Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 12:43:23 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/mobile-pentesting/android-app-pentesting/reversing-native-libraries.md
CPol 31a2ab586b
GitBook: No commit message
2024-05-05 17:56:05 +00:00

6 KiB
Raw Blame History

Reversing Native Libraries

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

WhiteIntel

WhiteIntel is a dark-web fueled search engine that offers free functionalities to check if a company or its customers have been compromised by stealer malwares.

Their primary goal of WhiteIntel is to combat account takeovers and ransomware attacks resulting from information-stealing malware.

You can check their website and try their engine for free at:

{% embed url="https://whiteintel.io" %}

For further information check: https://maddiestone.github.io/AndroidAppRE/reversing_native_libs.html

Android apps can use native libraries, typically written in C or C++, for performance-critical tasks. Malware creators also use these libraries, as they're harder to reverse engineer than DEX bytecode. The section emphasizes reverse engineering skills tailored to Android, rather than teaching assembly languages. ARM and x86 versions of libraries are provided for compatibility.

Key Points:

  • Native Libraries in Android Apps:
    • Used for performance-intensive tasks.
    • Written in C or C++, making reverse engineering challenging.
    • Found in .so (shared object) format, similar to Linux binaries.
    • Malware creators prefer native code to make analysis harder.
  • Java Native Interface (JNI) & Android NDK:
    • JNI allows Java methods to be implemented in native code.
    • NDK is an Android-specific set of tools to write native code.
    • JNI and NDK bridge Java (or Kotlin) code with native libraries.
  • Library Loading & Execution:
    • Libraries are loaded into memory using System.loadLibrary or System.load.
    • JNI_OnLoad is executed upon library loading.
    • Java-declared native methods link to native functions, enabling execution.
  • Linking Java Methods to Native Functions:
    • Dynamic Linking: Function names in native libraries match a specific pattern, allowing automatic linking.
    • Static Linking: Uses RegisterNatives for linking, providing flexibility in function naming and structure.
  • Reverse Engineering Tools and Techniques:
    • Tools like Ghidra and IDA Pro help analyze native libraries.
    • JNIEnv is crucial for understanding JNI functions and interactions.
    • Exercises are provided to practice loading libraries, linking methods, and identifying native functions.

Resources:

WhiteIntel

WhiteIntel is a dark-web fueled search engine that offers free functionalities to check if a company or its customers have been compromised by stealer malwares.

Their primary goal of WhiteIntel is to combat account takeovers and ransomware attacks resulting from information-stealing malware.

You can check their website and try their engine for free at:

{% embed url="https://whiteintel.io" %}

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: