Merge pull request #1086 from HackTricks-wiki/research_update_src_mobile-pentesting_android-app-pentesting_reversing-native-libraries_20250710_013259

Add content: Research Update Enhanced src/mobile-pentesting/android-app-p...

Author: carlospolop

src/mobile-pentesting/android-app-pentesting/reversing-native-libraries.md

@@ -5,45 +5,94 @@
 
 **For further information check:** [**https://maddiestone.github.io/AndroidAppRE/reversing_native_libs.html**](https://maddiestone.github.io/AndroidAppRE/reversing_native_libs.html)
 
-Android apps can use native libraries, typically written in C or C++, for performance-critical tasks. Malware creators also use these libraries, as they're harder to reverse engineer than DEX bytecode. The section emphasizes reverse engineering skills tailored to Android, rather than teaching assembly languages. ARM and x86 versions of libraries are provided for compatibility.
-
-### Key Points:
-
-- **Native Libraries in Android Apps:**
-  - Used for performance-intensive tasks.
-  - Written in C or C++, making reverse engineering challenging.
-  - Found in `.so` (shared object) format, similar to Linux binaries.
-  - Malware creators prefer native code to make analysis harder.
-- **Java Native Interface (JNI) & Android NDK:**
-  - JNI allows Java methods to be implemented in native code.
-  - NDK is an Android-specific set of tools to write native code.
-  - JNI and NDK bridge Java (or Kotlin) code with native libraries.
-- **Library Loading & Execution:**
-  - Libraries are loaded into memory using `System.loadLibrary` or `System.load`.
-  - JNI_OnLoad is executed upon library loading.
-  - Java-declared native methods link to native functions, enabling execution.
-- **Linking Java Methods to Native Functions:**
-  - **Dynamic Linking:** Function names in native libraries match a specific pattern, allowing automatic linking.
-  - **Static Linking:** Uses `RegisterNatives` for linking, providing flexibility in function naming and structure.
-- **Reverse Engineering Tools and Techniques:**
-  - Tools like Ghidra and IDA Pro help analyze native libraries.
-  - `JNIEnv` is crucial for understanding JNI functions and interactions.
-  - Exercises are provided to practice loading libraries, linking methods, and identifying native functions.
-
-### Resources:
-
-- **Learning ARM Assembly:**
-  - Suggested for a deeper understanding of the underlying architecture.
-  - [ARM Assembly Basics](https://azeria-labs.com/writing-arm-assembly-part-1/) from Azeria Labs is recommended.
-- **JNI & NDK Documentation:**
-  - [Oracle's JNI Specification](https://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/jniTOC.html)
-  - [Android's JNI Tips](https://developer.android.com/training/articles/perf-jni)
-  - [Getting Started with the NDK](https://developer.android.com/ndk/guides/)
-- **Debugging Native Libraries:**
-  - [Debug Android Native Libraries Using JEB Decompiler](https://medium.com/@shubhamsonani/how-to-debug-android-native-libraries-using-jeb-decompiler-eec681a22cf3)
+Android apps can use native libraries, typically written in C or C++, for performance-critical tasks. Malware creators also abuse these libraries because ELF shared objects are still harder to decompile than DEX/OAT byte-code.  
+This page focuses on *practical* workflows and *recent* tooling improvements (2023-2025) that make reversing Android `.so` files easier.
 
