1

I Work as cybersecurity consultant and now i'am in mission to reverse engineering of mobile app. I always reverse it using Jadx and dex2jar ... the problem that after reverse them i found some native methodes with like (system.libraryload("share_c++") system.libraryload("android-network") and they have system.securityloadlibrarry("mainJni")) but i can't found the .so or library files anyone can help me please

  • Please add more information to your question. – tmr232 Feb 6 at 15:31
0

It's hard to say without the sample but it's possible that the native library is written to the filesystem at runtime, e.g. downloaded from somewhere or decrypted from some byte array embedded in the Java code.

|improve this answer|||||
0

One approach would be to monitor all file-system activities e.g. using inotify-tools.

Run it with root permissions, checking recursively for all read/write operations in the app directory. This should allow you to identify which file is created (in case the native library is decoded/decrypted or loaded from an online source) and what files are loaded.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.