk 检查 |
| 10 | **InstrumentationHijacker** | Runtime DEX | ProxyInstrumentation 监控所有 activity hooks |
| 11 | `delayed_detection` | DREXz | 延迟约 4 秒的完整扫描 |
### GOT 陷阱绕过
```
// DexShell overwrites libart.so GOT with 0x77d61f0220 on Frida detection.
// Any JNI call through that stub crashes. Catch and resume at LR:
Process.setExceptionHandler(details => {
if (details.address.equals(ptr('0x77d61f0220'))) {
details.context.pc = details.context.lr;
details.context.x0 = ptr(1);
return true; // handled, resume
}
});
```
### `dl_iterate_phdr` 绕过
```
// ByteHook calls dl_iterate_phdr to find frida-agent-64.so.
// Interceptor.replace causes infinite recursion here — must use Interceptor.attach:
Interceptor.attach(Module.findExportByName(null, 'dl_iterate_phdr'), {
onEnter(args) {
this._origCallback = args[0];
const filtered = new NativeCallback((info, size, data) => {
const name = info.add(16).readCString() || '';
if (name.includes('frida') || name.includes('frijia')) return 0;
return this._origCallback(info, size, data);
}, 'int', ['pointer','size_t','pointer']);
args[0] = filtered;
}
});
```
## VMP 架构：v26 vs v29
### v26 — 线程化字节码解释器
```
Protected Java method → N.invoke(methodIndex, args[])
↓
libdexshellx.so: fetch bytecode record from DexShell.mp3 container @ offset[idx]
↓
256-opcode threaded interpreter loop
↓
Return result via JNI
```
**DexShell.mp3 容器二进制格式** (data section @ `0xD1051`)：
```
// Per-class (repeating):
uint16 name_len;
char[] class_descriptor; // e.g. "La/o/MainActivety;"
uint16 method_count; // ⚠️ uint16 NOT uint32 — critical for parsing
repeat method_count:
uint32 global_method_idx;
uint32 vm_bytecode_offset;
// Total: 1,395 classes, ~14,375 methods across 3 ELFs (arm64/arm32/x86)
```
### v29 — 原生 AOT 编译器
```
Protected Java method → N.ᛱᛱ(methodIndex, args[]) (Runic-named dispatcher)
↓
libdexshellx.so: funcVaddr[methodIndex] ← dispatch table from RELA relocs
↓
Integrity checks:
- Golden-ratio counter: counter * 0x9e3779b9 ^ 0x61c88646 at fixed .data slot
- Dispatch return addr: LR must match expected thunk
↓ (any mismatch → JNIEnv->FatalError)
Execute compiled ARM64 native function (1,448 methods, 1,140 named)
```
**Dispatch table 提取：**
```
# 对 .data.rel.ro 应用 R_AARCH64_RELATIVE 重定位 → 获取 funcVaddr[methodId]
for r_off, r_type, _, r_addend in elf.rela_entries('.rela.dyn'):
if r_type == 1027: # R_AARCH64_RELATIVE
struct.pack_into('
*研究仅供教育目的。*
**[@BlackOuTv2](https://github.com/BlackOuTv2)** ·
**[Telegram @BlackOuTv1](https://t.me/BlackOuTv1)** ·
**[LinkedIn](https://www.linkedin.com/in/black0ut/)** ·
**[Instagram @cyberxblackout](https://www.instagram.com/cyberxblackout/)**
标签：Android安全, Docker支持, Frida, 云资产清单, 代码脱壳, 动态分析, 安全研究, 逆向工程