https://blog.omiilgo.com/tags/jni/ Recent content in Jni on Security Notes Hugo en-us Sat, 04 Jan 2025 10:00:00 +0800 https://blog.omiilgo.com/posts/android-native-library-re-notes/ Sat, 04 Jan 2025 10:00:00 +0800 https://blog.omiilgo.com/posts/android-native-library-re-notes/ One lab APK, one arm64-v8a .so. file/readelf/llvm-objdump through JNI_OnLoad, Java_* exports, GetStringUTFChars, a 32-byte stack copy, tombstone and ASAN. Frida logs length and prefix only. https://blog.omiilgo.com/posts/android-frida-jni-trace-lab/ Mon, 04 Sep 2023 11:00:00 +0800 https://blog.omiilgo.com/posts/android-frida-jni-trace-lab/ Lab APK com.lab.jni.trace. Hook NativeBridge.nInit in Java.perform and the Java_* export with Interceptor.attach, then compare argument length and prefix. Console output redacted. https://blog.omiilgo.com/posts/android-jni-registernatives-lab/ Wed, 09 Jun 2021 14:10:00 +0800 https://blog.omiilgo.com/posts/android-jni-registernatives-lab/ APK where nm -D shows no Java_* exports. Walk JNI_OnLoad, recover the JNINativeMethod table, map Java names to ARM64 IMPs, Frida-trace the native with arguments redacted. https://blog.omiilgo.com/posts/android-jni-onload-name-mangling/ Mon, 02 Dec 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/android-jni-onload-name-mangling/ Self-built APK where javah-style Java_com_lab_onload_Bridge_* exports sit next to a RegisterNatives table. readelf -s, ARM64 JNIEnv GetObjectClass, crash on an unbounded UTF copy.