PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Glimpse Into Tencent's Legu Packer

blog.quarkslab.com | research | #android | #reverse-engineering | #tencent | #packer | #dex | #legu
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

An analysis of Tencent Legu, a state-of-the-art Android APK packer: its native libraries, the container format holding NOP-ed DEX files, hashmap, NRV compression and XTEA-based encryption.
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · blog.quarkslab.com
DJI - The ART of obfuscation
A detailed analysis of the modified SecNeo packer protecting DJI Pilot: how DJI hijacks the Android runtime (ART) for bytecode injection, with a Python proof-of-concept (DxFx) for static unpacking.
research · blog.quarkslab.com
Smali the Parseltongue Language
A practical guide to reading and writing Smali, Android's DEX intermediate representation: why analysts patch apps at the Smali level, and how to repackage an APK cleanly.
research · bughunters.google.com
Google's PageBreak Project – Real-World Findings
This post provides a technical deep dive into specific, real-world vulnerabilities discovered by Google's PageBreak scanner
research · blog.trailofbits.com
How safe browsing fails to protect user privacy
An analysis of Safe Browsing showing its k-anonymity is nearly meaningless: browsers reveal 32-bit URL hash prefixes to providers, as Apple did by routing Chinese users' checks to Tencent.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
Back