Welcome to simplify Discussions!

[CalebFenton]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[apkunpacker]

Myself ApkUnpacker . I really amazed after see simplify project and use it daily for simplification of different apk/apks
I have some requests

1. Give a option to choose among dead code removal , string decryption , white noise solving etc so we can choose which thing we want to try
2. for string decryption mostly target only return value of any of
   anything;->anything(anything)Ljava/lang/String;
   and
   1st parameter value of
   Ljava/lang/String; init method with any argument
   so instead of executing every instruction it can run these user defind method on whole dex .
   as per as your instruction there is option to define which classes need to be simplified but most of time string encryption applied on whole dex so by default we need to target whole apk which is slow , if we can give user defined method which simplify match and only execute that then atleast string decryption speed will be greatly increased.

and at last thanks for great idea and project 👌

[CalebFenton]

Idea #1 is quite reasonable and shouldn't be too difficult. It's on my todo list somewhere. Doing it "best" would involve documenting the different types of optimizations a bit, otherwise it's a super advanced feature that only a few power users would know how to use. But again, it should be simple to implement and would really help when some types of deobfuscation are causing problems.

For your idea #2, it sounds like you want a selection filter for which methods to "step into". So you could specify the "exclude types", the "include types" and this new filter. This makes a lot of sense for your use case. Do you have a good example apk / dex for this? Also, have you tried dex-oracle? It was made for solving this specific problem.

[apkunpacker]

On android itself there are many tool which can decrypt strings of whole apk with emulating way in few second but none of them provide deadcode removal , white noise etc but those tool are not effective in detecting string encryption and many time show no decryptable data found even there is encrypted string so they given log injection way so after every predefined string method match they insert android logs so when app run, decrypted string saved in files + in logcat also . same possible with frida also but the way analysis matter is to see decrypted string in dex itself rather decrypted somewhere else and then replace them . in this case simplify is superior . i will upload a demo apk asap

[apkunpacker]

Sample.zip
Includes a simple and small apk with 3 varient - original & String Encrypted & log injected.
Every string picked up from large string pool . every string decrypted from different method so may be hard from hooking as each and every method need to be hooked for decryption but method return signature is same ()Ljava/lang/String; so if we can only target those method whose return signature is java/lang/String it can process it easily

[apkunpacker]

https://virustotal.com/gui/file/32163262846232d1f5a7a67eda2c4615c3f6b9224684fc3f1f2d154c9ea10e37
https://koodous.com/apks/32163262846232d1f5a7a67eda2c4615c3f6b9224684fc3f1f2d154c9ea10e37
6H INJECTOR V3.7.apk.zip

Ofc its very serious malware but not detected by VT and Koodous , it receive command from server as json and execute some root operation like cleaning sdcard , clearing /system/ and at last reboot . now simplifying whole dex is useless point as we can grab all info by just watching string as ip address and command are hardcoded which always decrypted by ()Ljava/lang/String; so if simplify can include which method signature to include in simplification process it can greatly reduce analysis time

[euzada]

Good afternoon,
First, thank you for this great tool. I have 2 questions/requests:
1- in the debugger, is there a way to see the value in the registers (V0, V1, ...) in Hexadecimal? The debugger represents the value in decimal. It will be great if both are shown.
2- How we can include or exclude more than one classes? let's say I want to run simplify and exclude "com/google" and "androidx". If I type -et "com/google" -et "androidx", simplify will take only the last exclude value which is "androidx". It will be possible to create a list of including classes and excluding classes in a txt file and import the text file to simplify?
something like that:
java -jar simplify.jar -rules "path_to_rules_file.txt" "name_of_apk.apk"
rules.txt will include something like that
include first the general settings:
--max-call-depth 1000
--max-address-visits 1000
...
include after the classes to be included in the analysis
!com/google/** to be excluded
!androidx/** to be excluded
com/packagename/** to be included

Thank you,
euzada

[CalebFenton]

Thanks for the suggestions. #1 seems fine. Should be an easy change if you want to attempt a PR.

#2 it's a regex, you can exclude multiple classes with something like -et (com/google/|androidx/). How's that work for you?

[euzada]

That's perfect. I will try it with regex.
Thank you

[apkunpacker]

sir its possible to add a new command in sdbg to debug new method after executing debugger ? like we started sdbg for
java -jar sdbg.jar "Lcom/new;->a()Z"
and after the end of this method execution sdbg say "executiom terminated" . now the point - it is possible to provide there new method as arguments so it can start debugging that so we not need to start debugger again. to be honest i not find such option in sdbg so requestimg to add such option also