NDK .so Session: readelf, llvm-objdump -d, JNI_OnLoad
One lab APK, one arm64-v8a .so. file/readelf/llvm-objdump through JNI_OnLoad, Java_* exports, GetStringUTFChars, a 32-byte stack copy, tombstone and ASAN. Frida logs length and prefix only.
Jni
Frida: Java Wrapper vs JNI Interceptor on the Same Call
Lab APK com.lab.jni.trace. Hook NativeBridge.nInit in Java.perform and the Java_* export with Interceptor.attach, then compare argument length and prefix. Console output redacted.
Finding Hidden JNI Methods: RegisterNatives in a Lab APK
APK where nm -D shows no Java_* exports. Walk JNI_OnLoad, recover the JNINativeMethod table, map Java names to ARM64 IMPs, Frida-trace the native with arguments redacted.
JNI_OnLoad vs Java_* Name Mangling on a Lab APK
Self-built APK where javah-style Java_com_lab_onload_Bridge_* exports sit next to a RegisterNatives table. readelf -s, ARM64 JNIEnv GetObjectClass, crash on an unbounded UTF copy.