1

I'm debugging an obfuscated android application. I use Android Studio's debugger. I attach it remotely to my physical device via adb. I can set a breakpoint in the app smali code, but when I try to step into a function in an external library, the code browser stays at the caller's place (I expected it to show me the called function's disassebly smali output), but stack trace and the variables output follows the called function as expected. Why is that? Can't java debugger inform Android Studio about the instructions to which the code jumped even though they are in an external library?

Also, I know the app calls some functions com.android.conscrypt. Can I set a breakpoint in an external library like this one? If Android Studio can't do that, what other tools can?

2
  • In the title you mentioned openssl which is a native (non-Java/dex) library. I am not sure if AS is capable of debugging arbitrary native libraries you don't have the source code. Also most native libraries come stripped, so without debugging data which makes debugging difficult. For reverse engineering Android apps that make use of native libraries I would recommend to use frida.re in combination with a good decompiler/disassembler like Ghidra or IDA Pro.
    – Robert
    Sep 15, 2022 at 8:19
  • @Robert, thank you for your recommendation, I'll take at look at it. But I'm asking about java dex libraries in general, can I set a breakpoint in the java library? Openssl is also wrapped by some java library, so I could set a breakpoint there.
    – g00dds
    Sep 15, 2022 at 13:34

1 Answer 1

1

Do you mean JNI / native libraries?

Android app cannot view into native libraries, but you can use frida-trace to get in between the call and return.

readelf -a -W library.so | grep nativeFunctionNameHere

Note the nativeFunctionName with some other words prepended to it

frida-trace -i "_JNIStuffblabla_nativeFunctionNameHere" -F

You will see when it's being called, and you can edit the .js file in the console output to customize/log the function calls However, to find out what the function does, you will need to use disassemblers/debuggers and try to figure it out.

If you only need to inspect OpenSSL library, just intercept like -i "openssl_*" or something, see which function is it that you want, and then log the arguments and/or return value.

If you meant android. libraries, you can again intercept them with frida. It's a really good tool for reverse engineering, especially for Android applications. But why would you need to debug them? They're already publicly available, you should probably focus on the return value, no?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.