1

I'm trying to analyze a .so file that is ran on android. Loading the file into IDA I'm unable to spot the JNI_onLoad. So I dumped the .so to memory and I'm still unable to spot the JNI_onLoad.

Looking at the strings window, I could see a string "JNI_onLoad", but it's not referenced anywhere. The library should also contain JNI native methods, but I'm unable to find any.

So my question is, where is JNI_onLoad? Must there be a JNI_onLoad? and how does the calling java class know where to find it's native functions?

Here are the exports that IDA lists:

Name    Address  Ordinal
----    -------  -------
       0008A044        
/linker 0008A064        
       0008B098        
ס      0008AFCC        
       0008A990        
       0008A16C        
r      0008A43C        
       0008A464        
ƒ      0008A4B8        
       0008A784        
       0008A988        
       0008AB24        
       0008AB4C        
      0008AED0        
.      0008AED8        
       0008AEE0        
       0008AF44        
       0008AF7C        
h      0008AF90        
       0008B07C        
       0008C808        
       0008C85C        
       0008C0E8        
       0008B5E4        
}      0008B5EC        
       0008B690        
       0008C2D8        
       0008C0C0        
      0008C12C        
ט      0008C184        
פ      0008C0A4        
½      0008C198        
       0008C1BC        
|       0008C1E0        
       0008C228        
_«     0008C660        
       0008C6B0        
       0008C6CC        
»      0008C6D4        
נ»     0008C6DC        
_»     0008C6E4        
»      0008C6EC        
_      0008C774        
       0008C790        
       0008C7A4        
_      0008C7CC        
ר_     0008C7E0        
       0008CAE8
Improve this question
4
  • Did you try to look into Exports window ? Do you see any reasonable code ?
    – w s
    Oct 29, 2017 at 7:33
  • @ws, nothing, I've never encountered anything like this. /linker would seem interesting but I can't seem to make anything of it. When I load the file IDA says it cannot read file attributes and cannot create segment followed by an error that the binary data 16 is incorrect. Maybe I'm loading the file wrong?
    – NotGI
    Oct 29, 2017 at 21:58
  • I'd say that either you're loading it wrong or there is bug in IDA. What "file" utility says about the .so file ?
    – w s
    Oct 30, 2017 at 8:46
  • @ws, trying to run objdump on .so file says file truncated. However it's being loaded somehow into the application anyway.
    – NotGI
    Oct 30, 2017 at 10:19

1 Answer 1

Reset to default
1

Found somewhat of a solution.
After a lot googling I came to a conclusion that the ELF file was corrupted on purpose.
I've found that only 3 fields can be manipulated in order to make an ELF break a debugger and still be able to run -> (e_shoff, e_shnum, e_shstrndx).

Source: https://dustri.org/b/screwing-elf-header-for-fun-and-profit.html

I downloaded ELF Parser from http://www.elfparser.com/ and loaded the shared object file into it.
Under SHeaders, made note of the smallest section offset and converted into hex, in my case the offset was 2056 or in hex 0x808. I went to the ELF header and made note of my SH Offset which was 703264 or in hex 0xABB20
I opened the file in a hex editor and looked for 0x20 0xBB 0x0A 0x00 and replaced it with 0x08 0x08. That fixed the exports and imports for IDA and i was able to find JNI_onLoad.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.