1

Apologies for a beginner-esque question, but I am reverse engineering an Android application, that is most probably using the libusbhost.so library to interface with USB devices via Java Native Interface.

How would I go about doing so?

2

It is a bit unclear what do you mean by "library being called". If you want to know when the library is loaded, you may look for references to System.loadLibrary(string) or System.load(string) java functions. You might for example hook it using Frida.

If you want to see when particular functions exported by the libusbhost.so are called, you also may use Frida. There is prebuild tool called frida-trace. For example using frida-trace -U -i “Java_*” [package_name], will print out all the calls to JNI native functions from your app, along with their timestamp.

If you want to alter the parameters of the called functions, modify the way they work, or replace their return values - you may find the Frida Interceptor module useful.

4
  • Thank you very much! Apologies for not explaining myself clearly; I meant seeing when a method from a library is called. Frida is a cool looking tool, from what I read about it, this will really help me, I won't doubt! Thank you! Dec 14 '20 at 19:08
  • I suppose I am having a problem. I haven't rooted my phone, therefore, I used the frida-gadget. My problem is, it's always stopping with the error message Failed to start tracing: script is destroyed Server terminated I think it's probably due to me repackaging the app, and then using it. It probably has some problems with that, because it destroys the process immediately (from logcat, what I've seen) Dec 14 '20 at 21:41
  • Unfortunately I've never used the frida-gadget. I've been always using the raw frida server on rooted phone and it works without any problems. This way you don't need to repackage the apk.
    – morsisko
    Dec 14 '20 at 21:45
  • Rooted my phone. frida-server works fine, I need to go on with reverse engineering now :p Jan 1 at 1:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.