Author: admin

Introduction: The Native Underbelly of Android Apps

Modern Android applications frequently leverage native libraries (written in C/C++ and compiled into .so files) to achieve performance gains, implement complex algorithms, or, more commonly, hide critical logic and secrets from casual reverse engineering attempts. The Java Native Interface (JNI) serves as the bridge between Java/Kotlin code and these native libraries. Among the most pivotal functions in JNI is JNI_OnLoad, a special entry point that executes early in a native library’s lifecycle. Understanding and hooking JNI_OnLoad with Frida is a powerful technique for Android penetration testers and reverse engineers to uncover hidden native functionality, bypass anti-tampering mechanisms, and gain deep insights into an application’s core logic.

This deep dive will guide you through the intricacies of JNI_OnLoad, explain its significance, and provide practical, expert-level Frida scripts to intercept its execution and even unravel the functions registered via RegisterNatives.

Prerequisites

• Basic understanding of Android application structure and JNI.
• Familiarity with C/C++ programming.
• Working knowledge of Frida (installation, basic usage).
• A rooted Android device or emulator with Frida-server running.
• ADB (Android Debug Bridge) installed and configured.

Understanding JNI_OnLoad: The Native Initializer

What is JNI_OnLoad?

JNI_OnLoad is an optional, but widely used, function that resides within a native shared library (.so file). It’s the first function called by the Java Virtual Machine (JVM) when a native library is loaded into memory via System.loadLibrary(). Its primary purpose is to perform any necessary initialization tasks for the native library, such as:

• Setting up global data structures.
• Registering native methods with the JVM using env->RegisterNatives().
• Performing anti-tampering checks or obfuscation routines.
• Storing references to the JavaVM* and JNIEnv* pointers for later use.

The function prototype for JNI_OnLoad is:

JNIEXPORT jint JNICALL JNI_OnLoad(JavaVM* vm, void* reserved) {  // Initialization code  return JNI_VERSION_1_X;}

Why is JNI_OnLoad a Prime Target?

Because it’s executed very early and implicitly by the JVM, JNI_OnLoad is a critical control point. Attackers and reverse engineers can leverage its early execution to:

• Discover native methods: By hooking RegisterNatives calls within JNI_OnLoad, you can programmatically extract the names, signatures, and addresses of all native functions the library exposes to Java.
• Bypass anti-tampering: Many anti-tampering or anti-debugging checks are performed during native library initialization. Intercepting JNI_OnLoad allows you to observe or even alter these checks.
• Uncover hidden logic: Often, sensitive decryption keys or critical algorithmic steps are initialized or set up in JNI_OnLoad.

Frida Fundamentals for Native Hooking

Frida provides powerful APIs for interacting with native code. Key components include:

• Module.findExportByName(moduleName, exportName): Locates the address of an exported function.
• Interceptor.attach(address, callbacks): Hooks a function at a specific memory address, allowing you to execute code before (onEnter) and after (onLeave) the original function.
• NativePointer: Represents a pointer to a memory address, allowing arithmetic operations.
• Memory.readCString(address) / Memory.readByteArray(address, size): Read data from memory.

Step-by-Step: Hooking JNI_OnLoad

1. Identify the Target Library

First, you need to know which native library contains the JNI_OnLoad you want to hook. You can often infer this from the application’s Java code (e.g., System.loadLibrary("my_native_lib")) or by examining the lib/ directory within the APK. For this example, let’s assume our target library is libnative-lib.so.

2. Frida Script for JNI_OnLoad

Here’s a basic Frida script to hook JNI_OnLoad. We’ll find the module, then locate and attach to the JNI_OnLoad export.

Java.perform(function() {  var libraryName = "libnative-lib.so";  var JNI_OnLoad_ptr = Module.findExportByName(libraryName, "JNI_OnLoad");  if (JNI_OnLoad_ptr) {    console.log("[+] Found JNI_OnLoad at: " + JNI_OnLoad_ptr);    Interceptor.attach(JNI_OnLoad_ptr, {      onEnter: function(args) {        console.log("[*] JNI_OnLoad called for " + libraryName);        this.javaVm = args[0]; // JavaVM*        this.reserved = args[1]; // void*        console.log("    JavaVM*: " + this.javaVm);        console.log("    Reserved*: " + this.reserved);      },      onLeave: function(retval) {        console.log("[*] JNI_OnLoad returned: " + retval);      }    });  } else {    console.log("[-] JNI_OnLoad not found in " + libraryName);  }});

3. Running the Script

Attach Frida to your target application’s process:

frida -U -f com.your.package.name -l hook_jni_onload.js --no-pause

Replace com.your.package.name with the actual package name and hook_jni_onload.js with your script’s filename. The --no-pause flag ensures the app starts immediately.

