Inject code into JNI function (Android shared library)

Question

An android app loads a native library (.so) using System.loadLibrary. It then calls a specific function, which takes 3 input variables, and returns a string containing a MD5 hash.

You can see the relevant part of the function below:

I want to be able to see the original, "unhashed" message (which is of course derived from the 3 input variables), instead of it's md5 hash. Is this possible in any way?

Answer 1

You can use Frida.

Frida is a dynamic binary instrumentation tool that allows you to intercept, trace, modify, ... of a running application using a JavaScript debugging logic.

For your purpose, you need to hook the MD5_Update function using the Interceptor API.

The JavaScript code may look like the following. [Warning: Untested]

// Use the mangled form of name MD5_Update below
Interceptor.attach(Module.findExportByName("mylib.so", "MD5_Update"), {
    onEnter: function (args) 
    {
        var ptr_data = args[1];
        var length = args[2];    

        var data = Memory.readByteArray(ptr_data, length);
        console.log(data);
    }
});

Further reference:

• https://11x256.github.io/
• https://www.notsosecure.com/instrumenting-native-android-functions-using-frida/
• https://enovella.github.io/android/reverse/2017/05/20/android-owasp-crackmes-level-3.html