NDK .so Session: readelf, llvm-objdump -d, JNI_OnLoad
One lab APK, one arm64-v8a .so. file/readelf/llvm-objdump through JNI_OnLoad, Java_* exports, GetStringUTFChars, a 32-byte stack copy, tombstone and ASAN. Frida logs length and prefix only.
Android
Android Kernel LPE Classes, at Invariant Level, Plus a Userspace TOCTOU Lab
Futex, perf_event, and get_user-era Android kernel LPE classes as broken invariants. No kernel exploit code. A toy C file-TOCTOU analog, a planted strcpy, ASAN output.
AIDL Lab Service: Parcel Layout and Native onTransact
Self-built AIDL service com.lab.binder. dumpsys and logcat Binder, Parcel bytes for writeInterfaceToken + int + string, ARM64 BnEcho::onTransact. No privilege escalation.
Frida: Java Wrapper vs JNI Interceptor on the Same Call
Lab APK com.lab.jni.trace. Hook NativeBridge.nInit in Java.perform and the Java_* export with Interceptor.attach, then compare argument length and prefix. Console output redacted.
apktool Smali: if-eqz Chains That Want to Be a switch
Lab APK with packed-looking if-eqz obfuscation around a 5-way dispatch. apktool smali, jadx Java, reconstruct a packed-switch, plus a planted stack copy crash. Not a commercial packer unpack.
Finding Hidden JNI Methods: RegisterNatives in a Lab APK
APK where nm -D shows no Java_* exports. Walk JNI_OnLoad, recover the JNINativeMethod table, map Java names to ARM64 IMPs, Frida-trace the native with arguments redacted.
JNI_OnLoad vs Java_* Name Mangling on a Lab APK
Self-built APK where javah-style Java_com_lab_onload_Bridge_* exports sit next to a RegisterNatives table. readelf -s, ARM64 JNIEnv GetObjectClass, crash on an unbounded UTF copy.