2

I've start reversing some android application. I have a little experience in this subject, but i got stuck on a little matter.

The app i'm trying to reverse uses JNI (java native interface), meaning some of the code is not java - it is assembly.. To my knowing, the native code should be somewhere in the classes.dex file too (together with the dalvik bytecode).

My problem is that the tool i'm using that knows to convert the dex file into a java code (dex2jar) doesn't seem to know how to handle the native code inside the classes.dex file. So my questions are: Is there any tool that knows to do this conversion? If not, does someone have general knowledge about the whereabouts of native code in dex files (if it is there)?

Improve this question

1 Answer 1

Reset to default
2

No, native code isn't in classes.dex. If an android apk file has native code, the apk itself, when unzipping, should have a lib subdirectory, which may have architecture-dependent subdirectories armeabi. armeabi-v7a. x86 and possibly others, and those will contain the native code objects. Sometimes, shared objects may be in other directories as well, especially if they belong to some libraries the application linked in.

For example, i unzipped the apk of one application that i know to have native code:

$ unzip -l net.skoobe.reader-1.apk
[ stuff omitted ]    
     2291  2016-03-14 10:27   NDK_LICENSES
    18549  2016-03-14 10:27   assets/www/error.js
   345568  2016-03-14 10:27   assets/armeabi/lib64libcrittercism-v3.so
   308716  2016-03-14 10:27   assets/armeabi-v7a/lib64libcrittercism-v3.so
   345696  2016-03-14 10:27   assets/arm64-v8a/lib64libcrittercism-v3.so
     5088  2016-03-14 10:25   lib/armeabi/librsjni.so
  2890256  2016-03-14 10:26   lib/armeabi/libskoobe.so
     5088  2016-03-14 10:25   lib/armeabi/libRSSupport.so
  2792064  2016-03-14 10:26   lib/armeabi-v7a/libskoobe.so
  4555592  2016-03-14 10:26   lib/x86/libskoobe.so
    18560  2015-03-26 19:09   lib/armeabi-v7a/librsjni.so
   420320  2015-03-26 19:09   lib/armeabi-v7a/libRSSupport.so
    26636  2015-03-26 19:09   lib/x86/librsjni.so
   518512  2015-03-26 19:09   lib/x86/libRSSupport.so
   159719  2016-03-14 10:27   META-INF/MANIFEST.MF
[ more stuff omitted ]
Improve this answer
1
  • Thank you! it helped :) Is there a special approach to REing JNI code? or treat it like any assembly code?
    – user3848844
    Jul 16, 2016 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.