2026 decompile/reverse-engineering toolchain notes

Bitten-and-learned version numbers for the current Android/bootchain generation.

Android system jars

• Android 16 dex = version 041.
• baksmali cannot open dex 041 — the newest artifact on Maven Central (2.5.2, 2021) predates it; the smali project publishes no newer release jars.
• jadx 1.5.6 works (needs JDK 11+; tested with Temurin 17). powershell $env:JAVA_HOME = '<jdk17>' jadx.bat --single-class com.android.server.oemlock.OemLockService -d out services.jar
• Useful classes for unlock research: com.android.server.oemlock.*, com.android.server.pdb.PersistentDataBlockService.

Boot-chain triage (before touching a disassembler)

1. lz4-decompress every BL tar member (standard lz4 frame magic 04 22 4d 18).
2. Per-file: parse ELF program headers → per-PT_LOAD entropy + printable-string count:
3. entropy ≈ 8.0 + no real strings = encrypted at rest (Samsung's abl/imagefv).
4. entropy ≈ 6-7 + rich strings = plaintext, RE-able.
5. Keyword-scan strings for unlock/rpmb/verify/var/etc.

Stripped AArch64 binaries (no symbols)

• capstone (pip install capstone) linear disasm is enough for targeted work:
• find string→code xrefs via ADRP+ADD pairs and ADRP+LDR literal-pool lookups (careful: ldr's base register is op.mem.base, displacement is op.mem.disp).
• strings often serve as log function-name params — xrefs mark the function itself.
• Flag/global analysis: a gate byte's initial value is a literal byte in the image's data segment — check the file before assuming anything about runtime state.

Ghidra

• Ghidra 12.x requires JDK 25+ (11.x wanted 17-21; the requirement keeps moving). analyzeHeadless.bat refuses older JDKs outright.
• Headless import + auto-analysis of a 3 MB stripped ELF: a few minutes.

JDK inventory (install once, keep all)

All available via winget install EclipseAdoptium.Temurin.<N>.JDK.