Differences between before, after, and result:

- Before:
When it runs: Before the target method is called.
Purpose: Useful for modifying the values of parameters passed to the target method.
Example use case: If you want to change the parameter values before the method is executed.

- After:
When it runs: After the target method is called.
Purpose: Useful for modifying the return value of the target method while still executing the original method's logic.
Example use case: If you want to alter the result returned by the method after it has completed execution.

Result:
When it runs: Replaces the entire implementation of the target method.
Purpose: Useful for completely overriding the method's logic and directly returning a desired value without executing the original method's code.
Example use case: If you want to ignore the original method's logic and directly return a specific value.

Example:

{
  "com.pinehook.plus.MainActivity": {
    "returnInteger": {
      "returnType": "Integer",
      "after": {
        "result": 200
      }
    }
  }
}

The config above will have the same return value as follows:

{
  "com.pinehook.plus.MainActivity": {
    "returnInteger": {
      "returnType": "Integer",
      "result": 200
    }
  }
}

The difference between the two configs above is that, in the first one, all the code in the method will be executed first and then return 200, while in the second one, it directly replaces the method's implementation to return 200.

Note:
The "returnType" is optional. If you do not add it, it will return a primitive data type (int) or (I) in smali. However, if you specify the type as "Integer," the return type will be (Integer) or (Ljava/lang/Integer;) in smali.

How to Encrypt config.json

1. Open the script folder and place your config.json file there.
2. Run the command python3 enc.py.
3. Copy your configKey and place it in the configKey method inside the Config class (com.pinehook.plus.Config).
4. Change the value of the useEncryptedConfig method to true (0x1).
5. Delete the config.json file from your hook folder, and add the config.enc file to that folder.

Note:
If this is your first time running the script, please install the required libraries first by running the following command inside the script folder:
pip3 install -r requirements.txt

Have you ever wondered if performing dex2c on the hook you created is enough to secure it from others trying to figure out what you’re actually hooking? It turns out that it’s very easy for others to see what you’re hooking, even if you’ve applied dex2c to your hook. In fact, simply checking the logs is often enough, as many people forget to disable logging in their Pine hook. Here’s how to disable it:

// Do we need to print more detailed logs?
PineConfig.debug = false; 
// Is this process debuggable?
PineConfig.debuggable = false;

But is disabling the logs alone enough? Apparently not. In this video, I demonstrate how easy it is for someone to simply replace the original top.canyie.pine folder with a modified version that logs the class, method, and result of the hooked functions.

Of course, the method above still has its limitations. If there’s a control flow that accesses the top.canyie.pine folder, we can’t easily replace it. However, this can still be worked around by hooking the hook method of the Pine class and ensuring that our injected hook runs earlier than the hook we want to observe. In the end, there’s not much we can do here. Perhaps adding additional protections like Jiagu360 could help make it more difficult for someone to uncover the contents of your hook.

Conclusion: Don’t forget to disable Pine’s logging and add various other types of protections. Also, be prepared for the possibility that your hook might still be exposed despite these measures.

Download dex : https://t.me/c/2234891150/81980

Judul: FIXME
Deskripsi: Perbaiki semua kesalahan di kode smalinya sampai aplikasinya bisa dijalankan dengan normal. Nanti bakal ada sebuah flag yang muncul di layar.
Level: Easy - Medium (Tergantung level kalian saat ini)

Hint: Gunakan LogFox atau aplikasi lainnya buat lihat log error dari aplikasinya.
Hint2 (Jangan dibuka kecuali sudah buntu) : https://pastebin.com/tt0YdMBi

Video tutorial untuk menyelesaikan challenge FIXME.

Jika kalian ingin mengerjakan challengenya silahkan klik di sini.

*Jika ada kesalahan informasi yang disampaikan di dalam video ini, tolong beritahu ya, biar kita perbaiki kesalahnnya di sini.

Tutorial Bypassing the New Google Pairip Signature Validation

In the latest version of Google Pairip, a new signature validation has been added to ensure that only apps with a verified signature can run. If you install an unsigned app, it will immediately crash. Here’s a simple trick to bypass it.


@NullRE_Channel

Challenge

Replace the image in the dialog

Level: Easy
Hint: The image is located in the assets folder.

Note: You don’t need to touch the lib to solve it, but feel free to use any technique you like.

Preview of dpt-shell Unpacker (No Root Required)

Just sharing a quick preview of a tool I’m working on, a dpt-shell unpacker that doesn’t require root access.
At the moment, it only supports dpt-shell v2. I’ll be adding support for v1 soon, so stay tuned!

@NullRE_Channel

Hook SharedPreferences with Pinehook

Class<?> SharedPreferences = Class.forName("android.app.SharedPreferencesImpl");
Method getBoolean = SharedPreferences.getDeclaredMethod("getBoolean", String.class, boolean.class);
Pine.hook(getBoolean, new MethodHook() {
    @Override
    public void afterCall(Pine.CallFrame callFrame) throws Throwable {
        super.afterCall(callFrame);
        String key = (String) callFrame.args[0];
        if(key.equals("isPremium")){
            callFrame.setResult(true);
        }
    }
});

ref : Frida Script

@NullRE_Channel
#hook #pine #tutorial

Hi guys, the dpt-shell unpacker is now ready for testing! You can try it out via my Telegram bot (@getDex_bot). Just send your app there.

