Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
There is an Android application that has a shared library (.so) file in split_config.arm64_v8a.apk that I want to debug .
When I look at /proc/PID/maps I don't see that library (I do see the split_config.arm64_v8a.apk file), but I'm sure the library is loaded because I see logs that only that library prints. Additionally, the application calls System.loadLibrary("libMyLib.so"); to load that library.
How can I debug this shared library?
What you see is possible if the APK files uses the mode extractNativeLibs="false". If that attribute is set in the <application tag in AndroidManifest.xml then Android loads the .so files directly from within the APK file without extracting them first.
This works because the .so files are stored without compression and aligned to 4KiB page boundary so that they can be directly mapped into memory via mmap (see also zipalign comments on that topic https://developer.android.com/studio/command-line/zipalign).
frida-trace -D XXXXXXX -f com.MyApp -a "libMyLib.so" and I got an error unable to find module 'libMyLib.so'
Process.enumerateModules({onMatch: function(module){ if(module.name=="libMyLib.so") {console.log('Module name: ' + module.name + " - " + "Base Address: " + module.base.toString());} }, onComplete: function(){} }); and find out that this lib was loaded after I press some click into the application , and it load to split_config.arm64_v8a.apk memory (in /proc/PID/maps)
libMyLib.soin file-system and when loaded in list of loaded modules. On a rooted device my recommendation would be to use frida.reAndroidManifest.xmlinbasein insplit_config.arm64_v8a, what should I search there ? 2) The app is installed on a rooted device 3) I useFridaand hookdlopenfromlibcto print the library that load withdlopento application , and I didn't see this lib that loddedextractNativeLibs="false"in the<applicationtag, the native libraries are directly loaded from within the APK (need to be stored without compression in the APK).android:extractNativeLibs="false"split_config.arm64_v8a.apkwhich is the library loaded without unpacking.