reso7200/molt-dex

** 앱의 피부가 읽었으며 언젠가 무엇인지 읽었습니다. **

역설계, modding 및 Android 앱 평가를 위한 단계, 증거 우선 기술, 일반 APK에서 크게 obfuscated 것들. 내장 apktool, adb 및 scrcpy, 런타임 DexKit 및 Xposed API를 통해 해결 및 후킹.

---

그것이 무엇인지

molt-DEX는 Claude 기술입니다. "here is an APK"에서 안드로이드 응용 프로그램을 사용하는 파이프라인은 “그들은 어떻게 내장되어 있는지, 어떻게 행동과 약점이 있는 곳.”

그것은 진짜 일, 반전 기술설계에서 증류되고 큰, obfuscated app를 modding (Instagram) 많은 버전. 버전이 끝난 후 생존 된 기술은 한 가지입니다. 여기에 구워.

• ** 전체 obfuscation 스펙트럼. ** 일반 앱, R8/ProGuard 이름 obfuscation, 문자열 암호화, 반사, 포장, 네이티브 스텁, 그리고 안티 스탬퍼, 그것을 감지하는 방법과 방법을 각각 그것을 통해.
• apktool, 아니 JADX. 그것은 apktool-decoded smali 및 자원에 대한 이유, 둥근 지구 (축구 및 재설치 가능). Java decompile는 선택적 편의이며 소스가 없습니다. 진실의. -**Static는, 장치를 확인합니다.

---

What it is

molt-DEX is a Claude skill: a packaged pipeline that takes an Android app from “here is an APK” to “here is how it is built, how it behaves, and where its weaknesses are.”

It was distilled from real work, reverse-engineering and modding a large, obfuscated app (Instagram) across many versions. The techniques that survived version after version are the ones baked in here.

• Full obfuscation spectrum. Plain apps, R8/ProGuard name obfuscation, string encryption, reflection, packing, native stubs, and anti-tamper, each with a way to detect it and a way through it.
• apktool, not JADX. It reasons over apktool-decoded smali and resources, which round-trip (you can rebuild and reinstall). A Java decompile is an optional convenience, never the source of truth.
• Static to understand, device to confirm. Read the code to form a hypothesis, then prove or kill it on a real device with adb and scrcpy. Every claim cites evidence: a smali method, a string-table hit, a logcat line, a screenshot.

Why it holds up: resolve by shape, not by name

This is the whole idea. In an obfuscated app you almost never have the real name of a class or method, and whatever name it has changes on the next release. So you never anchor on names. You anchor on things that stay put:

• literal strings a method uses (log lines, error text, QPL tags),
• JSON / wire keys it parses,
• method shape (parameter types, return type, static vs instance, arity),
• class relationships (superclass, implemented interface, callers and callees),
• resource names.

Find the member by that description, statically (a string index over the decoded tree) and at runtime (a DexKit query inside the live app). When the app updates and the method moves, you re-run the same description and find it again. This is why a module built this way keeps working when Instagram ships a new build, and it is the backbone of every stage below.

Authorization: what the work touches