How to decompile a sequence of bytes from dex file using androgurad (or any other python tool)?

510 views Asked by At

I have a sequence of bytes extracted from dex file, and I want to decompile it using androguard or any other python package

My sequence looks like:

b'\x17\x8a\\\x05{\x00p\x00\x00\x00xV4\x12\x00\x00\x00\x00\x00\x00\x00\x00\x80\x04'
1

There are 1 answers

6
JesusFreke On

It's impossible to decompile or disassemble a random set of bytes from a dex file with no other context or info about the dex file.

For one thing, the tool wouldn't know what part of the dex file the bytes are from. Dex files have a number of different data structures in them, and without knowing what part of which data structure the bytes are from, a tool wouldn't know how to interpret it.

Additionally, the information about a given class or even method is spread out in multiple places in a dex file. As a basic example, let's look at the encoding of a const-string instruction. Taking a look at the same example I posted in my answer to your first question:

0001d8: 1a01 0000          |    const-string v1, "Hello World!"

In this case, 1a is the opcode for "const-string", 01 is the register to store the value in (e.g. v1), and 00 00 is, unsurprisingly, the little-endian encoding for the integer value 0, which is interpreted as an index into the global string pool for the dex file. If the tool doesn't have access to that global string pool, it has no way of knowing what string index 0 refers to.