From c8724e0ad6773233632cb17571ce22056e4874a8 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Sat, 24 Oct 2026 06:03:52 +0000 Subject: [PATCH 1/2] Add content from: YuanKong RAT: The Android Remote-Control Service That Stamps... --- .../android-app-pentesting/manual-deobfuscation.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/mobile-pentesting/android-app-pentesting/manual-deobfuscation.md b/src/mobile-pentesting/android-app-pentesting/manual-deobfuscation.md index 548425745b8..22b5ddf7410 100644 --- a/src/mobile-pentesting/android-app-pentesting/manual-deobfuscation.md +++ b/src/mobile-pentesting/android-app-pentesting/manual-deobfuscation.md @@ -162,6 +162,8 @@ unzip -t stage2.bin apksigner verify --verbose --print-certs stage2.bin ``` +A simpler packer may put a JSON manifest beside the opaque asset with its Base64 key, asset name, expected hash, and ZIP member path. In the documented `SVLT` v2 variant, the asset starts with four magic bytes, one version byte, one IV-length byte, the IV, then ciphertext; each plaintext byte is `cipher[i] ^ key[i % keylen] ^ iv[i % ivlen]`. Check the version and nonempty IV, compare the header IV with the manifest, and validate that the result is a ZIP. Hash the **extracted child APK**, not the surrounding ZIP, against the manifest's `original_hash`, then inspect the child signer separately from the loader signer. All of this can be done offline when the key and payload are bundled together.[[14]](#references) + #### Reconstruct DPT-Shell method bodies DPT-Shell hollows DEX method implementations and reconstructs them at runtime.[[10]](#references) Strong fingerprints are a small `ProxyApplication`/`JniBridge` stub, `assets/OoooooOooo`, and a native loader below `assets/vwwwwwvwww/` for each ABI.[[10]](#references)[[11]](#references) Repair deceptive DEX table offsets **before** resolving method indexes; otherwise valid code-store records will be mapped to the wrong methods.[[11]](#references) @@ -267,4 +269,5 @@ After decrypting a staged container: - [11] [78 Victims, One Lazy Key, and a Firebase Named After India’s Ruling Party](https://medium.com/@singhbkn07/78-victims-one-lazy-key-and-a-firebase-named-after-indias-ruling-party-62cf0ad0380e) - [12] [Unpacking the Unpackable: Malformed APKs as an Anti-Analysis Technique](https://www.cleafy.com/cleafy-labs/malformed-apks-as-an-anti-analysis-technique-malfixer-tool) - [13] [MalFixer: Inspecting and recovering malformed Android APK files](https://github.com/Cleafy/Malfixer) +- [14] [YuanKong RAT: The Android Remote-Control Service That Stamps Operator Names into Every Build](https://starlabs.sg/blog/2026/10-yuankong-rat-the-android-remote-control-service-that-stamps-its-operators-names-into-every-build) {{#include ../../banners/hacktricks-training.md}} From 56042a74021353df15abbac56b5abdf48698fc23 Mon Sep 17 00:00:00 2001 From: SirBroccoli Date: Sat, 24 Oct 2026 08:16:22 +0200 Subject: [PATCH 2/2] docs: repair PR placement and formatting after editorial review --- .../android-app-pentesting/manual-deobfuscation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mobile-pentesting/android-app-pentesting/manual-deobfuscation.md b/src/mobile-pentesting/android-app-pentesting/manual-deobfuscation.md index 22b5ddf7410..d7ec81fc20d 100644 --- a/src/mobile-pentesting/android-app-pentesting/manual-deobfuscation.md +++ b/src/mobile-pentesting/android-app-pentesting/manual-deobfuscation.md @@ -162,7 +162,7 @@ unzip -t stage2.bin apksigner verify --verbose --print-certs stage2.bin ``` -A simpler packer may put a JSON manifest beside the opaque asset with its Base64 key, asset name, expected hash, and ZIP member path. In the documented `SVLT` v2 variant, the asset starts with four magic bytes, one version byte, one IV-length byte, the IV, then ciphertext; each plaintext byte is `cipher[i] ^ key[i % keylen] ^ iv[i % ivlen]`. Check the version and nonempty IV, compare the header IV with the manifest, and validate that the result is a ZIP. Hash the **extracted child APK**, not the surrounding ZIP, against the manifest's `original_hash`, then inspect the child signer separately from the loader signer. All of this can be done offline when the key and payload are bundled together.[[14]](#references) +Before reversing a loader, check whether an adjacent asset manifest already names the opaque blob and supplies its key, IV, expected hash, and payload path. When the blob also carries an IV in its header, compare it with the manifest before decoding offline. If the plaintext is a ZIP containing the child APK, compare the manifest hash with the **extracted APK**, not the ZIP wrapper, and inspect the child's signer separately from the loader's.[[14]](#references) #### Reconstruct DPT-Shell method bodies