I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk modifying is not feasible, and injecting code into the .so file the apk uses would be pretty much the way to go.

So I've been searching for hours for ARM binary instrumenting tools, and I've come across a lot of dynamic instrumenting tools, but not any static ones. What I'm trying to achieve is, injecting code into a codecave or overwrite ARM code into an existing function in a library that resides in /data/data/com.appname/libs/. So when the app is launched, the corresponding library get loaded and the code gets executed. The device is rooted of course so I can modify the library, but the app requires the device to be unrooted when the app is actually running. I can use SuperSU to modify/overwrite existing app libraries, then unroot the device when before launching the app.

If there are any existing tools or blog posts out there, it would be grateful if you could point me to some links. If there's nothing, then I'd probably just use the code in dynamic instrumentation tools and create a small tool to do the task.

Any help would be appreciated.

Thanks! :)

  • I think it can be easier to change your device rooting method to something not detected by the application and use existing dynamic tools.. resources.infosecinstitute.com/… lists some root detection methods and their bypassing.
    – osgx
    Feb 18 '15 at 17:36
  • I searched the web and found another nice article on root detection bypassing. For those interested : blog.netspi.com/bypassing-airwatch-root-restriction Feb 23 '15 at 2:31
  • This is actually very interesting topic for me, both the apk/so injection and the root detetection/bypass methods discussed here. Hopefully i can help the next person out a little( this originsl post is extremely old ) when i share this: I've found that a quicc bypass method for most apps is to just rename the su binary to something other than su. ex: root@device/ # mv /system/bin/su /system/bin/renamed now when you open terminal you no longer type "su" command to switch-user but instead you would type "renamed" to execute the switch-user command. hope this helps someone!! Jan 16 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.