0

I have encrypted Android so library that decrypts itself on load. I want to get its unencrypted code. For me it looks good idea to dump that library from memory when application started.

I used /proc/self/maps to get loaded process memory map. I found 3 segments that correspond to the library in memory maps and used /proc/self/mem to dump these 3 segments to binary files. So, I got 3 binary files: code, writable data and read only data.

Does anyone know how to parse these 3 binary files and assemble them back to so file that Android can run & debug?

2

You can use GameGuardian for dump memory. Need root.

Memory editor tab - menu - memory dump - select range and folder - press ok - wait for toast "Dump end".

Here some video examples how to do this:

But it not enough for build valid ELF (.so) file from dump. It is impossible because some data from ELF used only on load and never stored in memory. And some other data (relocations for example) changed during ELF load.

| improve this answer | |
0

Maybe this helps: https://www.andnixsh.com/2015/11/tutorial-how-to-decrypt-encrypted-dll.html

You can create dump from memory using gcore <path> command and recover any plain files (.dex, .dll, .mp3, etc) using custom GDB for Android. I'm not sure if you can recover decrypted .so file.

Custom GDB only works on ARM-based devices running Android 4.4.4 and below. If you want to get it work for 5.x.x, you need to bypassing PIE security check but there is a risk of bricking your device. https://www.alphagamers.net/threads/guide-bypassing-pie-security-check-android-5-0-up.242363/

| improve this answer | |
0

Frida is the way to go, you can simply do:

memorydump: function (address, size) {
    Memory.protect(ptr(address), size, "rwx");
    var a = Memory.readByteArray(ptr(address),size-1000);
    return a;
}

moduleaddress: function (lib){
  try{

    var ret = [];
    var module = Process.findModuleByName(lib);
    var address = Module.findBaseAddress(lib);
    var sz = module.size;
  
  ret.push({
    "addr": address,
    "size": sz
  });
  return ret;
}
catch(err){
  console.log('[!] Error: '+err);
}

}

If you are not comfortable with Frida you can use a wrapper: https://github.com/Ch0pin/medusa

dumping the memory will be simply as: medusa>memops package_name libname.so

and then just type dump :)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.