AwesomeREA.org

Tool

dex-oracle

Pattern-based Dalvik deobfuscator that takes an APK, a DEX file or a Smali directory, disassembles it with baksmali and runs plugins that look for obfuscation patterns in the Smali code. To learn what a matched call returns, such as a decrypted string, it merges a small driver into the app's DEX, pushes it to a connected Android device or emulator and invokes the static method there through reflection; the result replaces the call as a constant before the APK or DEX is reassembled. Plugins cover simple string encryption, indexed string and class lookups, certain DexGuard patterns and some reflection, and the author describes it as the inspiration for Simplify.

Targets
App
Category
Android tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Development is inactive: the latest RubyGems and GitHub release is 1.0.5 of 2016-07-26, while the reviewed master commit of 2018-12-13 already declares an unpublished 1.0.6. It is installed as a Ruby gem or from source with Bundler; the repository pins Ruby 2.5.3 and needs Java, adb, and smali and baksmali on the PATH, with the README's setup snippet using smali 2.2.5.
  • Input is the user's own APK, DEX or Smali directory, and a running emulator or attached device with Android 5.0 or later is required because matched methods really execute on it. The README prefers an emulator and warns that the executed code may be hostile; its troubleshooting section instead suggests Android 4.4.2 (API level 19, ARM) if the driver crashes. Only static methods can be executed, and plugins can be disabled when a pattern matches code that is not obfuscation.
  • The res directory ships the prebuilt driver.dex and a copy of the Android SDK's dx.jar, which the tool uses for DEX merging; rebuilding the driver needs Gradle and the SDK's dx tool. The README lists three plugins, while the plugins directory holds six, adding indexed string and class lookups and a bitwise string-decryption pattern.
  • RSpec tests with tiny hello-world APK and DEX fixtures and Smali pattern samples ran through a Travis CI configuration on Ruby 2.5.3; the repository has no GitHub Actions workflow, and nothing was run in this review.
  • MIT (LICENSE.txt and the gemspec); dx.jar and the smali tools keep their own terms. The reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · CalebFenton/dex-oracle · Revision d6be172
  2. lib/dex-oracle/driver.rb GitHub · CalebFenton/dex-oracle · Revision d6be172
  3. lib/dex-oracle/plugins GitHub · CalebFenton/dex-oracle · Revision d6be172
  4. res GitHub · CalebFenton/dex-oracle · Revision d6be172
  5. dex-oracle.gemspec GitHub · CalebFenton/dex-oracle · Revision d6be172
  6. lib/dex-oracle/version.rb GitHub · CalebFenton/dex-oracle · Revision d6be172
  7. .travis.yml GitHub · CalebFenton/dex-oracle · Revision d6be172
  8. LICENSE.txt GitHub · CalebFenton/dex-oracle · Revision d6be172
  9. https://rubygems.org/gems/dex-oracle/versions/1.0.5

More in Apps

All 116 entries in Apps