CodingGay/BlackDex
BlackDex
BlackDex is an Android runtime-level DEX extraction tool that recovers bytecode from protected APK files across Android versions 5 through 12 without requiring root access. It operates by hooking system APIs, reading DexFile cookies, and repairing obfuscated method bodies from memory, supporting both 32-bit and 64-bit architectures for installed and uninstalled applications.
The tool distinguishes itself through a multi-method approach that combines cookie-based dumping, API hooking, and memory-based instruction repair to handle first through third generation packers. It reconstructs method bodies by copying opcodes from external memory blocks back into the Dex file structure, fixing erased DexCode instructions and reducing nop-filled stubs. Separate compiled binaries are provided for each instruction set to match the target app's native architecture.
BlackDex processes both installed apps and uninstalled APK files, extracting DEX content from apps already on the device in seconds or from archive files stored on disk. It removes protection layers from APK files without requiring installation, and operates on physical devices or emulators across Android 5.0 through 12 without external dependencies.
Features
- APK Unpacking - Extracts DEX bytecode from protected Android APK files, both installed and uninstalled.
- 32/64-bit Build Variants - Ships separate 32-bit and 64-bit binaries to match the target app's native architecture.
- Multi-Generation Packer Bypass - Bypasses first through third generation packers by targeting code loading from disk, memory, or instruction extraction.
- DEX Instruction Repair - Reconstructs obfuscated method bodies by copying opcodes from external memory blocks into the Dex file.
- Android DEX Dumpers - Dumps DEX files from installed apps and uninstalled APKs using DexFile cookie and hook API methods.
- Android DEX Unpackers - Extracts and repairs DEX bytecode from protected Android apps without requiring root access.
- DEX File Recovery - Recovers DEX files from obfuscated or packed Android applications by bypassing protection layers.
- ART Runtime Compatibility - Adapts to ART runtime changes across Android 5 through 12 for DEX extraction.
- Multi-Version Android Unpackers - Supports Android versions 5 through 12 with separate 32-bit and 64-bit builds for broad device compatibility.
- Android Runtime API Hooking - Intercepts Android runtime function calls to capture DEX content as it loads into memory.
- Android Version Range Support - Runs on Android devices from version 5.0 through 12, covering both legacy and modern systems.
- Cross-Version Android Support - Runs on Android devices from version 5.0 through 12 without root access.
- No-Root DEX Extraction - Extracts DEX files from installed apps without requiring root access or system modifications.
- 32/64-bit Architecture Support - Provides separate builds for 32-bit and 64-bit architectures to unpack apps compiled for either.
- Android APK Unpackers - Removes obfuscation layers from installed and uninstalled APK files to recover original application code.
- Android Method Instruction Repairers - Reconstructs obfuscated method bodies by filling in redirected instructions and fixing NOP placeholders.
- DexFile Cookie Retrieval - Reads DEX data by accessing the internal DexFile cookie handle from the Android runtime.
- Direct APK Extraction - Extracts DEX bytecode directly from uninstalled APK files stored on disk.
- Android Device Emulator Compatibility - Operates on physical phones or emulators across Android 5.0 through 12 without external dependencies.
