1

An Android application I'm analyzing makes calls to a native library to generate a certain value. Here's an example of the native library function declaration from SMALI (Decompiled Java):

.method private native createAlgorithmSolver(II)J
.end method

.method private native solveAlgorithm(Ljava/lang/String;IJ)[I
.end method

This makes sense. createAlgorithmSolver accepts two ints, and returns a long. solveAlgorithm accepts a 32 character string such as "SM1r0WeJH6qxdfNua2zg7t8ITwQUZYn5", and it accepts an int, and a long, and returns an int array.

When I decompile the actual ".so" file with IDA Hex-rays decompiler, I get this:

createAlgorithmSolver(int a1, int a2, unsigned int a3, int a4)
solveAlgorithm(int a1, int a2, int a3, unsigned int a4, signed int a5)

When I use "Retargetable Decompiler" (https://retdec.com) with Python pseudo code, I get these function declarations:

def createAlgorithmSolver(a1, a2):
def solveAlgorithm(a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12, a13, a14, a15, a16, a17):

What's causing these weird discrepancies?

3

JNI methods take an extra parameter of type JNIEnv*, which is a pointer to a table of function pointers. This is how JNI methods can make calls into the JVM, which is necessary to do anything nontrivial.

So that accounts for the first int argument of the functions you listed.

Also, the functions are non-static, so they obviously take a hidden this parameter. That accounts for the second argument. After that comes the source level parameters of the methods. In the first case, it's just two ints. In the second case, it's a String object (i.e. a jstring pointer), an int, and a long.

However, the decompiler isn't smart enough to guess what the actual types of the parameters are meant to be - it just sees how many values are passed in registers and on the stack. Therefore, all the pointers show up as ints and the long shows up as a pair of ints.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.