Skip to content
Scripts to unpack APK protected by Legu
Python CMake C++
Branch: master
Clone or download
Latest commit 7b4aec6 Nov 26, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
imgs Add content Nov 26, 2019
pylegu Add content Nov 26, 2019
samples Add content Nov 26, 2019 Add content Nov 26, 2019
legu_hashmap.ksy Add content Nov 26, 2019 Add content Nov 26, 2019
legu_packed_file.ksy Add content Nov 26, 2019 Add content Nov 26, 2019 Add content Nov 26, 2019

Legu Unpacker

Scripts to unpack Android applications protected by Tencent Legu. It only works with versions and of Legu.


The original DEX files are located in assets/0OO00l111l1l with the following layout:

One can find the details of this structure in the Kaitai file: legu_packed_file.ks

The hashmap embedded in the second part is described in the legu_hashmap.ks file:


pylegu contains the Python bindings to decrypt and uncompress the data embedded in assets/0OO00l111l1l.

To compile and install pylegu:

$ cd pylegu
$ python3.7 ./ build -j4 install --user
$ python -c "import pylegu"

One could also use jap/pyucl to decompress the data and aguinet/dragonffi to bind the custom implementation of XTEA.

Get Started

The sample com.intotherain.voicechange.apk is a suspicious application that can be unpacked as follows:

$ python ./ ./samples/com.intotherain.voicechange.apk

[+] Legu version:
[+] Password is 'IPk2Hw7AKTuIQBlc'
[+] Number of dex files: 1
[+] Unpacking #1 DEX files ...
[+] dex 0 compressed size:   0x1619a3
[+] dex 0 uncompressed size: 0x5671f8

[+] Unpacking #1 hashmap ...
[+] hashmap 0 compressed size:   0x4399c
[+] hashmap 0 uncompressed size: 0x95558

[+] Unpacking #1 packed methods ...
[+] packed methods 0 compressed_size:   0xf4636
[+] packed methods 0 uncompressed_size: 0x1e3072

[+] Stage 2: Patching DEX files
[+] Unpacked APK: unpacked.apk

The unpacked DEX files are located in the unpacked.apk file.


  • Python >= 3.7
  • Kaitai Struct
  • LIEF
  • pylegu
You can’t perform that action at this time.