├── .gitignore ├── LICENSE ├── README.md ├── dump-dex ├── go.mod └── main.go /.gitignore: -------------------------------------------------------------------------------- 1 | # If you prefer the allow list template instead of the deny list, see community template: 2 | # https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore 3 | # 4 | # Binaries for programs and plugins 5 | *.exe 6 | *.exe~ 7 | *.dll 8 | *.so 9 | *.dylib 10 | 11 | # Test binary, built with `go test -c` 12 | *.test 13 | 14 | # Output of the go coverage tool, specifically when used with LiteIDE 15 | *.out 16 | 17 | # Dependency directories (remove the comment below to include it) 18 | # vendor/ 19 | 20 | # Go workspace file 21 | go.work 22 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2024 dodola 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | # DumpDex 3 | dump dex from memory NEED ROOT 4 | 5 | # Build 6 | GOOS=android GOARCH=arm64 GOARM=7 go build . 7 | 8 | # Run 9 | ```bash 10 | adb push dump-dex /data/local/tmp/ 11 | adb shell "chmod 755 /data/local/tmp/dump-dex" 12 | ./dump-dex pid 13 | ``` 14 | -------------------------------------------------------------------------------- /dump-dex: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dodola/DumpDex/ecc71be47ee0b280be0c0667df72e88db705e3d8/dump-dex -------------------------------------------------------------------------------- /go.mod: -------------------------------------------------------------------------------- 1 | module dump-dex 2 | 3 | go 1.21.1 -------------------------------------------------------------------------------- /main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "bufio" 5 | "encoding/binary" 6 | "fmt" 7 | "io" 8 | "os" 9 | "strconv" 10 | "strings" 11 | ) 12 | 13 | const ( 14 | dexMagic = "dex\n035\x00" 15 | ) 16 | 17 | type memorySegment struct { 18 | startAddr uintptr 19 | endAddr uintptr 20 | perms string 21 | offset int64 22 | devMajor int64 23 | devMinor int64 24 | inode int64 25 | pathname string 26 | } 27 | 28 | func parseMapsFile(pid int) ([]memorySegment, error) { 29 | f, err := os.Open(fmt.Sprintf("/proc/%d/maps", pid)) 30 | if err != nil { 31 | return nil, err 32 | } 33 | defer f.Close() 34 | 35 | var segments []memorySegment 36 | rd := bufio.NewReader(f) 37 | for { 38 | line, _, err := rd.ReadLine() 39 | if err != nil { 40 | if err == io.EOF { 41 | break 42 | } 43 | return nil, err 44 | } 45 | 46 | fields := strings.Fields(string(line)) 47 | addrs := strings.Split(fields[0], "-") 48 | 49 | startAddr, _ := strconv.ParseUint(addrs[0], 16, 64) 50 | endAddr, _ := strconv.ParseUint(addrs[1], 16, 64) 51 | perms := fields[1] 52 | 53 | offset, _ := strconv.ParseInt(fields[2], 16, 64) 54 | dev := strings.Split(fields[3], ":") 55 | devMajor, _ := strconv.ParseInt(dev[0], 16, 64) 56 | devMinor, _ := strconv.ParseInt(dev[1], 16, 64) 57 | 58 | inode, _ := strconv.ParseInt(fields[4], 10, 64) 59 | pathname := "" 60 | if len(fields) > 5 { 61 | pathname = fields[5] 62 | } 63 | 64 | segments = append(segments, memorySegment{ 65 | startAddr: uintptr(startAddr), 66 | endAddr: uintptr(endAddr), 67 | perms: perms, 68 | offset: offset, 69 | devMajor: devMajor, 70 | devMinor: devMinor, 71 | inode: inode, 72 | pathname: pathname, 73 | }) 74 | } 75 | 76 | return segments, nil 77 | } 78 | func findDexInMemory(pid int, segments []memorySegment) error { 79 | memPath := fmt.Sprintf("/proc/%d/mem", pid) 80 | memFile, err := os.Open(memPath) 81 | if err != nil { 82 | return err 83 | } 84 | defer memFile.Close() 85 | 86 | dexMagicLength := len(dexMagic) 87 | 88 | for _, s := range segments { 89 | if strings.Contains(s.perms, "r") { 90 | length := s.endAddr - s.startAddr 91 | data := make([]byte, length) 92 | 93 | _, err := memFile.Seek(int64(s.startAddr), 0) 94 | if err != nil { 95 | continue 96 | } 97 | 98 | _, err = memFile.Read(data) 99 | if err != nil { 100 | continue 101 | } 102 | 103 | offset := 0 104 | for offset <= len(data)-dexMagicLength { 105 | if string(data[offset:offset+dexMagicLength]) == dexMagic { 106 | if offset+36+dexMagicLength > len(data) { 107 | break 108 | } 109 | realSize := binary.LittleEndian.Uint32(data[offset+32 : offset+36]) 110 | if offset+int(realSize) > len(data) { 111 | break 112 | } 113 | realSizeData := data[offset : offset+int(realSize)] 114 | 115 | f, err := os.Create(fmt.Sprintf("/data/local/tmp/%d-%x-%d.dex", pid, s.startAddr, offset)) 116 | if err != nil { 117 | offset += dexMagicLength 118 | continue 119 | } 120 | _, err = f.Write(realSizeData) 121 | if err != nil { 122 | f.Close() 123 | offset += dexMagicLength 124 | continue 125 | } 126 | fmt.Printf("Found DEX at segment [%x-%x] and wrote to /data/local/tmp/%d-%x-%d.dex\n", s.startAddr, s.startAddr+uintptr(realSize), pid, s.startAddr, offset) 127 | f.Close() 128 | 129 | offset += int(realSize) 130 | } else { 131 | offset++ 132 | } 133 | } 134 | } 135 | } 136 | return nil 137 | } 138 | 139 | func main() { 140 | if len(os.Args) < 2 { 141 | fmt.Println("Please provide a PID as argument") 142 | os.Exit(1) 143 | } 144 | 145 | pid, err := strconv.Atoi(os.Args[1]) 146 | if err != nil { 147 | fmt.Println("Invalid PID: ", os.Args[1]) 148 | os.Exit(1) 149 | } 150 | segments, _ := parseMapsFile(pid) 151 | findDexInMemory(pid, segments) 152 | } 153 | --------------------------------------------------------------------------------