Advanced Techniques: Intercepting RegisterNatives

Many important native functions are not exported but are instead registered dynamically using JNIEnv->RegisterNatives() within JNI_OnLoad. To uncover these, we need to hook RegisterNatives itself. This is more complex as JNIEnv is a pointer to a struct of function pointers.

Hooking RegisterNatives

Java.perform(function() {  var libraryName = "libnative-lib.so";  var JNI_OnLoad_ptr = Module.findExportByName(libraryName, "JNI_OnLoad");  if (JNI_OnLoad_ptr) {    console.log("[+] Found JNI_OnLoad at: " + JNI_OnLoad_ptr);    Interceptor.attach(JNI_OnLoad_ptr, {      onEnter: function(args) {        console.log("[*] JNI_OnLoad called for " + libraryName);        this.env = Memory.readPointer(this.context.x0.add(0)); // Get JNIEnv* from JavaVM* for 64-bit ARM, often args[0] for JNIEnv directly.        // For JNI_OnLoad, args[0] is JavaVM*, args[1] is void* reserved.        // To get JNIEnv* from JavaVM*, you'd typically call GetEnv.        // However, in the context of `JNI_OnLoad`, a JNIEnv* is provided via `*env` in `JNI_OnLoad`'s return context, or derived from `JavaVM*` if needed.        // Let's assume for simplicity we can get JNIEnv* from somewhere or hook `GetEnv` later.        // For direct `RegisterNatives` hooking, we need the `JNIEnv*` from `onEnter` of a function that receives it.        // This example focuses on 'how to hook' RegisterNatives, not 'how to get JNIEnv* reliably in JNI_OnLoad'.        // More reliably, if you hook a native function that directly takes JNIEnv*, you can get it there.      },      onLeave: function(retval) {        // console.log("[*] JNI_OnLoad returned: " + retval);      }    });  } else {    console.log("[-] JNI_OnLoad not found in " + libraryName);  }  // Hook RegisterNatives  // The JNIEnv structure varies by architecture and JNI version.  // On ARM64 (AArch64), the JNIEnv* is typically passed in x0.  // JNIEnv is a pointer to a pointer to a table of function pointers.  // The offset for RegisterNatives typically needs to be determined by looking at the JNI header files or reversing.  // For Android JNI, it's often 216 bytes (0xD8) for 64-bit and 84 bytes (0x54) for 32-bit.  var RegisterNatives_offset;  if (Process.arch === 'arm64') {    RegisterNatives_offset = 0xD8; // Offset for RegisterNatives on 64-bit ARM  } else if (Process.arch === 'arm') {    RegisterNatives_offset = 0x54; // Offset for RegisterNatives on 32-bit ARM  } else {    console.log("[-] Unsupported architecture: " + Process.arch);    return;  }  var libart = Process.findModuleByName("libart.so");  if (libart) {    var env_ptr = Memory.alloc(Process.pointerSize);    var fn_getEnv = libart.findExportByName("_ZN3art9JavaVMExt6GetEnvEPPvj") || libart.findExportByName("_ZN3art9JavaVMExt6GetEnvEPPj"); // Adjust based on your Android version & symbols.    // If we have a JavaVM* from JNI_OnLoad, we could call GetEnv to get a valid JNIEnv* for hooking.    // For simplicity, let's just find the global JNIEnv functions.    // A more robust way is to hook a function that takes JNIEnv* and then retrieve the address.    // Let's assume we can get a JNIEnv* to extract function table base for demonstration.    // A simpler approach for RegisterNatives is to hook from a function that actually passes JNIEnv* as first arg.    // For now, let's hook it directly from its expected offset in the JNIEnv* table.    // We can't directly use 'JNI_OnLoad' arguments to hook RegisterNatives reliably without `GetEnv`    // Let's use `Java.vm.getEnv().handle` which gives us a `JNIEnv*` to inspect the table.    // This is for inspecting, not for live hooking `RegisterNatives` as it's called.    // A better way is to attach to a native method which receives JNIEnv as argument 1 (x0/r0)    // And then hook RegisterNatives in its onEnter.    var current_jni_env = Java.vm.getEnv().handle;    var RegisterNatives_ptr = Memory.readPointer(current_jni_env.add(RegisterNatives_offset));    console.log("[+] RegisterNatives function pointer: " + RegisterNatives_ptr);    if (RegisterNatives_ptr.isNull()) {      console.log("[-] RegisterNatives pointer is null, unable to hook.");      return;    }    Interceptor.attach(RegisterNatives_ptr, {      onEnter: function(args) {        this.env = args[0];        this.javaClass = args[1];        this.methods = args[2]; // JNINativeMethod*        this.numMethods = args[3].toInt32();        console.log("n[!] RegisterNatives called!");        console.log("    Java Class: " + Java.vm.tryGetEnv().getClassName(this.javaClass));        console.log("    Number of methods: " + this.numMethods);        for (var i = 0; i < this.numMethods; i++) {          var methodPtr = this.methods.add(i * Process.pointerSize * 3);          var namePtr = Memory.readPointer(methodPtr);          var signaturePtr = Memory.readPointer(methodPtr.add(Process.pointerSize));          var fnPtr = Memory.readPointer(methodPtr.add(Process.pointerSize * 2));          var methodName = Memory.readCString(namePtr);          var methodSignature = Memory.readCString(signaturePtr);          console.log("      Method " + (i + 1) + ":");          console.log("        Name: " + methodName);          console.log("        Signature: " + methodSignature);          console.log("        Native function pointer: " + fnPtr);          // Optionally, you can hook each native function here!          // Interceptor.attach(fnPtr, { ... });        }      },      onLeave: function(retval) {        // console.log("[!] RegisterNatives returned: " + retval);      }    });  } else {    console.log("[-] libart.so not found, cannot reliably hook RegisterNatives.");  }});

