
A memory dumper for Android reverse engineering that extracts DEX files from running apps using panda-dex-dumper over ADB. Built for unpacking obfuscated or encrypted apps where the real bytecode only exists in memory after the loader decrypts it. The workflow is straightforward: push the binary, attach to the target process via ptrace, pull the dumped DEX files back to your machine. You'll need root access since it attaches to processes, and timing matters because you need to dump after the packer has loaded the real classes. Handles the full lifecycle including cleanup, which is nice because most dumping tools leave artifacts all over /data/local/tmp.
$ npx -y skills add p4nda0s/reverse-skills --skill rev-dex-dumper --agent claude-codeInstalls into .claude/skills of the current project.
Dump DEX files from a running Android application's memory using panda-dex-dumper via ADB.
The panda-dex-dumper binary is bundled in this skill's directory. Resolve its absolute path relative to this SKILL.md file:
skills/rev-dex-dumper/panda-dex-dumper
adb push <path-to>/panda-dex-dumper /data/local/tmp/
adb shell chmod +x /data/local/tmp/panda-dex-dumper
If the user provides a package name, use it directly. Otherwise, get the foreground app:
adb shell dumpsys activity top | grep 'ACTIVITY' | tail -1 | awk '{print $2}' | cut -d/ -f1
adb shell "cd /data/local/tmp && ./panda-dex-dumper -p $(adb shell pidof <package_name>)"
The dumped DEX files are saved to /data/local/tmp/panda/ on the device.
adb pull /data/local/tmp/panda/ ./
Pull to the user's current working directory.
adb shell rm -rf /data/local/tmp/panda/
adb shell rm /data/local/tmp/panda-dex-dumper
Sponsors