Agent Skills › P4nda0s/reverse-skills › rev-dex-dumper

rev-dex-dumper

GitHub

通过ADB和panda-dex-dumper从运行中的Android应用内存中提取DEX文件，用于APK解包、去混淆或对抗类加载打包。支持自动检测包名、处理Root权限及清理残留。

skills/rev-dex-dumper/SKILL.md P4nda0s/reverse-skills

Trigger Scenarios

用户想要解包Android APK 需要从内存转储DEX文件提取已解密的DEX文件对抗类加载打包

Install

npx skills add P4nda0s/reverse-skills --skill rev-dex-dumper -g -y

More Options

Use without installing

npx skills use P4nda0s/reverse-skills@rev-dex-dumper

指定 Agent (Claude Code)

npx skills add P4nda0s/reverse-skills --skill rev-dex-dumper -a claude-code -g -y

安装 repo 全部 skill

npx skills add P4nda0s/reverse-skills --all -g -y

预览 repo 内 skill

npx skills add P4nda0s/reverse-skills --list

SKILL.md

Frontmatter

{
    "name": "rev-dex-dumper",
    "description": "Dump DEX files from a running Android app for unpacking\/deobfuscation. Activate when the user wants to unpack an Android APK, dump DEX from memory, extract decrypted DEX files, or defeat class-loading packing."
}

rev-dex-dumper - Android DEX Dumper

Dump DEX files from a running Android application's memory using panda-dex-dumper via ADB.

Tool Location

The panda-dex-dumper binary is bundled in this skill's directory. Resolve its absolute path relative to this SKILL.md file:

skills/rev-dex-dumper/panda-dex-dumper

Workflow

1. Push the tool to device

adb push <path-to>/panda-dex-dumper /data/local/tmp/
adb shell chmod +x /data/local/tmp/panda-dex-dumper

2. Determine target package name

If the user provides a package name, use it directly. Otherwise, get the foreground app:

adb shell dumpsys activity top | grep 'ACTIVITY' | tail -1 | awk '{print $2}' | cut -d/ -f1

3. Run the dumper

adb shell "cd /data/local/tmp && ./panda-dex-dumper -p $(adb shell pidof <package_name>)"

The dumped DEX files are saved to /data/local/tmp/panda/ on the device.

4. Pull DEX files to host

adb pull /data/local/tmp/panda/ ./

Pull to the user's current working directory.

5. Clean up device cache

adb shell rm -rf /data/local/tmp/panda/
adb shell rm /data/local/tmp/panda-dex-dumper

Guidelines

Always verify ADB connection first — run adb devices and confirm a device is listed before proceeding.
Root may be required — panda-dex-dumper uses ptrace to attach to the target process. If the device is not rooted, the dump will fail. Suggest adb root or running via su if needed.
Wait for app to fully load — if the user is dumping a packed app, the real DEX is only available after the packer's class loader has decrypted it. Advise the user to navigate past the splash screen before dumping.
Handle pidof failure — if pidof returns empty, the app may not be running. Launch it first with adb shell monkey -p <package_name> -c android.intent.category.LAUNCHER 1.
Multiple DEX files are normal — packed apps often produce several DEX files. All files in /data/local/tmp/panda/ should be pulled.
Always clean up — remove both the dumped DEX files and the tool binary from the device after pulling results to avoid leaving artifacts.