Introduction to Android Native Hooking with Frida

Android applications often leverage native code (C/C++) for performance-critical operations, low-level system interactions, or to protect sensitive logic from easy reverse engineering. While Java/Kotlin code can be decompiled relatively easily, native libraries present a greater challenge. This is where Frida, a dynamic instrumentation toolkit, shines. Frida allows security researchers and developers to inject custom scripts into running processes, enabling powerful runtime analysis and modification, including deep dives into native C/C++ functions.

The Power of Frida in Native Reverse Engineering

Native hooking with Frida provides unparalleled capabilities for understanding and manipulating how an Android application interacts with its underlying system and third-party libraries. It’s an indispensable technique for:

• Security Research: Uncovering vulnerabilities in native code, analyzing cryptographic implementations, or understanding anti-tampering mechanisms.
• Reverse Engineering: Deobfuscating protected logic, tracing data flows, and reconstructing complex algorithms implemented in C/C++.
• Bypassing Controls: Modifying function behavior to bypass license checks, unlock features, or circumvent security measures in a controlled environment.

Setting the Stage: Prerequisites and Tools

Before diving into native hooking, ensure you have a proper environment set up:

• Rooted Android Device or Emulator: Necessary for running the Frida server.
• Frida Server: Running on your Android device.
• Frida Tools: Installed on your host machine (pip install frida-tools).
• ADB: Android Debug Bridge for interacting with the device.
• Disassembler/Decompiler: Tools like Ghidra or IDA Pro are crucial for static analysis of native libraries (.so files) to identify target functions and understand their signatures.

Identifying Target Native Functions

The first step in native hooking is to accurately identify the C/C++ functions you want to intercept. This often involves a combination of static and dynamic analysis.

JNI Exports and Dynamic Analysis

Many native functions in Android are exposed via the Java Native Interface (JNI). Java methods declared with the native keyword link to C/C++ functions within a shared library. You can often find these mappings by examining the Java code or using tools that list JNI exports. For example, if a Java method is public native boolean checkLicense(String key);, its corresponding C/C++ function will typically follow a JNI naming convention like Java_com_example_app_NativeUtils_checkLicense.

You can also use Frida itself to enumerate exports of loaded modules:

Java.perform(function() {    var lib = Module.findBaseAddress("libnative-lib.so");    if (lib) {        console.log("Base address of libnative-lib.so: " + lib);        Module.enumerateExportsSync("libnative-lib.so").forEach(function(exp) {            console.log("  Export: " + exp.name + " @ " + exp.address);        });    } else {        console.log("libnative-lib.so not found.");    }});

Static Analysis with Disassemblers

For functions not directly exported via JNI or for deeper understanding, a disassembler like Ghidra or IDA Pro is essential. Load the target .so file into these tools to:

• Identify internal functions not exposed by JNI.
• Determine function signatures (number and types of arguments, return value).
• Understand calling conventions (e.g., ARM32 vs. ARM64, where arguments are passed in registers or on the stack).
• Locate specific code blocks or offsets within a function for fine-grained hooking.

Understanding the ABI (Application Binary Interface) for your target architecture (e.g., AArch64) is critical to correctly interpret arguments and return values. For ARM64, the first eight arguments are typically passed in registers X0-X7, with subsequent arguments on the stack. Return values are usually in X0.

Frida’s Core for Native Interception

Frida provides two primary mechanisms for interacting with native code: Module.findExportByName and Interceptor.attach.

Module.findExportByName and Interceptor.attach

• Module.findExportByName(moduleName, exportName): This function is used to find the memory address of an exported function within a loaded module (shared library). If you know the module name (e.g., libnative-lib.so) and the exact name of the exported function (e.g., Java_com_example_app_NativeUtils_checkLicense or a simple C function like custom_function), this is your primary way to get its address.
• Interceptor.attach(address, callbacks): Once you have the address, Interceptor.attach allows you to insert your own code before (onEnter) and after (onLeave) the original function execution.

var funcAddress = Module.findExportByName("libmygame.so", "check_integrity");if (funcAddress) {    Interceptor.attach(funcAddress, {        onEnter: function (args) {            // 'this' refers to the invocation context            console.log("check_integrity called! Arg 0 (pointer): " + args[0]);            // Example: read a string argument            // var strArg = args[0].readUtf8String();            // console.log("  Arg 0 as string: " + strArg);        },        onLeave: function (retval) {            console.log("check_integrity returned: " + retval);            // Example: modify return value to always be true (1)            // retval.replace(ptr(1));        }    });    console.log("Hooked check_integrity at " + funcAddress);} else {    console.log("check_integrity not found!");}

Practical Example: Hooking a C/C++ Function

Let’s consider a common scenario: an application that performs a license check in native code. We’ll create a simple shared library and an Android app to demonstrate hooking.

Scenario: Intercepting a Hypothetical License Check

Imagine you have a native library (libnative-lib.so) with a C function like this:

// native-lib.cpp#include #include extern "C" JNIEXPORT jboolean JNICALLJava_com_example_fridanativehook_MainActivity_checkLicense(        JNIEnv* env,        jobject /* this */,        jstring licenseKey) {    const char* keyCStr = env->GetStringUTFChars(licenseKey, 0);    std::string validKey = "SUPER_SECRET_KEY";    bool isValid = (std::string(keyCStr) == validKey);    env->ReleaseStringUTFChars(licenseKey, keyCStr);    return isValid;}`}

// frida_script.jsJava.perform(function() {    var moduleName = "libnative-lib.so";    var functionName = "Java_com_example_fridanativehook_MainActivity_checkLicense";    var moduleBase = Module.findBaseAddress(moduleName);    if (!moduleBase) {        console.log("Module " + moduleName + " not loaded yet or not found.");        return;    }    console.log("Module " + moduleName + " base address: " + moduleBase);    var targetFunction = Module.findExportByName(moduleName, functionName);    if (!targetFunction) {        console.log("Function " + functionName + " not found in " + moduleName + ".");        return;    }    console.log("Target function " + functionName + " found at: " + targetFunction);    Interceptor.attach(targetFunction, {        onEnter: function(args) {            // In JNI functions, args[0] is JNIEnv*, args[1] is jobject (this)            // Subsequent args are the actual method parameters.            // For ARM64: X0, X1, X2...            // Our licenseKey is the third argument passed to the JNI function.            // In Frida's 'args' array, this maps to args[2].            this.licenseKeyPtr = args[2];            var key = Java.vm.get === 'android' ? Java.string(this.licenseKeyPtr) : "Not an Android JNIEnv"; // Helper for converting jstring to JS string            console.log("Intercepted checkLicense with key: " + key);            // Optionally modify the license key before it's used            // var newKey = env.newStringUtf("ALWAYS_VALID");            // args[2] = newKey; // This might require more complex JNIEnv interaction            // For simplicity, we'll just modify the return value.        },        onLeave: function(retval) {            console.log("Original return value: " + retval);            // Force the return value to true (jboolean is 1 for true)            retval.replace(ptr(1));            console.log("Modified return value to: " + retval);        }    });    console.log("Hooked successfully!");});