2

There is an Android application that has a shared library (.so) file in split_config.arm64_v8a.apk that I want to debug .

When I look at /proc/PID/maps I don't see that library (I do see the split_config.arm64_v8a.apk file), but I'm sure the library is loaded because I see logs that only that library prints. Additionally, the application calls System.loadLibrary("libMyLib.so"); to load that library.

How can I debug this shared library?

5
  • From what I remember .so files are (unless explicitly stated in AndroidManifest.xml) extracted upon installation. I would assume that this is still valid even for apps that comprise of multiple APK files (split APK). So you should better search for libMyLib.so in file-system and when loaded in list of loaded modules. On a rooted device my recommendation would be to use frida.re
    – Robert
    Nov 24 at 15:38
  • @Robert 1) There are 2 AndroidManifest.xml in base in in split_config.arm64_v8a , what should I search there ? 2) The app is installed on a rooted device 3) I use Frida and hook dlopen from libc to print the library that load with dlopen to application , and I didn't see this lib that lodded
    – Polo123
    Nov 24 at 15:56
  • If you see an attribute like extractNativeLibs="false" in the <application tag, the native libraries are directly loaded from within the APK (need to be stored without compression in the APK).
    – Robert
    Nov 24 at 16:30
  • @Robert Yes , I see android:extractNativeLibs="false"
    – Polo123
    Nov 24 at 17:03
  • Then you got your answer. You see split_config.arm64_v8a.apk which is the library loaded without unpacking.
    – Robert
    Nov 24 at 17:05
1

What you see is possible if the APK files uses the mode extractNativeLibs="false". If that attribute is set in the <application tag in AndroidManifest.xml then Android loads the .so files directly from within the APK file without extracting them first.

This works because the .so files are stored without compression and aligned to 4KiB page boundary so that they can be directly mapped into memory via mmap (see also zipalign comments on that topic https://developer.android.com/studio/command-line/zipalign).

5
  • So how can I debug this so please?
    – Polo123
    Nov 24 at 17:11
  • @Polo123 As evrey Andorid app that uses native libraries you can not debug it using Android Studio if you don't have the source code. You can attach gdb to it or much easier use frida.re to hook Java and/or native methods or trace executions (frida-trace).
    – Robert
    Nov 24 at 17:13
  • I have tried frida-trace -D XXXXXXX -f com.MyApp -a "libMyLib.so" and I got an error unable to find module 'libMyLib.so'
    – Polo123
    Nov 24 at 17:42
  • @Polo123 Use Frida to list all loaded modules, e.g. as shown here: github.com/poxyran/misc/blob/master/… For the rest check the extensive Frida API: frida.re/docs/javascript-api There are also a lot tutorials online about Android and native libraries.
    – Robert
    Nov 24 at 18:06
  • Thank you about your help , I run Process.enumerateModules({onMatch: function(module){ if(module.name=="libMyLib.so") {console.log('Module name: ' + module.name + " - " + "Base Address: " + module.base.toString());} }, onComplete: function(){} }); and find out that this lib was loaded after I press some click into the application , and it load to split_config.arm64_v8a.apk memory (in /proc/PID/maps)
    – Polo123
    Nov 24 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.