An android app loads a native library (.so) using System.loadLibrary. It then calls a specific function, which takes 3 input variables, and returns a string containing a MD5 hash.

You can see the relevant part of the function below:

enter image description here

I want to be able to see the original, "unhashed" message (which is of course derived from the 3 input variables), instead of it's md5 hash. Is this possible in any way?

  • 2
    You can use Frida to hook the MD5_Update function.
    – 0xec
    Nov 25, 2017 at 7:11
  • @0xec this worked perfectly. Please post an answer so I can accept it.
    – user22348
    Nov 25, 2017 at 12:14
  • @0xes I'm trying to reverse engineer hash generation in an Android app. I suppose Frida is the right tool for this too? I was able to hook to the app. But there are some things I'm a bit confused about. How would I find out which function is doing it? After I have the function name, how would I get the contents of the function?
    – Arya
    Dec 27, 2017 at 6:05
  • Any news about this? I am trying to do samething. Jun 5, 2019 at 23:21
  • @BerkayYıldız there already is an accepted answer
    – user22348
    Jun 6, 2019 at 19:02

1 Answer 1


You can use Frida.

Frida is a dynamic binary instrumentation tool that allows you to intercept, trace, modify, ... of a running application using a JavaScript debugging logic.

For your purpose, you need to hook the MD5_Update function using the Interceptor API.

The JavaScript code may look like the following. [Warning: Untested]

// Use the mangled form of name MD5_Update below
Interceptor.attach(Module.findExportByName("mylib.so", "MD5_Update"), {
    onEnter: function (args) 
        var ptr_data = args[1];
        var length = args[2];    

        var data = Memory.readByteArray(ptr_data, length);

Further reference:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.