How to revese engineer a self-modyfing binary

Question

I am trying to hack a code in binary .so library. But, when I open .so library with IDA the library has only one function and no strings and there is bad_offset before every address. However, when I open the library in hex editor I can see the name of the functions. I think the program modify itself at runtime but I am not sure.

Here is the code of the function that shows in IDA:

        ADR             R12, 0x1FE8
        ADD             R12, R12, #0x12000
        LDR             PC, [R12,#0xF68]! 

Answer 1

This is not self-modifying code. This snippet just jumps to a pointer loaded from memory (most likely a GOT entry):

    ADR             R12, 0x1FE8           ;R12=0x1FE8  
    ADD             R12, R12, #0x12000    ; R12 +=0x12000->R12=0x13FE8
    LDR             PC, [R12,#0xF68]!     ; PC= *(R12+0xF68)=*(0x14F50)

this is a typical code for a PLT stub entry. You will need to check what is present at that address in the binary and see where it finally jumps.

Answer 2

I don't know about Android so don't know if it applies to your situation, but on some embedded systems where you normally expect to disassemble the code from the flash image, but cannot for similar reasons, it can help to read the RAM as the program is running. Or step through the code in a simulator.