Search the Community

GDA, a new Dalvik bytecode decompiler, is implemented in C++, which has the advantages of faster execution and lower memory&disk consumption and an stronger ability to decompiling the APK, DEX, ODEX, OAT files(supports JAR, CLASS and AAR files since 3.79). GDA is completely self-independent and works without Java VM and installation, so it works well in any newly installed windows system and virtual machine system without additional configuration. GDA Decompiler project started in 2013 and its first version 1.0 released in 2015 at GDA website. GDA is also a powerful and fast reverse analysis platform. Which does not only supports the basic decompiling operation, but also many excellent functions like Malicious behavior detection, Privacy leaking detection, Vulnerability detection, Path solving, Packer identification, Variable tracking analysis, Deobfuscation, Python& Java scripts, Device memory extraction, Data decryption and encryption etc. All the excellent features as follows: 𝕬 Interactive operation: 1. Cross-references for strings, classes, methods and fields; 2. Searching for strings, classes methods and fields; 3. Comments for java code; 4. Rename methods,fields and classes; 5. Save the analysis results in gda db file. ... 𝕭 Utilities for Assisted Analysis: 1. Extracting DEX from ODEX; 2. Extracting DEX from OAT; 3. XML Decoder (Component filter); 4. Algorithm tool(Support rolling encryption and almost all popular encryption algorithms); 5. Device memory dump(Dump so, odex, dex, oat file); 6. Path solving; 7. Static vulnerability scanner; ... 𝕮 New features: 1. Brand new dalvik decompiler in c++ with friendly GUI; 2. Support python script and Java script; 3. Packers Recognition; 4. Multi-DEX supporting; 5. Making and loading signature of the method; 6. Malicious Behavior Scanning by API chains; 7. Taint analysis to preview the behavior of variables; 8. Taint analysis to source the variables; 9. De-obfuscate; 10. API view with x-ref; 11. Association of permissions with modules; 12. Extract all the urls in APK. 13. Apk Forensics Analysis. 14. Static vulnerability scanner based on stack state machine and dynamic rule interpreter.. 15. Smart Rename. 16. Support for .jar files, .class files and .aar files. 17. Dual decompiler mode. 18. Deep URL extraction. 19. Multi-DEX Merge. 20. Personalized and Customizable UI. 21. Privacy leaking scanning. 22. Path solving based on low-level intermediate representation(LIR). [Hidden Content] [Hidden Content]

GDA(GJoy Dex Analysizer) Most reverse engineers mainly use Java decompiler, commercial dalvik decompiler Jeb and smali2java to analyze Android APPs. Java decompiler is based on Java bytecode, including JD, JD-GUI, jadx, and others. smali2java is a decompiler based on Smali code. They have their own shortcomings, such as Java decompiler depends on convert of dex2jar. For complex, obfuscated or packed apks, there are problem of translation failure. smali2java decompiles Smali code which should be translated from DEX with apktool, so it increases the difficulty and error rate, and decreases the speed of manual analysis. In addition, their interaction is poor, which increases the difficulty of manual analysis. Although the commercial Jeb has better interactivity, it is easy to death when analyzing large-sized APP with the Multidex, and it is very expensive for me… Here, a new decompiler based on Dalvik bytecode, GDA（this project started in 2013 and released its first version 1.0 in 2015 at www.gda.com: 9090) , is proposed and implemented in C++ language to provide more sophisticated, fast and convenient decompilation support. GDA is completely self-independent. It supports APK, DEX, ODEX, oat files, and run without installation and Java VM support. GDA only takes up 2M of your disk space, and you can use it in any newly installed windows system and virtual machine system. In addition, GDA has more features as follows: Interactive operation: 1.cross-references for strings, classes, methods and fields; 2.searching for strings, classes methods and fields; 3.comments for java code; 4.rename for methods,fields and classes; 5.save the analysis results in gda db file. ... Utilities for Assisted Analysis: 1.extracting DEX from ODEX; 2.extracting DEX from OAT; 3.XML Decoder; 4.algorithm tool; 5.device memory dump; ... New features: 1.Brand new dalvik decompiler in c++ with friendly GUI; 2.Support python script 3.packers Recognition; 4.Multi-DEX supporting; 5.making and loading signature of the method 6.Malicious Behavior Scanning by API chains; 7.taint analysis to preview the behavior of variables; 8.taint analysis to trace the path of variables; 9.de-obfuscate; 10.API view with x-ref; 11.Association of permissions with modules; bug fixes and updates Fix some bugs. Optimize the search algorithm The redesigned structured algorithm makes the code more readable. A faster and better cyclic structure algorithm is proposed, and switch, if-else, and try-catch are optimized in some degrees. The color of the super method is canceled. [HIDE][Hidden Content]]

GDA (GJoy Dex Analysizer) GDA is a new decompiler written entirely in c++, so it does not rely on the Java platform, which is succinct, portable and fast, and supports APK, DEX, ODEX, oat. Most reverse engineers mainly use Java decompiler, commercial dalvik decompiler Jeb and smali2java to analyze Android APPs. Java decompiler is based on Java bytecode, including JD, JD-GUI, jadx, and others. smali2java is a decompiler based on Smali code. They have their own shortcomings, such as Java decompiler depends on convert of dex2jar. For complex, obfuscated or packed apks, there are problem of translation failure. smali2java decompiles Smali code which should be translated from DEX with apktool, so it increases the difficulty and error rate, and decreases the speed of manual analysis. In addition, their interaction is poor, which increases the difficulty of manual analysis. Although the commercial Jeb has better interactivity, it is easy to death when analyzing large-sized APP with the Multidex, and it is very expensive... Here, a new decompiler based on Dalvik bytecode, GDA, is proposed and implemented in C++ language to provide more sophisticated, fast and convenient decompilation support. GDA is completely self-independent. It supports APK, DEX, ODEX, oat files, and run without installation and Java VM support. GDA only takes up 2M of your disk space, and you can use it in any newly installed windows system and virtual machine system. In addition, GDA has more features as follows: Interactive operation: 1.cross-references for strings, classes, methods and fields; 2.searching for strings, classes methods and fields; 3.comments for java code; 4.rename for methods,fields and classes; 5.save the analysis results in gda db file. ... Practical Tools for Assisted Analysis: 1.extracting DEX from ODEX; 2.extracting DEX from OAT; 3.XML Decoder; 4.algorithm tool; 5.device memory dump; ... New features: 1.Brand new dalvik decompiler in c++ with friendly GUI; 2.Support python script 3.packers Recognition; 4.Multi-DEX supporting; 5.making and loading signature of the method 6.Malicious Behavior Scanning by API chains; 7.taint analysis to preview the behavior of variables; 8.taint analysis to trace the path of variables; 9.de-obfuscate; 10.API view with x-ref; 11.Association of permissions with modules; ... Demo : More info && Download [Hidden Content]