Note:
This is for testing purposes only. Please use your own app that has been protected with dpt-shell.

The bot will be online for 1 hour only. After that, I will stop it.

How to repack:
1. Change your Application class name and AppComponentFactory in AndroidManifest.xml back to the original values.

2. How to find the original values? Check your assets folder:
- app_name → Application class name
- app_acf → AppComponentFactory

[Optional] Remove unnecessary files:
- assets/app_name
- assets/app_acf
- assets/OoooooOooo
- assets/vwwwwwvwww
- The last dex file (junk code) — be sure to inspect it before deleting


@NullRE_Channel

Tutorial Remove Pairip

Note:
This app already has pairip removed from the dex, but there are still some native libs that contain pairip, which can cause the app to crash. So here, we want to replace those libs with ones that don’t contain pairip.

Before trying this, I recommend downloading an older version of the app and checking its native libs. Sometimes, older versions still use the same libs without pairip and you can replace the current ones with those. You can also check other apps that use the same libs without pairip.

If you can’t find any, you can follow this video to identify which lib is being used, and build a simple app that includes the same dependency to get a clean version of the lib without pairip.

Fortunately, in most cases, the lib that contains pairip is not from the app developer’s own code, but from a third-party dependency, so you can rebuild the lib yourself without pairip.

Tools used in this video:
1. Mt Manager
2. AndroidIDE
3. LogFox


@NullRE_Channel

#tutorial #pairip

🚀 DPT Shell Unpacker is Now Back Online!

Need to unpack apps protected with DPT Shell?
@getDex_bot is ready to serve you. Fast, reliable, and effortless.

Just send your app, no commands needed. The bot will handle everything automatically, from unpacking to delivering the result.

✨ If the unpacked dex (after compression) is under 10MB, the service is completely free.

For files larger than 10MB, a small processing fee applies. Don’t worry — the bot will automatically notify you about payment details once the unpacking is complete.

Ideal for reverse engineers, malware analysts, security researchers, and curious minds alike who want quick, accurate unpacking.

Give it a try with your own apps and compare the unpacked dex with the original to see the difference.

Let @getDex_bot take care of the heavy lifting, so you can focus on your analysis!


@NullRE_Channel

New Update ✨

@getDex_bot now supports unpacking dex files from applications protected with Arm加固. This feature is available for free and without limitations.

Bug Fixes & Improvements:
In the previous version, unpacking dpt-shell could fail if the required file had been renamed using a modified version of dpt-shell. We've added a fallback mechanism to automatically scan the app and locate the correct file, improving compatibility with modified versions.

Currently Supported Protections:
- dpt-shell (standard & some modified versions)
- Arm加固
- (More coming soon...)

Note:
Unpacking for Arm加固 is free and has no limitations.
Unpacking for dpt-shell is free if the dex size after compression is under 10MB.

Try it now, and if you encounter any issues or have feedback, feel free to contact @NullRE.

@getDex_bot
@NullRE_Channel

New Update ✨

@getDex_bot now supports unpacking dex files from applications protected with ApkWall and ApkSecurity, ApkEncryptor.

Supported Protections:
- Dpt-shell
- Arm加固
- ApkWall Protection
- Apk Security Protection
- Apk Encryptor
- (More coming soon...)

You can try it now. For bug reports or feedback, feel free to contact @NullRE.

@NullRE_Channel

New Update ✨

@getDex_bot now supports unpacking/dumping dex files from applications protected with DexProtector App.

Currently, our bot can dump dex files from the following protections:
- DPT-Shell
- Arm加固
- ApkWall Protection
- Apk Security Protection
- Apk Encryptor
- DexProtector App
- (More coming soon...)

Note:
I've just refactored the code, and I haven't had much time to test everything thoroughly.
If you encounter any bugs or have feedback, feel free to contact @NullRE.

@NullRE_Channel

New Update ✨

@getDex_bot now supports unpacking / dumping dex files from applications protected with Crazy Tools and ApkProtector.

Currently, our bot can dump dex files from the following protections:
- DPT-Shell
- Arm加固
- ApkWall Protection
- Apk Security Protection
- Apk Encryptor
- DexProtector App
- Crazy Tools
- ApkProtector
- (More coming soon...)

@NullRE_Channel

New Update ✨

@getDex_bot now supports unpacking/dumping dex files from applications protected with Modder Hub and Guardrail.

Bug Fixes & Improvements:
Fixed an issue with our custom protection scanner that could fail to identify the protection, even though it was already supported.

Currently, our bot can dump DEX files from the following protections:
- DPT-Shell
- Arm加固
- ApkWall Protection
- Apk Security Protection
- Apk Encryptor
- DexProtector App
- Crazy Tools
- ApkProtector
- Modder Hub
- Guardrail
- (More coming soon...)

@NullRE_Channel

Tutorial: how to use mtcr-apply

mtcr-apply is a simple script to apply patches to your APK.
It uses .mtcr files generated by MT Manager.
The idea behind mtcr-apply is inspired by git-apply.

Usage:

java -jar mtcr-apply.jar -i input.apk -p patch.mtcr

To reverse:

Just add the -r flag

@NullRE_Channel