Android unpacking/unshelling—use frida-dexdump to dump the DEX released by a hardening packer from memory. Applicable when opening the APK in jadx only shows the packer stub and not the real business code (whole-release packers like Tencent Legu/Bangcle/360 hardening). Trigger scenarios — unpacking, unshelling, frida-dexdump, dump dex, hardening, can't see the real code, packer/shell, unpack.
Android unpacking/unshelling—use frida-dexdump to dump the DEX released by a hardening packer from memory. Applicable when opening the APK in jadx only shows the packer stub and not the real business code (whole-release packers like Tencent Legu/Bangcle/360 hardening). Trigger scenarios — unpacking, unshelling, frida-dexdump, dump dex, hardening, can't see the real code, packer/shell, unpack.
Android Unpacking (frida-dexdump)
frida-dexdump is installed globally (frida-dexdump is on PATH and relies on frida 17.7.3). At app runtime it scans process memory and dumps the DEX that has been decrypted and landed in memory; it is effective against whole-release hardening packers.
When it's needed
After opening an APK with [[jadx-reverse-engineering]] / [[android-re-decompile]], if:
You only see a few StubApp / proxy Application classes and no real business logic
classes.dex is very small or has very few classes
→ it means the app is hardened; you need to unpack first, then feed the dumped DEX back into jadx to inspect.
Prerequisites
A device is connected and frida-server is running on it
The target app is installed
Usage
# When the target app is already in the foreground (most stable): open the app manually first and let it finish hardening/decryption
frida-dexdump -FU # -F=attach foreground app, -U=USB device# Or specify a package name to spawn
frida-dexdump -U -f <package_name>
# Specify output directory + deep search (when the packer hides things deeply)
frida-dexdump -FU -d -o ./dexout
The dumped *.dex files are in the output directory; drag them straight into jadx-gui or run jadx ./dexout/*.dex to continue the analysis.
Limitations (important)
Only effective against "whole-release" packers; it is powerless against method-extraction/VMP packers (the dumped method bodies come out empty)—those require FART/active-invocation-style tooling or manual work, and modern packers usually require device-side Shamiko/ZygiskFrida to first defeat Frida detection
Dump timing must be after hardening decryption: let the app fully start and reach the main screen before dumping
Multi-DEX apps dump multiple files; merge them into one directory for jadx
Connecting with other skills
Before unpacking: [[apktool-decompile]] to check whether the Application class in AndroidManifest is a packer stub
After unpacking: dumped DEX → [[jadx-reverse-engineering]] / [[android-re-decompile]] to inspect the real code → [[frida-mitm-capture]] to capture traffic
If the packer's Frida detection causes the dump to fail: a device-side anti-detection layer is needed (Shamiko + ZygiskFrida)
