ARM - Is calling function from external static library possible?

Question

Basically i'm debugging a closed source binary on Android and i want to execute some of my code in between which is large enough not to fit in codecave. So is it possible to compile library with my code separately & then calling it from target binary? If yes then how?

My friend suggested me to modify binary header & extend data segment to inject my code. Is it convenient?

I have another one suggestion. I know interface to that closed source binary, then is it possible to write a wrapper binary? For ex, suppose closed source binary is libfoo.so. Then is it possible to write a binary libbar.so which actually loads libfoo.so & sends function calls to libfoo.so

I'm asking this because i've seen some warez programs bundled with some extra dlls & often some wrapper executable.

Answer 1

"Wrapping" is definitely possible, one of the techniques I normally use for Android reverse engineering is "shimming" the binary. Essentially you write a small application, either Java/Application based or C/Native based. An example of doing this is here;

https://github.com/rednaga/native-shim

This allows you to call any method you would like with slight modifications.

Answer 2

If this library is linked statically, you can not change it without changing the executable. However you can use Frida during debugging session to intercept specific calls, automate this task and run your own code written in (surprise!) JavaScript.

See simple example here for more details.