Skip to content

Back to the catalog

tiwe0/r0dump
github.comrepo

tiwe0/r0dump

r0dump ports the FART active-invocation dumping technique into the Android 16 / ART runtime, hooking DEX registration, class loading and method dispatch directly inside ART to force packed apps to decrypt their code at runtime. It also captures DEX loaded via InMemoryDexClassLoader, reconstructs shifted ID tables back into standard DEX files, and recomputes Adler-32/SHA-1 checksums, with a companion "R0dump Manager" app (including an ADB-driven MCP bridge) for target selection, repair and ZIP export of dumped samples for inspection in JADX/dexdump. The reference build targets a OnePlus 9 running LineageOS 23.2 with test-keys, and the project ships git-format-patch sets for porting to other Android 16 devices.

TL;DR An ART-native, FART-style active-invocation DEX dumper/unpacker for Android 16, built for a OnePlus 9/LineageOS 23 test build.
Open original ↗
Document

What it is

r0dump's reference release is a flashable image named r0dump-fusion-16, built on LineageOS 23.2 / Android 16 for the OnePlus 9 (lemonade / sm8350), signed with test-keys. The companion app is R0dump Manager.

Preconditions / Affected

  • Only the OnePlus 9 has an official flashable build; other devices require building from the community/ported patch sets.
  • GApps variant requires disabling vbmeta verification when flashing.
  • Target device must already be unlocked and flashed with the matching build before use.

What to do

Operational procedure as stated on the page:

1. Flash matching r0dump-fusion-16 build onto OnePlus 9
2. Open R0dump Manager, select an authorized target app
3. Choose process mode and DUMP strategy (default tuned for gen 1-2 packers)
4. Enable capture, cold-start the target app, wait for task to auto-finish
5. Tap "Repair and export latest artifact"
6. Retrieve ZIP + SHA-256 file from /sdcard/Downloads/r0dump-exports/
7. Inspect with JADX or dexdump

GApps flashing note: --disable-verification is required when writing vbmeta.

Patches are distributed as git format-patch sets, grouped by component: art, frameworks/base, system/sepolicy, packages/apps/R0dumpManager, vendor/lineage. Porting to a new device should start from the project's porting guide rather than the patches alone, since baseline, apply order, and conflict handling are documented there.

To submit a new device port, the page requires: source baseline, patches, build output, real-device verification scope, and a security note — submitted via Issue/PR, with no proprietary binaries, private keys, or user data included.

Caveats

  • The page explicitly states r0dump cannot guarantee recovery of all packer schemes or all dynamically generated code; success depends on when code is decrypted, what ART's observable paths expose, the capture budget, and sample behavior.
  • Community ports are independently published and maintained — baseline, install method, and verification scope are whatever that specific fork's repo states, not this project's.
  • The project explicitly scopes itself to security research/interoperability analysis on software/devices the user owns or is authorized to test; unlocking and test-key builds are stated to reduce device security and risk data loss or bricking.

Technologies named here

  • OnePlus 9
  • R0DUMP
  • LineageOS
  • R0dump Manager
  • FART
  • Android
  • dexdump
  • JADX
  • r0dump-fusion-16
  • ART

Techniques named here

  • ART integrated capture
  • FART-style active invocation
  • In-memory DEX capture
  • DEX reconstruction
  • Asynchronous dump queue with budget/scope/ANR protection

Related in Mobile Security