Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I work as cybersecurity consultant, and now I am on mission to reverse engineering of mobile app.
I always reverse it using Jadx and dex2jar... the problem that after reverse them I found some native methods with like
system.libraryload("share_c++"), system.libraryload("android-network"), and system.securityloadlibrarry("mainJni")
But I can't find the .so or library files. Can anyone help me, please?
It's hard to say without the sample but it's possible that the native library is written to the filesystem at runtime, e.g. downloaded from somewhere or decrypted from some byte array embedded in the Java code.
One approach would be to monitor all file-system activities e.g. using inotify-tools.
Run it with root permissions, checking recursively for all read/write operations in the app directory. This should allow you to identify which file is created (in case the native library is decoded/decrypted or loaded from an online source) and what files are loaded.
