app脱壳
1、查壳工具 链接: https://pan.baidu.com/s/1F4VdYAbAASTq2MZyGDu_CQ 提取码: ki37
![](https://upload-images.jianshu.io/upload_images/4664072-89db9625b777f9ba.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
2、安装frida
pip3 install frida
pip3 install frida-tools
安装FRIDA-DEXDump
git clone https://github.com/hluwa/FRIDA-DEXDump
cd FRIDA-DEXDump/frida-dexdump
python3 main.py -h
![](https://upload-images.jianshu.io/upload_images/4664072-81f9342cdefc81f9.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
3、adb连接夜神模拟器
模拟器开启usb调试
![](https://upload-images.jianshu.io/upload_images/4664072-58dadb15a5a44896.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
adb devices
adb connect 127.0.0.1:62001(夜神模拟器端口)
adb devices
![](https://upload-images.jianshu.io/upload_images/4664072-56c3032b905e0afb.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
4、安装frida服务端
到 https://github.com/frida/frida/releases 下载相应的版本
rida-server下载需要注意的有两点:
1.安装的frida版本:需要下载与安装的frida版本对应的frida-server,否则会出错。
frida --version
frida-server-15.1.13-android-x86_64.xz (夜神是64位)
frida-server-15.1.13-android-x86.xz(mumu是32位)
![](https://upload-images.jianshu.io/upload_images/4664072-9bc9031b17ec31d9.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
解压缩上面的文件,并且重命名为frida-server,将frida-server 通过adb push指令推送到木木浏览器下的/data/local/tmp目录下,然后开启权限并启动。
shell getprop ro.product.cpu.abi (查看模拟器位数)
adb push frida-server /data/local/tmp/
adb shell "chmod 777 /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server &"
重新打开一个cmd窗口, 执行下面的命令, 查看当前运行的进程. 有输出则说明启动成功
frida-ps -U
![](https://upload-images.jianshu.io/upload_images/4664072-286a01a5a5e31131.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
5、使用frida_dexdump脱壳
模拟器开启需要脱壳的app,执行frida_dexdump脱壳
python3 main.py
![](https://upload-images.jianshu.io/upload_images/4664072-1eeea9fb883ddcf1.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)