# -*- coding: utf-8 -*- import re import zipfile from pathlib import Path APK = Path(__file__).resolve().parent.parent / "apks" / "maribank_sg_base.apk" with zipfile.ZipFile(str(APK)) as zf: d = b"".join(zf.read(n) for n in zf.namelist() if n.endswith(".dex")) for m in re.finditer(rb"Lcom/[^;]{0,160}CharacterCrypto[^;]{0,40};", d): print(m.group().decode()[1:-1].replace("/", ".")) for m in re.finditer(rb"Lcom/[^;]{0,160}NativeEncrypt[^;]{0,40};", d): print(m.group().decode()[1:-1].replace("/", ".")) # find class with getDfpByMMKV - search all Lcom paths and check if followed by getDfp in same method table is hard # instead search for MMKV + dfp strings proximity idx = d.find(b"getDfpByMMKV:") if idx >= 0: chunk = d[max(0, idx - 500) : idx + 500] for m in re.finditer(rb"Lcom/[^;\x00]{5,200};", chunk): print("near getDfpByMMKV:", m.group().decode()[1:-1].replace("/", "."))