Endoscope: Unpacking Android Apps with VM-Based Obfuscation
summary
Shows a practical method that recovers original Dalvik bytecode from VM‑obfuscated Android apps by combining hooking of native registration (keeps hook registerNative), instruction‑level instrumentation with QBD to trace dispatcher/handler execution, and per‑handler genetic signature hashes that tolerate pointer and immediate differences. Demonstrates restoring Rhino bytecode to AST via Rhino’s Source API for one case and a general pipeline that learns handler→bytecode mappings from a seeded app and then successfully unmasks handlers in the wild, though it requires accessible entry functions and typical packer translation patterns.
AI-written summary · about
chapters (6)
- 0:00VM-based obfuscation on Android
- 3:03Rhino bytecode in malware
- 8:06Reversing Rhino bytecode
- 11:48Challenges in unpacking VM obfuscation
- 16:58Mapping relations via execution traces
- 26:27Insights on VM obfuscation trends
related talks
45mReverse engineering mobile apps: how, why, and what now?
15mObfuscation in Mobile Apps
47mAttacking Android Applications
40mDynamic Binary Instrumentation Techniques to Address Native Code Obfuscation
37mPack your Android: Everything you need to know about Android Boxing
36mMaster the Art of Code Obfuscation from Simple to Advanced
38mReverse Engineering is not just for hackers
33mReverse - Engineering apps on the device - how far can we go?