I’ve been working on reverse engineering this android x86 ELF binary. According to my research when loadLibrary() is called the function JNI_onLoad is supposed to be executed however this binary doesn’t have it. I guess I’m confused on what loadlibrary() is actually doing. How would I find the first function or entry point to this binary?
loadLibrary(..) loads the native library into the current process. Besides the call to
JNI_onLoad this is just a standard library loading as it is done by
dlopen(..). Note that that as a part of this regular library loading process some code sections in the library may be executed automatically. But that is nothing Java/JNI specific. For more details see this question on Stackoverflow.com.
JNI_onLoad function is AFAIR optional. It's first parameter is a pointer to the
JavaVM structure that allows to interact with the Java virtual VM, e.g. request memory that is recognized by the garbage collector. Or search and instantiate Java classes from within native code.
The more important part of loading a native library into a Android/Java process is that it's exported functions are made available to the Java part. Check the Java classes for methods marked as
native. Such methods don't have a method body, instead when they are called a matching (based on the class an method name) native method is executed.