1

I'm currently learning how native functions are implemented among the ELF SO files contained inside an APK. I'm using IDA.

Native calls are always achieved in this way.

// First load the library 
class myClass{
public myClass(){
  super();
  v0 = system.loadLibrary("library-native"); 
  //then declare the methods 
}
public static native int nativeMethod(byte[] arg0, boolean arg1) ;
}
void a(){
  // then uses it 
  ret = this.nativeMethod(byte,bool) ; 
}

According to my little experiences in JNI, when looking to library-native.so using a disassembler I should see something like Java_package_name_libname_class_NativeMethod among the exported function.

I cannot see any of these elements. When I'm searching the desired function (nativeMethod in the past example) inside the disassembled code, I do not find any clue.

I wonder how Dalvik process manages to call the right function when a native call is performed, and how can I find myself the source code of the desired functions ?

Thanks

EDIT : I add the nm and readelf output to clarify.

nm --defined-only library-native.so 
nm library-native.so : no symbols
readelf -s library-native.so | grep nativeMethod // gives no output
//The only JNI related function 
nm -D --defined-only library-native.so | grep JNI
00XX: JNI_onLoad
2
  • if you run nm on the file, does it list the expected symbols?
    – Igor Skochinsky
    Apr 21, 2017 at 12:49
  • Hey Igor, I add the nm and readelf output. Thanks for pointing this out !
    – deadeert
    Apr 26, 2017 at 13:18

1 Answer 1

2

Well, if the original file does not export the symbols, I can only think of two possibilities:

  1. the methods are registered dynamically at load time.
  2. (most likely) the file is obfuscated/encrypted and is decrypted on load.

In both cases the action probably happens in the JNI_onLoad function. You will need to debug it to see what's going on.

4
  • Could you provide an example (link or quick writing) of method register at load time, I'm not sure to understand what you are talking about and it interest me a lot. Thanks you very much.
    – deadeert
    Apr 26, 2017 at 14:01
  • see RegisterNatives and this example
    – Igor Skochinsky
    Apr 26, 2017 at 14:04
  • 1
    Thanks. Command nm -Du --defined-only native-library.so | grep -i registernative outputs nothing. Same for readelf -s native-library.so | grep -i registernative command. Are you agree with me when I conclude that option 2 you pointed is right in this case ?
    – deadeert
    Apr 26, 2017 at 14:26
  • RegisterNatives is a field (function pointer) in the JNIEnv structure (first argument passed to JNI_onLoad). You won't see the field names in the binary, just numerical offsets.
    – Igor Skochinsky
    Apr 26, 2017 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.