2

I work as cybersecurity consultant, and now I am on mission to reverse engineering of mobile app.

I always reverse it using Jadx and dex2jar... the problem that after reverse them I found some native methods with like

system.libraryload("share_c++"), system.libraryload("android-network"), and system.securityloadlibrarry("mainJni")

But I can't find the .so or library files. Can anyone help me, please?

2
  • 2
    Please add more information to your question.
    – tmr232
    Feb 6, 2020 at 15:31
  • 1
    Where are you looking for the native (?) library/libraries?
    – 0xC0000022L
    Nov 11, 2020 at 7:58

2 Answers 2

2

It's hard to say without the sample but it's possible that the native library is written to the filesystem at runtime, e.g. downloaded from somewhere or decrypted from some byte array embedded in the Java code.

2

One approach would be to monitor all file-system activities e.g. using inotify-tools.

Run it with root permissions, checking recursively for all read/write operations in the app directory. This should allow you to identify which file is created (in case the native library is decoded/decrypted or loaded from an online source) and what files are loaded.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.