0

I have encrypted Android so library that decrypts itself on load. I want to get its unencrypted code. For me it looks good idea to dump that library from memory when application started.

I used /proc/self/maps to get loaded process memory map. I found 3 segments that correspond to the library in memory maps and used /proc/self/mem to dump these 3 segments to binary files. So, I got 3 binary files: code, writable data and read only data.

Does anyone know how to parse these 3 binary files and assemble them back to so file that Android can run & debug?

3

You can use GameGuardian for dump memory. Need root.

Memory editor tab - menu - memory dump - select range and folder - press ok - wait for toast "Dump end".

Here some video examples how to do this:

But it not enough for build valid ELF (.so) file from dump. It is impossible because some data from ELF used only on load and never stored in memory. And some other data (relocations for example) changed during ELF load.

0

Maybe this helps: http://www.iandrohacker.net/2015/11/tutorial-how-to-decrypt-encrypted-dll.html

You can create dump from memory using gcore <path> command and recover any plain files (.dex, .dll, .mp3, etc) using custom GDB for Android. I'm not sure if you can recover decrypted .so file.

Custom GDB only works on ARM-based devices running Android 4.4.4 and below. If you want to get it work for 5.x.x, you need to bypassing PIE security check but there is a risk of bricking your device. https://www.alphagamers.net/threads/guide-bypassing-pie-security-check-android-5-0-up.242363/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.