Android unpacking/unshelling—use frida-dexdump to dump the DEX released by a hardening packer from memory. Applicable when opening the APK in jadx only shows the packer stub and not the real business code (whole-release packers like Tencent Legu/Bangcle/360 hardening). Trigger scenarios — unpacking, unshelling, frida-dexdump, dump dex, hardening, can't see the real code, packer/shell, unpack.
Installation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Android unpacking/unshelling—use frida-dexdump to dump the DEX released by a hardening packer from memory. Applicable when opening the APK in jadx only shows the packer stub and not the real business code (whole-release packers like Tencent Legu/Bangcle/360 hardening). Trigger scenarios — unpacking, unshelling, frida-dexdump, dump dex, hardening, can't see the real code, packer/shell, unpack.
Android Unpacking (frida-dexdump)
frida-dexdump is installed globally (frida-dexdump is on PATH and relies on frida 17.7.3). At app runtime it scans process memory and dumps the DEX that has been decrypted and landed in memory; it is effective against whole-release hardening packers.
When it's needed
After opening an APK with [[jadx-reverse-engineering]] / [[android-re-decompile]], if:
You only see a few StubApp / proxy Application classes and no real business logic
classes.dex is very small or has very few classes
→ it means the app is hardened; you need to unpack first, then feed the dumped DEX back into jadx to inspect.
Prerequisites
A device is connected and frida-server is running on it
The target app is installed
Usage
# When the target app is already in the foreground (most stable): open the app manually first and let it finish hardening/decryption
frida-dexdump -FU # -F=attach foreground app, -U=USB device# Or specify a package name to spawn
frida-dexdump -U -f <package_name>
# Specify output directory + deep search (when the packer hides things deeply)
frida-dexdump -FU -d -o ./dexout
The dumped *.dex files are in the output directory; drag them straight into jadx-gui or run jadx ./dexout/*.dex to continue the analysis.
Limitations (important)
Only effective against "whole-release" packers; it is powerless against method-extraction/VMP packers (the dumped method bodies come out empty)—those require FART/active-invocation-style tooling or manual work, and modern packers usually require device-side Shamiko/ZygiskFrida to first defeat Frida detection
Dump timing must be after hardening decryption: let the app fully start and reach the main screen before dumping
Multi-DEX apps dump multiple files; merge them into one directory for jadx
Connecting with other skills
Before unpacking: [[apktool-decompile]] to check whether the Application class in AndroidManifest is a packer stub
After unpacking: dumped DEX → [[jadx-reverse-engineering]] / [[android-re-decompile]] to inspect the real code → [[frida-mitm-capture]] to capture traffic
If the packer's Frida detection causes the dump to fail: a device-side anti-detection layer is needed (Shamiko + ZygiskFrida)
