Unable to unpack a Qihoo app

[strazzere]

Unable to unpack a Qihoo app

[strazzere]

Nox emulator? Can you provide a link for that?

Can you please also upload the file in question?

[strazzere]

I'd also suggest doing a git pull because it appears you're running some code that is minimally 3 years old per 97ad55d

[kurocygnus]

Sure.
Nox Emulator (It's good for doing this because protectors don't found out that this is a emu): https://www.bignox.com/
Files (both I got the same result): https://drive.google.com/open?id=1PylaWBGA4vTWmOQgvVpVCp9PDtzP3CNq
https://drive.google.com/open?id=1UQ305iRw8DW_Sz6w58Q4BMOGY8R6aeQL

[strazzere]

Ok, so, it does look fairly similar to issue #42 - however I won't close this issue until you can rerun the new code against it.

I do think that this is just, the same packer and will complain due to mprotect usage about i/o issues.

[kurocygnus]

Hey. Tried with the new version.

[] Android Dalvik Unpacker/Unprotector - [email protected]
[+] Hunting for com.brazil.live
[+] 3880 is service pid
[+] 3972 is clone pid
[+] Attempting to detect packer/protector...
[] Nothing special found, hunting for all dex and odex magic bytes...
[] No packer found on clone_pid 3972, falling back to service_pid 3880
[+] Attempting to detect packer/protector...
[] Nothing special found, hunting for all dex and odex magic bytes...
[!] pread seems to have failed : I/O error
[!] Error peeking at memory : I/O error
[!] pread seems to have failed : I/O error
[!] Error peeking at memory : I/O error
[!] pread seems to have failed : I/O error
[!] Error peeking at memory : I/O error
[!] pread seems to have failed : I/O error
[!] Error peeking at memory : I/O error
[!] pread seems to have failed : I/O error
[!] Error peeking at memory : I/O error
[!] pread seems to have failed : I/O error
[!] Error peeking at memory : I/O error
[+] Found 1 potentially interesting memory locations...
[+] Attempting to search inside memory region 0x7f5b3000 to 0x7f63e000
[-] Likely a system file found, ignoring...

[strazzere]

Ok cool, seem to be the same issue as #42 -- it's likely do to mprotect. There are some suggestion in that issue on how to handle this, but for the time being I'm going to close this one since it's a duplicate.