1

・I am debugging an apk file.

・The address I want to stop at BreakPoint is in the native library(.so) (no function name).

・The native library has a "JNI_OnLoad" function, so I set BreakPoint. 　After starting the apk with "adb shell am start -a ・・・", I connected with IDA Pro RemoteDebugger. 　Then I connected with "jdb -connect com.sun.jdi.SocketAttach...".

・However, even though I keep pressing F9, the native library(.so) I want to analyze does not appear. 　It crashes after going back and forth between libc.so and linker.

・When I run "memory module list" using objection, the native library(.so) I want to analyze appears.

How can I solve this problem?

Improve this question
2
  • Have you checked function in init_array section? Maybe there are some anti-debug measures before JNI_ONLOAD was executed such as a infinity loop?
    – re100io
    Commented Aug 30, 2023 at 16:25
  • Thanks for the answer. I had not checked the init_array because there were over 400 functions in it. I knew you are taking countermeasures. If you have a better way to identify where the countermeasures are being taken, I'd be glad to know.
    – momonga
    Commented Aug 31, 2023 at 1:25

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.