Finding Hidden JNI Methods: RegisterNatives in a Lab APK
APK where nm -D shows no Java_* exports. Walk JNI_OnLoad, recover the JNINativeMethod table, map Java names to ARM64 IMPs, Frida-trace the native with arguments redacted.
Binary Analysis
Recovering a C++ Vtable From ARM64/x64 Disassembly
Two-class toy hierarchy, virtual dtor plus two methods. objdump/readelf of the compiler vtable, ctor writing the vptr, virtual call through [x0,#16], gdb print of the slot.
ROP vs ret2libc: Classifying `ret` Sites on a Toy Binary
Mental model plus objdump of a toy: ret2libc is whole-function reuse, ROP is fragment reuse. Classify epilogue rets vs pop;ret vs leave;ret. Overflow crash with RIP=0x4141… — no system("/bin/sh") chain.
AArch64 Calling Convention, as Read in IDA
AAPCS64 as it shows up in IDA: x0–x7, x29/x30, 16-byte SP, PACIBSP. Toy function with nine integer args so the ninth is on the stack. objdump of prologue and epilogue.
Reading RELRO, GOT, and PLT on a PIE Lab Binary
Partial vs Full RELRO measured on one toy: readelf FLAGS/GNU_RELRO, objdump of puts@plt, gdb GOT slot before and after bind, /proc maps of .got.plt. Companion to the lazy-binding lab.
ELF GOT/PLT Lazy Binding, Read From a PIE Lab Binary
Lab walkthrough of lazy PLT binding on a PIE: readelf, objdump, GOT slot before/after the first call, Partial vs Full RELRO.
Walking Mach-O Load Commands on a Self-Signed arm64 Lab Binary
Full otool -l walk of a self-signed LabSession: mach_header_64, LC_SEGMENT_64 __TEXT/__DATA, LC_LOAD_DYLIB, LC_CODE_SIGNATURE, LC_ENCRYPTION_INFO_64 cryptid=0. size -x, nm, class-dump, lldb. cryptid=1 stops the lab.
JNI_OnLoad vs Java_* Name Mangling on a Lab APK
Self-built APK where javah-style Java_com_lab_onload_Bridge_* exports sit next to a RegisterNatives table. readelf -s, ARM64 JNIEnv GetObjectClass, crash on an unbounded UTF copy.