Más contenido relacionado


Debugging Android Native Library

  1. @0ninaik & @ps_doom NETSQUARE Debugging Android Native Library Omkar Naik & Palak Sethia Venue: AMA, Ahmedabad
  2. @0ninaik & @ps_doom NETSQUARE Introduction and Agenda ● What is native library? ● JNI ● Analysis ● Static debugging ● Dynamic debugging ● How to efficiently debug? ● Task ● Requirements ● Demo Time! 2
  3. @0ninaik & @ps_doom NETSQUARE Native Library in android ● C/C++ Code ● Native Development Kit (NDK) ○ compiles the native code into native library ● Features ○ Performance ○ Security 3
  4. @0ninaik & @ps_doom NETSQUARE Android Application NDK SDK Java/Kotlin C/C++ JNI 4
  5. @0ninaik & @ps_doom NETSQUARE Java Native Interface JNI C/C++ functions/Code Java Classes/ Dalvik Code JAVA/Kotli n Native libraries 5
  6. @0ninaik & @ps_doom NETSQUARE Analysis ● Where to look for? ● Supported architectures ● Identification static { System.loadLibrary("lib"); } OR static { System.load("lib/arm64-v8a/"); } 6
  7. @0ninaik & @ps_doom NETSQUARE Static debugging ● Code is not executed ● Understand the code logic using graphs, decompilation etc ● Cannot read variable values 7
  8. @0ninaik & @ps_doom NETSQUARE #Dynamic #Debugging 8
  9. @0ninaik & @ps_doom NETSQUARE ● Execute code and try ● Check specific parts of code ● Runtime analysis of code flow and values ● Different tools used for runtime analysis ○ #IDA/Ghidra ○ #Frida Dynamic Debugging Cont. 9
  10. @0ninaik & @ps_doom NETSQUARE How to efficiently debug? ● Identify the interesting code in static analysis ● Understand code logic with specific inputs and conditions while execution ● Execute functions which are hard to understand ● Set breakpoints and analyze variables values. 10
  11. @0ninaik & @ps_doom NETSQUARE TASK ● hpAndro Vulnerable Application ○ Backdoor 7 Task ● Identify Pin to get the flag 11
  12. @0ninaik & @ps_doom NETSQUARE Requirements ● IDA Pro ● Rooted android device 12
  13. @0ninaik & @ps_doom NETSQUARE ● Task ● Apktool decompile ● Locate .so file for task ● .so file load in IDA ● Start IDA dbgsrv in android ● Decompile the function after identification ● Set debug points ● Start the task DEMO TIME ! 13
  14. @0ninaik & @ps_doom NETSQUARE 14 Thank you

Notas del editor

  1. Why not android studio
  2. NDK or Native Development Kit is a toolset that is provided by Android to use C or C++ code in our Android application. code is compiled to a binary code and run directly on OS, while Java code is translated into Java byte-code and interpreted by Dalvik Virtual Machine (VM) ?????
  3. It also allows native code to call Java methods and manipulate Java objects. Bridge between the Java Virtual Machine (JVM) and the native operating system and libraries. JNI allows Java developers to access features and functionality that are not available in the standard Java libraries. Mention native code language C and C++ Interaction between Java and native code. Functionality that are not available in the standard Java libraries. Access to device-specific functionality: JNI allows developers to access device-specific functionality such as camera, sensors, and Bluetooth, which may not be available through the standard Java SDK. Improved performance: JNI allows developers to take advantage of C/C++ code for performance-critical tasks such as image processing, video decoding, and audio processing.
  4. If code readable can understand application logic Hardcoded string search