Saturday, January 26, 2013

string decryption with dex2jar

i have been getting a lot of questions about string decryption lately, so let's talk.

let's say you have an app and notice encrypted strings. strings are an easy way to get a basic idea of what code is doing so naturally you want to decrypt them. but how? there are many different ways to encrypt strings and then decrypt at runtime but in practices there are some assumptions we can make in decreasing order of likelihood.

1. the encryption must be reversible. the strings must be decrypted at run time somehow. this is good but we can assume even more.

2. the process is automated. when Alice wants to release her app she puts the source code through an automated modification process which iterates over every string literal, encrypts it and replaces it with a call to a decryption method with the encrypted string as a parameter.

3. decryption is the same or nearly the same for each string. there is only one decryption method.

4. the type signature of the method is:
static String decryptMethod(String)

while these assumptions hold, it is not very difficult to create a general technique by which we can decrypt all of the strings of an app in place. the real question is do you want to do it at the java or smali level? if you primarily look at decompiled code you can work at the java level. and you're in luck, such a tool already exists in dex2jar:

there is a wiki article about it here: but it is unfinished. you can at least get a visual for what the decompiled code will look like before and after. if you're a good person, you will update the wiki. i leave that as a task for some good reader.

the tool is currently incorrectly spelled as d2j-decrpyt-string.(sh|bat). it takes at least two parameters and sometimes needs three. they are:
  1. method name, -mn : in our case, decryptMethod
  2. method owner, -mo : let's say com.alice.utils
  3. class path, -cp : if decryptMethod makes use of any framework api, you will need to give the path to a framework.jar from the android.sdk
d2j-decrpyt-string -mn decryptMethod -mo com.alice.utils -cp ~/android/sdk/platforms/android-4/framework.jar

doing this at the smali level requires access to a dalvik vm, so in that regard it is trickier, but there are many emulators and you can even use your phone. here's how the process can work:
  • pull out all of the strings and put into a file
  • write some java code, unless you're comfortable with smali, to open the file and iterate over each line and call the decryption method on each string.
  • compile java bytecode and convert to dalvik executable with dx from the android sdk
  • run the code on a dalvik vm


  1. Nice to see a new post :D really interesting, sometimes to decrypt encrypted-strings files I reverse the algorithm and convert it to Java!


    1. well that's certainly the pro way of doing it Nihilus. and i'm still around just busy learning. :D

    2. I'm busy too, these weeks I have 3 University exams. Hope I'll have more time to spend in reversing! Keep up the good work! If you have pro guides or something interesting to share you know the mail! :P


    3. Nihilus i need to talk for the dexgaurd brother,
      here is the email jaspreetsinghplayer@gmail

    4. Great Article android based projects

      Java Training in Chennai

      Project Center in Chennai

      Java Training in Chennai

      projects for cse

      The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

  2. Hi,

    I have bought some app for my kid with amazon app-shop. after buying it I uninstalled Amazon-shop app (don't want to be logged in on kids tablet). So now this app don't want work without amazon-app and log in info. Have tried to decompile this app with apk-tool, but even if I do nothing change and rekompile the app it won't work anymore.

    do you know how to crack amazon checker.

  3. Plz make a tut to crack subway surf to unlimited coins

  4. Articles that are nice and very interesting. I like to read the articles you make...

  5. Nice Article. Thank you for sharing the informative article with us. Morpheus tv apk is the best online Streaming App.Click the below link to know more about
    Morpheus tv apk
    morpheus tv
    morpheus tv apk
    morpheus app
    morpheus tv ios
    morpheus tv on your windows

  6. It is amazing and wonderful to visit your site.Thanks for sharing this information,this is useful to me...

  7. Thank you for taking the time to provide us with your valuable information. We strive to provide our candidates with excellent care


    Telegram > @leadsupplier
    ICQ > 752822040
    Email >

    >>1$ each without DL/ID number
    >>2$ each with DL
    >>5$ each for premium (also included relative info)

    *Will reduce price if buying in bulk
    *Hope for a long term business



    >Fresh Leads for tax returns & w-2 form filling
    >Payment mode BTC, ETH, LTC, PayPal, USDT & PERFECT MONEY


    >SSN+DOB Fullz
    >CC with CVV
    >Photo ID's
    >Dead Fullz
    >Spamming Tutorials
    >Carding Tutorials
    >Hacking Tutorials
    >SMTP Linux Root
    >DUMPS with pins track 1 and 2
    >Sock Tools
    >Server I.P's
    >HQ Emails with passwords

    Email >
    Telegram > @leadsupplier
    ICQ > 752822040


  9. Trade FX At Home On Your PC: roboforex login Is A Forex Trading Company. The Company States That You Can Make On Average 80 – 300 Pips Per Trade. roboforex login States That It Is Simple And Easy To Get Started.

  10. Hey! Looking for an commercial ice maker ? Then this site will help you out finding the best one for you.=""

  11. This comment has been removed by the author.

  12. This comment has been removed by the author.

  13. This comment has been removed by the author.


  14. is the best platform where you can find your dream Best clat coaching in delhi.The website lists 10 best clat coaching institutes in Delhi NCR with their fees, reviews, and faculty details. If you're trying to find an institute to prepare for the clat test, this article will help you.

  15. Discover beautiful and unique African Cocktail Dresses from the Etnica Store. Shop our collection of quality fabrics and intricate details to make your special event memorable.


Do NOT post about or link to specific apps!