The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfuscation, it just means someone wrote parts of the app in C.
In some cases, there is existing C code and it's just easier for the programmer to build a JNI interface to call the library from Java; in other cases, the programmer wants the speed advantage that compiled C has over Java. And of course, if I want to hide how some part of my application works, writing that in C and compiling it to a .so makes it much harder to reverse.
If you want to reverse an Android .so, these are the options you have:
- Buy the commercial version of IDA Pro. The demo versions will not do, as they can't disassemble ARM code. This is expensive, but by far the best tool to work with unknown object code.
- If the app includes versions of the .so for different hardware, and if it has a library for Android on x86, you can use the free IDA 5.1 version to disassemble it.
- If you have access to a Linux system, get a gcc toolchain for ARM that includes
objdump
, and use objdump --disassemble
to get a huge text file containing disassembled code. Then, have fun with that text file. There might be gcc toolchains for ARM targets that run on Windows as well, but I never tried.
- You could also upload the .so file to http://onlinedisassembler.com/ to get a disassembled file, if you don't want to install a gcc toolchain.
Beware, though, in all of these cases, you need a thorough understanding of the ARM processor architecture, assembler language, JNI conventions, and compiler ABI to make any sense of the disassembly. Prepare for many long nights if you're inexperienced.