CheckPointSW/android_unpacker

Stars
355
Rank 119,764 (Top 3 %)
Language
Shell
Created over 7 years ago
Updated over 2 years ago

CheckPointSW/android_unpacker

CheckPointSW

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

A (hopefully) generic unpacker for packed Android apps.

Android Unpacker

A (hopefully) generic unpacker for packed Android apps.

How does it work?

The tool is a patched version of AOSP with some additional scripts. The scripts executes the emulator and installs the APK. Following execution, it dumps the unpacked version of the DEX using different hooks. The result is two files, one of them should be the real dumped version of the DEX file, depending on how the targeted packer works.

Presented in DEF CON 25 (2017) by:

Slava Makkaveev
Avi Bashan

How to build?

Clone the AOSP project using the following instructions. Use the android-6.0.1_r65.
Apply unpacker.patch over <aosp folder>/art using $ git apply (Please note, your cwd should be <aosp dir>/art)
Build the AOSP source using $ lunch full-eng

Usage

Execute the following command

$ ./unpacker.sh <aosp folder> <apk>

The unpacked DEX file will be created in the current working dir.

License

Released under "Apache 2.0" license.

Karta

Karta - source code assisted fast binary matching plugin for IDA

InviZzzible

InviZzzible is a tool for assessment of your virtual environments in an easy and reliable way. It contains the most recent and up to date detection and evasion techniques as well as fixes for them.

Evasions

Evasions encyclopedia gathers methods used by malware to evade detection when run in virtualized environment. Methods are grouped into categories for ease of searching and understanding. Also provided are code samples, signature recommendations and countermeasures within each category for the described techniques.

showstopper

ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.

Scout

Scout - Instruction based research debugger (a poor man's debugger)

Cuckoo-AWS

Extension to Cuckoo Sandbox open source projects, adds support to AWS cloud functionalities and enables running emulation on auto-scaling infrastructure

CloudGuardIaaS

Check Point CloudGuard Network Security repository containing solution templates, Terraform templates, tools and scripts for deploying and configuring CloudGuard Network Security products.

cp_mgmt_api_python_sdk

Check Point API Python Development Kit simplifies the use of the Check Point Management APIs.

cpAnsible

Ansible module provides control over a Check Point Management server using Check Point's web-services APIs.

ExportImportPolicyPackage

Check Point ExportImportPolicyPackage tool enables you to export a policy package from a Management database to a .tar.gz file, which can then be imported into any other Management database. The tool is supported for version R80.10 and above.

QueryOrientedProgramming

Query Oriented Programming (QOP) gadgets for SQLite-based exploitation

Anti-Debug-DB

Anti-Debug encyclopedia contains methods used by malware to verify if they are executed under debugging. It includes the description of various anti-debug tricks, their implementation, and recommendations of how to mitigate the each trick.

SmartMove

Check Point SmartMove tool enables you to convert 3rd party database with firewall security policy and NAT to Check Point database.

CheckPointAnsibleMgmtCollection

This Ansible collection provides control over a Check Point Management server using Check Point's web-services APIs.

Cyber-Research

General purpose repository for miscellaneous scripts, pcaps and malware IOCs that we share with the info-sec research community

MacOS-MalwarePedia

android_appfuzz

ShowPolicyPackage

Check Point ShowPolicyPackage tool shows the content of a policy package (layers, rulebase, objects) over HTML pages.

terraform-provider-checkpoint

Terraform provider for Check Point

reputation-service-api

Leverage the Check Point’s threat intelligence to enrich your SIEM and SOAR solutions and to secure your business applications and websites by using simple RESTful APIs.

PolicyCleanUp

Check Point PolicyCleanUp tool allows automatic cleanup of your policy based on hits count.

smart-console-extensions

An extension can use JavaScript to interact with SmartConsole. The interactions provide access to information, such as the extension location context, and can perform certain basic operations. For example, navigate to a rule. Interactions can return data asynchronously by matching callbacks.

CheckPointAnsibleGAIACollection

An Ansible collection provides control over a Check Point machine using Check Point's web-services APIs.

charts

Deploy Kubernetes Helm Charts for Check Point CloudGuard

ExportObjects

Check Point ExportObjects tool enables you to export specific types of objects from a R80.10 and above Management database to a .csv file, which can then be imported into any other R80.10 and above Management database.

UsefulManagementApiTools

Check Point Useful Management API Tools contain scripts and tools that were used as solutions for customers.

dynobj

flash_instrumentation

Infinity-Next

cpmonitor

CPMonitor is a utility targeted to analyze traffic captured by tcpdump (www.tcpdump.org) / snoop (http://snoopwpf.codeplex.com/).

cp-mgmt-api-csharp-sdk

Check Point API C# Development Kit

terraform-checkpoint-dynobj-nia

Check Point Software Technologies Dynamic Objects module for Network Infrastructure Automation (NIA)

sddc

cp-mgmt-api-go-sdk

Check Point API Go Development Kit simplifies the use of the Check Point Management APIs

terraform-provider-infinity-next

Infinity Next's Terraform Provider for managing CloudGuard AppSec and other Infinity Next security application using Terraform.

ChangedPolicies

Check Point ChangedPolicies tool allows the user to know which policies were affected by changes that were made in the last published session.

teapi

An example of the Threat Prevention API implementation for Java & Python

sourceguard-action

SourceGuard is designed to leverage Check Point's varied prevention technologies and services, providing source-code security and visibility. With a simple, cross-platform CLI tool users can customize exclusions and control an ignore list with easy integration into any pipeline.

chkp_nano_agents

infinity-next-terraform-cli

Utility CLI for the Infinity Next Terraform Provider

cp-mgmt-api-java-sdk

Check Point API Java Development Kit simplifies the usage of the Check Point R80.10 Management APIs.

LocalToGlobal

Check Point LocalToGlobal tool enables you to copy objects from a local domain to the global domain.

cp-mgmt-api-typescript-sdk

Check Point API Typescript Development Kit simplifies the use of the Check Point Management APIs. The kit contains the API library files, and sample files demonstrating the capabilities of the library.

appliance_tpapi

Client side utilities for using Check Point Threat Prevention API calls to an appliance.

harmony-endpoint-management-js-ts-sdk

Check Point's Harmony Endpoint management SDK for JavaScript ecosystem

spectral-github-action

Automated Secrets, Misconfiguration, IaC Misconfiguration detection, and OSS by Check Point CloudGuard

infinitynext-mgmt-api-resources

Resources and example for using Check Point Infinity Next API. For API reference and GraphiQL tool, login into the product and navigate to Support->API Content

Check_Point_App_for_Splunk

sdn

harmony-endpoint-management-py-sdk

Check Point's Harmony Endpoint management SDK for Python ecosystem