1

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer

Though I still cannot understand how JavaObject is passed on? Looking through radare2,

410: sym.Java_com_asobimo_common_jni_NativeResource_getZipedFile (int16_t arg1, int16_t arg3, int16_t arg4);
           ; var int16_t var_0h @ sp+0x0
           ; var int16_t var_ch @ sp+0xc
           ; var int16_t var_14h @ sp+0x14
           ; var int16_t var_18h @ sp+0x18
           ; var int16_t var_1ch @ sp+0x1c
           ; var int16_t var_34h @ sp+0x34
           ; var int16_t var_40h @ sp+0x40
           ; arg int16_t arg1 @ r0
           ; arg int16_t arg3 @ r2
           ; arg int16_t arg4 @ r3
           ; DATA XREF from aav.0x0000c664 @ +0x64
           0x0000c974  ~   f0b5           push {r4, r5, r6, r7, lr}

this is how the static function is called. I feel like the function makes references to passed class objects, since it subtracts 0x44 from sp letter on and then do some stuffs. But, how does this referencing works actually? I am pretty clueless. This is how the Java class looks like which corresponds to it:-

package com.asobimo.common.jni;

public final class NativeResource {
  static {
    System.loadLibrary("NativeResource");
  }

  public static native void deleteFile(String paramString);

  public static native byte[] getFile(String paramString);

  public static native byte[] getZipedFile(String paramString1, String paramString2);

  public static native boolean isZipedNormality(String paramString);

  public static native void saveFile(String paramString, byte[] paramArrayOfbyte, int paramInt);
}

Also, this is not really a necessary thing to answer (and it kinda shifts away from focus of it, I am sorry) but how radare identifies the arguments' size? As it's clear by var int16_t var_40_h @ sp+0x40 being a reference (even though sp is subtracted by 0x40) and the fact that string function were being called using r0 pointer, over r2 and r3, (which makes it more obvious that they probably are int32_t)

And why radare didn't assign r1 to anything? And skipped arg2? It probably also has to do with JavaObject, but I can't really find anything by researching myself. I would really appreciate any help, I badly want that boss battle music hidden behind some encrypted zip files

In case it would help in making some sense, here is the .so file https://files.catbox.moe/foss7s.so

  • I highly recommend you to get in touch with frida, especially with jnitrace, which could help you to understand how and where shared object call jni functions which works with Java objects. Also will be good to read about jni to understand how does it work at all. – Olvin Roght Jan 23 at 16:37
  • @OlvinRoght I will try Frida later, thanks! And I did read Oracle's documentation. It did cleared some doubts I had earlier (or I would say, I just read it previously in hurry) but now I don't get these stuffs – CortexAuth Jan 23 at 17:23
  • I have no much time to explain with details, but main idea is next: 1) native function receive pointer to Java String (I'll proceed with getZipedFile from post); 2) to get string bytes in native code used GetStringChars which returns pointer to simple char array; 3) function do smth and then it uses NewByteArray to create Java array and return it. Maybe I'll post an answer later. – Olvin Roght Jan 23 at 19:07
  • @OlvinRoght Yeap! but it also does some stuffs with some values in stack, which probably came from the Java program. but I have no idea what those values could be That's kinda necessary to figure out because it could be part of how the zip files are encrypted – CortexAuth Jan 23 at 20:07
  • sub sp, #0x48 is allocation of 0x48 bytes for local variables. Procedure Call Standard for the ARM architecture. – Olvin Roght Jan 23 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.