Is it possible to call function in dynamic link library(.so) generated by Android JNI project?

Question

I unzipped an apk file and got one libxx.so file. I find that there are some "exported"(but I guess the "fun" function is not exported by the original programer) functions in this library by IDA Pro, like this:

Now I can call the "stringFromJNI" function by add this library to my Android project. But is it possible to call the "fun" function? Should I call it by JNI or dlopen(I have tried dlopen but got "undefined symbol:JNI_OnLoad" error)? And how?

Answer 1

Have a look at NativeFunction API of frida. It helps you call any native function. With a little bit of reversing, you'll have something like

 var func = new NativeFunction(Module.findExportByName('libxx.so', 'fun'), 'uint32', []);

Answer 2

After some days struggle, I find out that dynamic analyse through IDA Pro is a good way to deal with this problem.

Answer 3

if you want call it directly from java code, it won't work because jvm does not recognize it. But you can write a proxy so file which would call the fun function.

example

 void *handler= dlopen("libxxx.so", RTLD_LAZY);//open the so
 void *(*fun)(); //the definition of the fun pointer you want to call
 fun = (void *(*)())dlsym(handler,"fun"); // get the dynsym
 fun(); //call it

---

note: need check : handler != NULL && fun != NULL

you can get the dynamic symbol use readelf tool in linux