0

I unzipped an apk file and got one libxx.so file. I find that there are some "exported"(but I guess the "fun" function is not exported by the original programer) functions in this library by IDA Pro, like this: enter image description here

Now I can call the "stringFromJNI" function by add this library to my Android project. But is it possible to call the "fun" function? Should I call it by JNI or dlopen(I have tried dlopen but got "undefined symbol:JNI_OnLoad" error)? And how?

1

Have a look at NativeFunction API of frida. It helps you call any native function. With a little bit of reversing, you'll have something like

 var func = new NativeFunction(Module.findExportByName('libxx.so', 'fun'), 'uint32', []);
0

After some days struggle, I find out that dynamic analyse through IDA Pro is a good way to deal with this problem.

0

if you want call it directly from java code, it won't work because jvm does not recognize it. But you can write a proxy so file which would call the fun function.

example

 void *handler= dlopen("libxxx.so", RTLD_LAZY);//open the so
 void *(*fun)(); //the definition of the fun pointer you want to call
 fun = (void *(*)())dlsym(handler,"fun"); // get the dynsym
 fun(); //call it

note: need check : handler != NULL && fun != NULL

you can get the dynamic symbol use readelf tool in linux

  • Thanks for your answer. But what should I do in the proxy so file? I try to use dlopen and I can load the so library, but when I want to get the fun function by dlsym, dlerror give me "undefined symbol:JNI_OnLoad" error. – wangzhe Jul 31 '17 at 9:07
  • allmost the same in linux – yufeng Dec 9 '17 at 9:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.