$ show luoyesiqiu/dpt-shell
dpt-shell is a sophisticated Android application protection framework that implements a 'hollow shell' obfuscation technique. It functions as a two-part system: a Java-based CLI processor (dpt) that analyzes and modifies target APK/AAB files, and a native Android shell (shell) that is injected into the target application. The processor extracts method bytecode (CodeItem) from the original Dex files, encrypts them, and replaces the original code with NOP instructions. At runtime, the injected shell hooks Android's class loading mechanisms (DefineClass/LoadClass) using native libraries (Dobby, bhook), decrypts the stored bytecode, and patches the memory of the loaded Dex file to restore the original code before execution. This architecture provides runtime code integrity verification and anti-tampering capabilities. The codebase demonstrates high craftsmanship in both Java and C++. The Java processor utilizes smali/dexlib2 for bytecode manipulation and implements a robust rule-based exclusion system for framework classes. The C++ shell implements low-level memory management, ELF parsing, and dynamic hooking to intercept Android Runtime (ART) operations. It includes anti-debugging, anti-Frida, and signature verification features. The project targets very recent Android SDK versions (36) and build tools (Gradle 8.14), indicating active development and forward-looking compatibility.
The LLM identified 3 files worth highlighting for reuse:
Core utility for Android Dex file manipulation. It implements logic to extract CodeItem structures (method bytecode), split Dex files to handle class limits, and inject reflection-based initialization calls. The `extractAllMethods` function demonstrates non-obvious skill in parsing the Dex binary format directly using the `dx` tool's internal structures, handling multi-dex scenarios, and managing XOR obfuscation keys for the extracted code.
Implements the core runtime protection logic using native C++. It utilizes Dobby and bhook to intercept critical ART functions like `mmap` (to make Dex memory writable) and `DefineClass`/`LoadClass` (to restore bytecode). The code demonstrates advanced C++ skills including ELF section parsing, memory protection (`mprotect`), and safe hooking patterns to avoid crashing the Android Runtime. It also includes anti-debugging and anti-Frida detection routines.
Generates inline XOR decryption bytecode for helper methods. This component demonstrates a reusable pattern for string obfuscation where encrypted strings are decrypted at runtime within the method itself. It constructs a loop that XORs characters with a key, avoiding the need for external decryption libraries and making static analysis harder. The implementation is self-contained and could be extracted for other obfuscation projects.