Skip to content

zj1866/FRIDA-DEXDump

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

63 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

FRIDA-DEXDump

screenshot

Features

  1. support fuzzy search broken header dex.
  2. fix struct data of dex-header.
  3. compatible with all android version(frida supported).
  4. support loading as objection plugin ~
  5. pypi package has been released ~

Requires

  • frida: pip install frida
  • [optional] click pip install click

Installation

From pypi

pip3 install frida-dexdump
frida-dexdump -h

From source

git clone https://github.com/hluwa/FRIDA-DEXDump
cd FRIDA-DEXDump/frida-dexdump
python3 main.py -h

Usage

  • Run frida-dexdump or python3 main.py to attach current frontmost application and dump dexs.

  • Or, use command arguments:

    -n: [Optional] Specify target process name, when spawn mode, it requires an application package name. If not specified, use frontmost application.
    -p: [Optional] Specify pid when multiprocess. If not specified, dump all.
    -f: [Optional] Use spawn mode, default is disable.
    -s: [Optional] When spawn mode, start dump work after sleep few seconds. default is 10s.
    -d: [Optional] Enable deep search maybe detected more dex, but speed will be slower.
    -h: show help.
    
  • Or, loading as objection plugin

    1. clone this repo and move frida_dexdump into your plugins folder, eg:
      git clone https://github.com/hluwa/FRIDA-DEXDump ~/Downloads/FRIDA-DEXDump;
      mv ~/Downloads/FRIDA-DEXDump/frida_dexdump ~/.objection/plugins/dexdump
      
    2. start objection with -P or --plugin-folder your plugins folder, eg:
      objection -g com.app.name explore -P ~/.objection/plugins
      
    3. run command:
      1. plugin dexdump search to search and print all dex
      2. plugin dexdump dump to dump all found dex.

About

Fast search and dump dex on memory.

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • Python 69.4%
  • JavaScript 30.6%