Schadenfreude Channel

Here are Some useful tg groups/channels for learning reversing stuff🔥: Radare2: @radare - ontopic @radare_side - offtopic Frida: @fridadotre - ontopic @fridadotre_ot - offtopic dexcalibur/interruptor @dexcalibur r0 crew Global @r0_chat NFG: @nfg_tg Modding tools: @modding_tools - my friends channel @modder_official - my friends group Jasi2169: @jasi2169_support ApkEditor: @ApkEditorPr00 - channel @ApkEditorPr0 - group Cutter [ after r2 this is best instead of IDA Pro I personally use it ] @cutter_re Rizin [ Don't ask about it ] @rizinorg BotX Patcher [ P√0] @botx_patcher Dimension of TDO @TDOhex MT Team IRAN @MT_TEAM_IRAN ApkEditor Brazil @APKEDITORPROBRASIL [ Brazilian (Portuguese)] Simplified Modding @Simplified_Modding Andro ninja Reversing Stuffs @AndroNinja23 Android Tutorial by Masked Modder & Gazex @aidetutorial @aidetutorialdiscussion @gazexmodder Schadenfreude Channel @schdnfrd Sahir Mods @sahilR_mods By Spicey sir OP @androiddecompiler @AndroieReverseDecompiler Modders Community @modders_community Made by - @Qbtaumai

Filename: ASCII Converter_1.2.4.apk Package: com.universapp.asciiconverter Mod Info: Remove Ads https://play.google.com/store/apps/details?id=com.universapp.asciiconverter Lcom/universapp/asciiconverter/MainActivity;->onCreate(Landroid/os/Bundle;)V Insert below code after :cond_253 sget-object v0, Lcom/universapp/asciiconverter/MainActivity;->mPreferences:Landroid/content/SharedPreferences; invoke-interface {v0}, Landroid/content/SharedPreferences;->edit()Landroid/content/SharedPreferences$Editor; move-result-object v0 const-string v1, "remove_ads" const/4 v2, 0x1 invoke-interface {v0, v1, v2}, Landroid/content/SharedPreferences$Editor;->putBoolean(Ljava/lang/String;Z)Landroid/content/SharedPreferences$Editor; move-result-object v0 invoke-interface {v0}, Landroid/content/SharedPreferences$Editor;->apply()V Written by @deletuserbot https://t.me/schdenfreude -=[ Schadenfreude Reversing Group ]=-

ApkProtector Identify by the class path com/mcal/apkprotector Find the entrance from class ProtectApplication and then paste it to AndroidManifest.xml Unpack using BlackDex Merge the packed dex with the output dex from the previous unpack Written by @deletuserbot https://t.me/schdenfreude -=[ Schadenfreude Reversing Group ]=-

Smali Integer Value for View SetVisibility SetVisibility(I): 0 -> Visible 4 -> Invisible 8 -> Gone Written by @deletuserbot https://t.me/schdenfreude -=[ Schadenfreude Reversing Group ]=-

Baidu - No entrance, leave the packed dex - Verify the dex you've got from unpacking - Then repair dex -> Dex version keep the same - Batch rename: classes{1}{S} - Add to the app and then delete the leftover output dex - Add the original dex Files: assets/ f: libsagittarius6_x86 f: nim_keystore2 f: sa_mcc_mnc_mini.json f: sagittarius6-sec.dex f: sagittarius6.md f: sagittarius61.i.dex f: sagittarius61.jar f: sagittarius62.i.dex f: sagittarius62.jar f: sagittarius63.i.dex f: sagittarius63.jar f: sagittarius64.i.dex f: sagittarius64.jar Written by @deletuserbot https://t.me/schdenfreude -=[ Schadenfreude Reversing Group ]=-

Filename: Bubble Translator_3.1.4.apk Package: com.niven.translator Mod Info: Pro+ Life Long https://play.google.com/store/apps/details?id=com.niven.translator Lcom/niven/translate/data/config/LocalConfig;->isPro()Z Lcom/niven/translate/data/config/LocalConfig;->isProPlus()Z After the register: const/4 v0, 0x1 return v0 Lcom/niven/translate/data/vo/BillingStatus;->getProPlusLifeLong()Z .method public final getProPlusLifeLong()Z .registers 2 iget-boolean v0, p0, Lcom/niven/translate/data/vo/BillingStatus;->proPlusLifeLong:Z const/4 v0, 0x1 return v0 .end method Lcom/niven/translate/data/vo/BillingStatus;->setProPlusLifeLong(Z)V .method public final setProPlusLifeLong(Z)V .registers 2 const/4 p1, 0x1 iput-boolean p1, p0, Lcom/niven/translate/data/vo/BillingStatus;->proPlusLifeLong:Z return-void .end method Lcom/niven/translate/data/vo/BillingStatus;-><init>(ZZZZZZ)V [SEARCH] iput-boolean p6, p0, Lcom/niven/translate/data/vo/BillingStatus;->proPlusLifeLong:Z [REPLACE] const/4 p6, 0x1 iput-boolean p6, p0, Lcom/niven/translate/data/vo/BillingStatus;->proPlusLifeLong:Z Written by @deletuserbot https://t.me/schdenfreude -=[ Schadenfreude Reversing Group ]=-

