hluwa/frida-dexdumpArchived
Frida Dexdump
frida-dexdump is an Android memory forensics tool that recovers Dalvik Executable (DEX) files from running application processes using the Frida dynamic instrumentation framework. It functions as a Frida-based runtime analyzer and DEX memory dumper, capable of extracting obfuscated or packed DEX files without modifying the Android system.
The tool distinguishes itself through its ability to repair corrupted or missing DEX file headers using heuristic analysis and fuzzy matching techniques. It employs fuzzy boundary detection to identify DEX file boundaries in memory even when headers are damaged, and uses memory-scanning byte matching to locate executable binary blobs across process heap and mapped memory regions. This enables recovery of packed DEX files that standard tools would miss.
The tool operates by injecting a JavaScript agent into a running Android process via Frida, communicating scan results and extracted data over a bidirectional RPC channel. It scans process memory for Dalvik Executable magic bytes and structural markers, then reconstructs headers by matching internal data layout patterns against known byte-sequence signatures. The deployment approach uses dynamic instrumentation to run without system modifications, enabling simple installation and removal.
Features
- Memory Forensics - A memory analysis utility that recovers obfuscated or packed DEX files from running Android applications.
- Binary Header Reconstruction - Rebuilds corrupted or missing DEX file headers by matching internal data layout patterns against known byte-sequence signatures.
- Heuristic DEX Boundary Detection - Identifies DEX file boundaries in memory by heuristic analysis of class definitions and method offsets rather than relying on intact headers.
- Android DEX Dumpers - A tool that extracts Dalvik Executable files from Android process memory using the Frida instrumentation framework.
- DEX File Recovery - Extracting Dalvik Executable files from active app processes without modifying the Android system.
- Memory Pattern Searching - Scanning process memory with heuristic boundary detection and byte sequence matching to locate executable binary blobs.
- Android Runtime Analyzers - A dynamic instrumentation tool that inspects Android process memory and reconstructs executable binary blobs.
- Frida Agent RPC Channels - Communicates scan results and extracted data between the injected Frida agent and the host-side Python tool over a bidirectional RPC channel.
- Non-Modifying Deployments - Deploys via a dynamic instrumentation tool without altering the Android system, enabling one-click installation and easy cleanup.
- Live Memory Dumpers - Scans a running app's memory for Dalvik Executable files and extracts them for offline analysis.
- Process Memory Access - Reads and iterates over the address space of a live Android application to locate executable binary blobs without filesystem access.
- Frida-Based Instrumentation - Using the Frida dynamic instrumentation framework to inspect and dump process memory on Android runtimes.
- Android Application Reverse Engineering - Recovering obfuscated or packed DEX files from running Android applications for security analysis and reverse engineering.
- DEX Magic Byte Scanning - Scans process heap and mapped memory regions for Dalvik Executable magic bytes and structural markers using pattern-based search.
