CalebFenton/simplify
Simplify
Simplify es un sandbox de máquina virtual de Android, trazador de ejecución de bytecode y framework de análisis estático. Sirve como un desofuscador de bytecode Dalvik diseñado para recuperar código legible a partir de binarios mediante la simulación del comportamiento del programa sin necesidad de un dispositivo físico.
El proyecto se distingue por utilizar análisis de grafos de ejecución para resolver llamadas de reflexión y simplificar código ofuscado mediante propagación de constantes y eliminación de código muerto. Emplea simulación de ejecución multipath para rastrear todos los posibles resultados de ramas condicionales y mapea el flujo de instrucciones para identificar valores constantes.
El sistema cubre una amplia gama de capacidades de análisis, incluyendo el rastreo de propagación de excepciones, categorización de efectos secundarios de métodos y simulación de llamadas a la API de Java. También proporciona mecanismos para interceptar ejecuciones de métodos mediante hooks personalizados para monitorear o anular estados de la máquina virtual.
Features
- Android VM Sandboxes - Implements a virtual machine environment that emulates Dalvik instructions to analyze program behavior without a physical device.
- Android Application Reverse Engineering - Analyzes the structure and flow of Android applications by resolving reflected calls and mapping execution paths.
- Diagnostic Execution Tracers - Tracks variable values and instruction flow to resolve reflected calls and constant values during execution.
- Dalvik Bytecode Execution - Executes Dalvik bytecode within a virtual machine sandbox to generate execution graphs of register and class values.
- Execution Flow Tracing - Generates a graph of instructions that tracks register states and ancestry to define the execution order.
- Reflection Call Resolution - Identifies targets of reflected method and field lookups and replaces them with direct invocations.
- Bytecode Emulators - Executes Android instructions in a controlled environment to analyze program behavior without a physical device.
- Virtual Machine State Simulators - Runs specific pieces of Android code in a controlled environment to determine the values of registers and classes.
- Deobfuscation Tools - Removes confusing or hidden code patterns from Android binaries to make the underlying logic readable.
- Obfuscated Code Analysis - Analyzes execution graphs to perform constant propagation and dead code removal to improve bytecode readability.
- Java Bytecode Deobfuscators - Simplifies obfuscated Android bytecode using execution graph analysis and dead code removal.
- Multi-Path Execution Simulation - Tracks all possible outcomes of conditional branches when input arguments are unknown to produce a path graph.
- Path-Based State Tracking - Simulates all possible conditional branch outcomes to generate a comprehensive graph of potential program execution paths.
- Execution Graph Analysis - Maps instruction flow and register ancestry to identify constant values and remove unreachable dead code.
- Static Analysis Frameworks - Provides a framework for simulating Java API calls and exception propagation to recover readable code from binaries.
- Configurable Execution Sandboxes - Runs bytecode with configurable limits on call depth and instruction counts to prevent infinite loops.
- Dynamic Class Generation - Creates realistic class objects for input bytecode files to support methods that operate on custom classes.
- Exception Propagation Tracing - Simulates the throwing and bubbling of exceptions through the call stack to identify error handling paths.
- Java Runtime Emulations - Executes safe Java methods using reflection to increase performance and ensure correct standard library behavior.
- Reflection-Based API Bridging - Executes standard Java library methods via reflection to ensure behavioral correctness during virtual machine analysis.
- Side-Effect Analysis - Categorizes instructions based on their impact on external state to determine if code can be safely removed or inlined.
- Android - Simulates the execution of Android bytecode in a sandbox to understand malicious app behavior.
- Loop Detection - Prevents infinite execution during simulation by applying configurable limits on instruction counts, call depth, and time.
- Side-Effect Categorization - Classifies instructions by their impact on external state to determine if code can be safely inlined or deleted.
- Android Obfuscation - Generic deobfuscator for Android applications.
- Android Static Analysis Tools - Tool for de-obfuscating Android packages into dex files.
- Reverse Engineering Tools - Generic Android deobfuscator for simplifying code.