Tencent Royal Security (Net Easy) +++ Example: PureTuber - Easy to unpack - Dump using BlackDex - Class to detect: tencent.StubShell - Remove useless dex, some dex contain class from BlackDex that may be collected during dump process - Remove useless dex, the common dex use for UI Enhance, or builtin library - Remove the analyzed dex fast, by checking the name of dex: cookie_xxx.dex and hook_xxx.dex - Entrance in WrapperProxyApplication.java, static String className - Can replace with ease from AndroidManifest.xml String Pool - Remove Encrypted Dex and Protection Files Files: assets/ 0OO00|111|1| tosversion lib/{arch}/ libshell-super*.so libshella-*.so tencent_stub Written by @deletuserbot https://t.me/schdenfreude -=[ Schadenfreude Reversing Group ]=-

Compare APKs > Decompile the APKs using apktool for all resources | Or using dex2smali for only dex files > Zip/Archive the decompiled project = {prefix}Ori.zip / {prefix}Mod.zip > Compare zip using MT Manager and extract all the modified files from the archive > Compare each of the modified files using "Compare Text" in MT Manager Written by @deletuserbot https://t.me/schdenfreude -=[ Schadenfreude Reversing Group ]=-

### Remove Anti ScreenShot/Screen Recordings Normal Secure(Restrictions in App) > Search(type:smali): 0x2000 > Search(current-results): setflags > Result: (Landroid/view/Window)/Intent > Replace 0x2000 to 0x0 High Secure(Class Extends View/Screenfilter of Video Player) > Search(type:smali): setsecure > Result: SurfaceView/Class Extends View > Class setsecure input parameter0 is boolean type > If parameter (true) then the anti screenshot is enabled > If parameter (false) then the anti screenshot is disabled const/4 p0, 0x0 {v0, p0} setsecure(Z)V Written by @deletuserbot https://t.me/schdenfreude -=[ Schadenfreude Reversing Group ]=-

### Kill Process invoke-static {}, Landroid/os/Process;->myPid()I move-result v0 invoke-static {v0}, Landroid/os/Process;->killProcess(I)V Written by @deletuserbot https://t.me/schdenfreude -=[ Schadenfreude Reversing Group ]=-

Love Encrypt/Ijiami - Dont have any sign check - Ultima VIP Dump Dex - Xpu01 for unpack ijiami - Unpack with Fundex - Reflection Master Unpack Files: d: assets/icon d: assets/ijm_lib d: assets/images f: assets/af.bin f: assets/ijiami.ajm f: assets/signed.bin Place to find original class: s.h.e.l.l/A -> .field private packageName:Ljava/lang/String; Replace: AndroidManifest.xml -> android:appComponentFactory="(.*?)" - Delete class s.h.e.l.l Written by @deletuserbot https://t.me/schdenfreude -=[ Schadenfreude Reversing Group ]=-

r2 cheat sheet: r2 -w libName.so > open lib file in write mode iE > print all functions afl > analyzed func list(same as iE) aaaaaa > analyze whole binary aaa > use it if lib is big instead of aaaaaa aF > analyze func (use it after seeking to a func and also only use it if you didnt type aaa or aaaaaa at the first) s 0xaddress > seek to address wa > seek to an address at first and run this command to edit the line (wa nop) pdf > Print disassembled function pd N > will print first N lines of function pdg > print decompiled func by ghidra pdd > print decompiled function by r2 decompiler izz > print all strings axt @ sym.imp.exit > to find all exit methods axt @@ str.XXXX > for finding data/code references to this address xref to look all strings axt 0xaddress > find data/code references to this address(xref to) axf 0xaddress > find data/code references from this address(xref from) axF str.wtf > Finding references of flags matching 'str.wtf' x > Show xrefs of current func from/to data/code agf > print disassembled function in graph view mode VVV > print disassembled function in graph view mode(press q to exit from graph view) pdf @ 0xaddress > will print disassembled function of that address wa nop @ 0xaddress > Will edit the assembly code of that address radiff2 -x liborg.so libmod.so it will compare 2 libs and show the difference iE > functions.txt it will save all the functions in a txt file izz > strings.txt it will save all the Strings in a txt file pdf > pdf.txt it will save printed disassembled function in a txt file to search an special function name or an special string: izz ~+The String you are looking for iE ~+FuncName to edit an string in the lib(new string length must be equal to original string length) w new string @ 0xaddress #r2_cheat_sheet Written by Reza(@ReZa_R78)

How to mod Flutter app & bypass CRC ❏ Used Files : ◉ Programiz https://bit.ly/3wtHF58 ◉ Termux https://t.me/aidetutorial/448 ◉ Doldrums zip https://t.me/aidetutorial/553 ◉ More info https://github.com/rscloura/Doldrums Tutorial by @ibadifal Support @schdnfrd