Totally impressed by the level of this blog post on de-obfuscation of an advanced packer
https://blog.quarkslab.com/dji-the-art-of-obfuscation.html
I hadn't ever seen the trick about "stealing bytecode" from methods from the ART class verification stage.
Follow
@cryptax wow yeah impressive. And app in question isn't malware. it is a well known company using a super complex packer. It seems that APK is not in #GooglePlay either, I wonder if that's related. They do have this DJI Pilot app on #AppStore, any ideas if it has the same kind of packer?
This kind of thing highlights how app review processes must review source code in order to be effective. Binary-only reviews like #Apple and #Google are at a disadvantage.
