davinci1010/pinduoduo_backdoor resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

5448 stars · 1899 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A security research repository documenting analysis of privilege-escalation code embedded in the Pinduoduo Android APK, including a VMP-packed dex and dynamically downloaded dex payloads. It reproduces the analysis workflow for Parcel serialization/deserialization mismatch exploits that grant system-level StartAnyWhere capability.

Use cases

• analyze android apk for hidden privilege escalation code
• study parcel serialization exploit techniques on android
• unpack vmp-protected dex files from a chinese app
• investigate dynamically downloaded dex payloads in mobile apps
• learn android reverse engineering with a real-world case
• audit mobile apps for privacy-invading behavior

When to choose

• you are researching android privilege escalation or parcel deserialization exploits
• you want a documented real-world case study of app-embedded exploit code
• you need a starting point for unpacking VMP-shelled dex files

When to avoid

• you need a maintained tool or library rather than a static analysis write-up
• you want production-ready or legally cleared code for app auditing
• you need something with a license or active releases

Facets

learning-resource · maturity maintenance

reverse-engineering security vulnerability-scanning osint security reverse-engineering android-tools privacy mobile-development android-apk-analysis privilege-escalation malware-analysis dex-deobfuscation parcel-exploit security-research pinduoduo android mobile

Member repositories

For agents

markdown · JSON · MCP: product_card(name="davinci1010/pinduoduo_backdoor")