5
votes
Finding the library an imported function is from in IDA
When I had the same problem (I was working on ELF binaries from Linux and QNX systems) I had to do the following:
run ldd on the executable to get the list of loaded libraries
obtain a list of ...
- 7,955
4
votes
Reverse engineer .so file from android app with radare2
There are several ways to show the different functions of a binary file in radare2.
Start by opening the binary file and analyze it.
$ r2 -A libdbm64.so
Command: afl
The simplest way to list the ...
- 8,689
3
votes
Accepted
Inject code into JNI function (Android shared library)
You can use Frida.
Frida is a dynamic binary instrumentation tool that allows you to intercept, trace, modify, ... of a running application using a JavaScript debugging logic.
For your purpose, you ...
- 5,890
3
votes
Accepted
Breakpoint to debug Android Native Shared Library
Answer to your first question
Googling for gdb step yields https://sourceware.org/gdb/onlinedocs/gdb/Continuing-and-Stepping.html as the first result. From that page:
Warning: If you use the step ...
- 20.5k
2
votes
How to dump Android shared library from memory?
You can use GameGuardian for dump memory. Need root.
Memory editor tab - menu - memory dump - select range and folder - press ok - wait for toast "Dump end".
Here some video examples how to do this:
...
- 121
2
votes
Need help reversing an Android Game
Unity games are scripted in C#. Check the Managed folder in the APK file, patch Assembly-CSharp.dll and enjoy your cheat until you get banned.
- 133
2
votes
Accepted
Load a *.dylib or *.so object into the Javascript V8 runtime?
I was misinterpreting the context of the comment in the original link, it seems. I was under the impression that Module.load was a v8-ism, while it in fact appears to be a Frida-API.
https://frida.re/...
- 183
2
votes
Dynamically linked shared objects
There are two things at work here that might be making it look a bit tricky:
virtual memory - see e.g. articles at Wikipedia for a refresher of the concepts of virtual memory or page table.
address ...
- 121
1
vote
Load to Ida binary with all of SO
I'd suggest running your binary, attach it using IDA debug server, then take memory snapshot.
- 408
1
vote
How do I execute "File -> Add To Program..." in a Ghidra script?
Are they raw files loaded by special mechanisms or typical .so or .dll shared objects? Given the dll tag I am assuming you are concerned about .dll files.
On importing a program for the first time you ...
- 1,261
1
vote
Accepted
anti-debugger techniques for shared library
I don't know whether the advice I'll give you is the "leading edge way", but I will describe some steps that you can perform in order to protect your software.
Is it possible to protect it ...
- 3,209
1
vote
Accepted
JNI_onLoad not presented in .so (Android)
Found somewhat of a solution.
After a lot googling I came to a conclusion that the ELF file was corrupted on purpose. I've found that only 3 fields can be manipulated in order to make an ELF break a ...
- 231
1
vote
How can I debug android native library with ida demo?
IDA demo does not include remote debuggers so you can't debug Android programs with it. You need the full version.
- 35.1k
1
vote
How to dump Android shared library from memory?
Frida is the way to go, you can simply do:
memorydump: function (address, size) {
Memory.protect(ptr(address), size, "rwx");
var a = Memory.readByteArray(ptr(address),size-1000);
...
1
vote
Accepted
how Can I use a linux so file from a program other than the program it was developed for?
an so file is self contained, to use it, you simply need to load it and use functions it implements. However, in order to use those functions a header file describing the functions and their input ...
- 11.4k
1
vote
Finding the library an imported function is from in IDA
Created this plugin recently, you can use https://github.com/0xMirasio/AutoResolv. This is an IDA plugins for resolving imports and show the library origin. You can also refactor code by importing ...
Only top scored, non community-wiki answers of a minimum length are eligible