Important Note on `RegisterNatives` Hooking: The most reliable way to hook RegisterNatives dynamically is to attach to a specific native method that you *know* will be called, and within its onEnter callback, use the JNIEnv* passed as args[0] to calculate and hook the RegisterNatives offset from that specific JNIEnv* instance. The example above demonstrates finding the offset and attaching, but the JNIEnv* from Java.vm.getEnv().handle is a global instance, not necessarily the one used during JNI_OnLoad calls, though the function table pointers should be the same across valid JNIEnv* instances for a given VM.

Case Study: Simple Native Library

Let’s imagine a simple native library:

#include <jni.h>#include <string.h>#include <stdio.h>JNIEXPORT jstring JNICALL Java_com_example_app_NativeLib_stringFromJNI(JNIEnv* env, jobject thiz) {    return (*env)->NewStringUTF(env, "Hello from C++!");}JNIEXPORT jint JNICALL native_add(JNIEnv* env, jobject thiz, jint a, jint b) {    return a + b;}static JNINativeMethod methods[] = {    {"add", "(II)I", (void*)native_add}};JNIEXPORT jint JNI_OnLoad(JavaVM* vm, void* reserved) {    JNIEnv* env;    if ((*vm)->GetEnv(vm, (void**)&env, JNI_VERSION_1_6) != JNI_OK) {        return -1;    }    jclass clazz = (*env)->FindClass(env, "com/example/app/NativeLib");    if (clazz == NULL) {        return -1;    }    (*env)->RegisterNatives(env, clazz, methods, sizeof(methods) / sizeof(methods[0]));    return JNI_VERSION_1_6;}

When you run the Frida script to hook JNI_OnLoad and RegisterNatives against an app using this library, your console output will reveal:

• `JNI_OnLoad` being called.
• The `RegisterNatives` hook firing.
• The `Java Class: com/example/app/NativeLib`.
• The method `Name: add`, `Signature: (II)I`, and its `Native function pointer`.

This allows you to then precisely hook `native_add` if you wish, gaining full control over its inputs and outputs.

Benefits and Use Cases

• Dynamic Method Discovery: Uncover all native methods dynamically registered, regardless of obfuscation or export visibility.
• Anti-Tampering Bypass: Observe and potentially subvert integrity checks or root detection mechanisms initialized within JNI_OnLoad.
• Key Extraction: Identify where cryptographic keys or sensitive data are initialized or transformed in native code.
• Behavioral Analysis: Understand the flow and dependencies of native components.

Conclusion

Hooking JNI_OnLoad and subsequently RegisterNatives with Frida is an indispensable technique for Android app penetration testers. It provides a crucial window into the native realm of an application, revealing hidden entry points and critical logic that might otherwise be invisible to static analysis. By mastering these advanced Frida capabilities, you can significantly enhance your ability to reverse engineer, analyze, and secure Android applications.