+---
 
-{{#include ../../banners/hacktricks-training.md}}
+### Quick triage-workflow for a freshly pulled `libfoo.so`
+
+1. **Extract the library**
+   ```bash
+   # From an installed application
+   adb shell "run-as <pkg> cat lib/arm64-v8a/libfoo.so" > libfoo.so
+   # Or from the APK (zip)
+   unzip -j target.apk "lib/*/libfoo.so" -d extracted_libs/
+   ```
+2. **Identify architecture & protections**
+   ```bash
+   file libfoo.so        # arm64 or arm32 / x86
+   readelf -h libfoo.so  # OS ABI, PIE, NX, RELRO, etc.
+   checksec --file libfoo.so  # (peda/pwntools)
+   ```
+3. **List exported symbols & JNI bindings**
+   ```bash
+   readelf -s libfoo.so | grep ' Java_'     # dynamic-linked JNI
+   strings libfoo.so   | grep -i "RegisterNatives" -n   # static-registered JNI
+   ```
+4. **Load in a decompiler** (Ghidra ≥ 11.0, IDA Pro, Binary Ninja, Hopper or Cutter/Rizin) and run auto-analysis.  
+   Newer Ghidra versions introduced an AArch64 decompiler that recognises PAC/BTI stubs and MTE tags, greatly improving analysis of libraries built with the Android 14 NDK.
+5. **Decide on static vs dynamic reversing:** stripped, obfuscated code often needs *instrumentation* (Frida, ptrace/gdbserver, LLDB).
+
+---
+
+### Dynamic Instrumentation (Frida ≥ 16)
+
+Frida’s 16-series brought several Android-specific improvements that help when the target uses modern Clang/LLD optimisations:
+
+* `thumb-relocator` can now *hook tiny ARM/Thumb functions* generated by LLD’s aggressive alignment (`--icf=all`).  
+* Enumerating and rebinding *ELF import slots* works on Android, enabling per-module `dlopen()`/`dlsym()` patching when inline hooks are rejected.  
+* Java hooking was fixed for the new **ART quick-entrypoint** used when apps are compiled with `--enable-optimizations` on Android 14.
+
+Example: enumerating all functions registered through `RegisterNatives` and dumping their addresses at runtime:
+```javascript
+Java.perform(function () {
+  var Runtime = Java.use('java.lang.Runtime');
+  var register = Module.findExportByName(null, 'RegisterNatives');
+  Interceptor.attach(register, {
+    onEnter(args) {
+      var envPtr  = args[0];
+      var clazz   = Java.cast(args[1], Java.use('java.lang.Class'));
+      var methods = args[2];
+      var count   = args[3].toInt32();
+      console.log('[+] RegisterNatives on ' + clazz.getName() + ' -> ' + count + ' methods');
+      // iterate & dump (JNI nativeMethod struct: name, sig, fnPtr)
+    }
+  });
+});
+```
+Frida will work out of the box on PAC/BTI-enabled devices (Pixel 8/Android 14+) as long as you use frida-server 16.2 or later – earlier versions failed to locate padding for inline hooks.  citeturn5search2turn5search0
+
+---
+
+### Recent vulnerabilities worth hunting for in APKs
 
+| Year | CVE | Affected library | Notes |
+|------|-----|------------------|-------|
+|2023|CVE-2023-4863|`libwebp` ≤ 1.3.1|Heap buffer overflow reachable from native code that decodes WebP images. Several Android apps bundle vulnerable versions. When you see a `libwebp.so` inside an APK, check its version and attempt exploitation or patching.| citeturn2search0|
+|2024|Multiple|OpenSSL 3.x series|Several memory-safety and padding-oracle issues. Many Flutter & ReactNative bundles ship their own `libcrypto.so`.|
 
+When you spot *third-party* `.so` files inside an APK, always cross-check their hash against upstream advisories. SCA (Software Composition Analysis) is uncommon on mobile, so outdated vulnerable builds are rampant.
 
+---
+
+### Anti-Reversing & Hardening trends (Android 13-15)
+
+* **Pointer Authentication (PAC) & Branch Target Identification (BTI):** Android 14 enables PAC/BTI in system libraries on supported ARMv8.3+ silicon. Decompilers now display PAC‐related pseudo-instructions; for dynamic analysis Frida injects trampolines *after* stripping PAC, but your custom trampolines should call `pacda`/`autibsp` where necessary.
+* **MTE & Scudo hardened allocator:** memory-tagging is opt-in but many Play-Integrity aware apps build with `-fsanitize=memtag`; use `setprop arm64.memtag.dump 1` plus `adb shell am start ...` to capture tag faults.
+* **LLVM Obfuscator (opaque predicates, control-flow flattening):** commercial packers (e.g., Bangcle, SecNeo) increasingly protect *native* code, not only Java; expect bogus control-flow and encrypted string blobs in `.rodata`.
+
+---
+
+### Resources
+
+- **Learning ARM Assembly:** [Azeria Labs – ARM Assembly Basics](https://azeria-labs.com/writing-arm-assembly-part-1/)
+- **JNI & NDK Documentation:** [Oracle JNI Spec](https://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/jniTOC.html) · [Android JNI Tips](https://developer.android.com/training/articles/perf-jni) · [NDK Guides](https://developer.android.com/ndk/guides/)
+- **Debugging Native Libraries:** [Debug Android Native Libraries Using JEB Decompiler](https://medium.com/@shubhamsonani/how-to-debug-android-native-libraries-using-jeb-decompiler-eec681a22cf3)
+
+### References
+
+- Frida 16.x change-log (Android hooking, tiny-function relocation) – [frida.re/news](https://frida.re/news/)  citeturn5search0
+- NVD advisory for `libwebp` overflow CVE-2023-4863 – [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2023-4863) citeturn2search0
+
+{{#include ../../banners/hacktricks-training.md}}