AwesomeREA.org

Tool

Simplify

Generic Android deobfuscator built on smalivm, a sandboxed Dalvik virtual machine that executes each method and records every possible register and class value along all execution paths, taking both branches when a value such as file or network input is unknown. Simplify then repeatedly applies constant propagation, dead-code removal, unreflection and peephole optimizations to the APK or DEX, which can decrypt strings and remove reflection while keeping behaviour the same; it does not rename classes or methods. smalivm can also be used as a library, and the last release adds sdbg, a step-through Smali debugger built on it.

Requirements and limitations

  • Development is inactive: the latest release, v1.3.0 of 2020-03-30, ships simplify, smalivm and sdbg jars, and the reviewed master commit dates from 2021-05-23. The project pins smali/dexlib2 2.4.0 and, by default, builds its Android framework reference from android-25 classes, so check results on apps that use newer DEX or API features.
  • Run it as java -jar simplify.jar on a user-supplied APK or DEX. Building needs JDK 8, a recursive clone for the AndroidFrameworkSmali submodule of reference framework classes, and the Gradle fatjar task. Execution limits on visits, call depth and time apply per method; the README advises narrowing large apps with include and exclude patterns, and output DEX defaults to API level 15.
  • --remove-weak, on by default, removes code even when it has weak side effects, and --ignore-errors may lead to unexpected behaviour, so compare output with the original code. The repository includes a project-provided obfuscated example app for testing; tests ran through a Travis CI configuration using Oracle JDK 8, the repository has no GitHub Actions workflow, and nothing was run in this review.
  • Dual-licensed: GPL-3.0 for open-source use, or a commercial license that permits binary distribution without source redistribution. Android framework classes and dependencies keep their own terms. The reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Android tools
Relationship
Foundation tool
Targets
App

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · CalebFenton/simplify · Revision 29fb25d
  2. LICENSE.GPL GitHub · CalebFenton/simplify · Revision 29fb25d
  3. LICENSE.COMMERCIAL GitHub · CalebFenton/simplify · Revision 29fb25d
  4. .gitmodules GitHub · CalebFenton/simplify · Revision 29fb25d
  5. .travis.yml GitHub · CalebFenton/simplify · Revision 29fb25d
  6. smalivm/build.gradle GitHub · CalebFenton/simplify · Revision 29fb25d
  7. https://github.com/CalebFenton/simplify/releases/tag/v1.3.0