JNIAnalyzer | Analysis scripts for Ghidra to work with Android NDK | Reverse Engineering library

by Ayrx Java Version: Current License: No License

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | JNIAnalyzer Summary

JNIAnalyzer is a Java library typically used in Utilities, Reverse Engineering applications. JNIAnalyzer has no vulnerabilities and it has low support. However JNIAnalyzer has 2 bugs and it build file is not available. You can download it from GitHub.

This Ghidra extension contains various scripts that assists in analyzing Android NDK applications. A Binary Ninja version of this plugin is also available.

Support

Quality

Security

License

Reuse

Support

JNIAnalyzer has a low active ecosystem.

It has 135 star(s) with 15 fork(s). There are 7 watchers for this library.

It had no major release in the last 6 months.

There are 1 open issues and 5 have been closed. On average issues are closed in 7 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of JNIAnalyzer is current.

Quality

JNIAnalyzer has 2 bugs (0 blocker, 0 critical, 2 major, 0 minor) and 56 code smells.

Security

JNIAnalyzer has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

JNIAnalyzer code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

JNIAnalyzer does not have a standard license declared.

Check the repository for any license declaration and review the terms closely.

Without a license, all rights are reserved, and you cannot use the library in your applications.

Reuse

JNIAnalyzer releases are not available. You will need to build from source code and install.

JNIAnalyzer has no build file. You will be need to create the build yourself to build the component from source.

Installation instructions are available. Examples and code snippets are not available.

JNIAnalyzer saves you 293 person hours of effort in developing the same functionality from scratch.

It has 707 lines of code, 25 functions and 12 files.

It has medium code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed JNIAnalyzer and discovered the below as its top functions. This is intended to give you an instant insight into JNIAnalyzer implemented functionality, and help decide if they suit your requirements.

Main entry point
Converts a primitive argument to its corresponding string representation
Obtain the primitive signature for a primitive type
Convert an array type to an array type
Parses the given apk file
Generate a native method name for the given method
Apply the signature of a method
Mangles unicode characters to unicode
Apply JNI - Load signature to JNI
Parse the argument signature
Convert argument type to javadoc type

Get all kandi verified functions for this library.

JNIAnalyzer Key Features

No Key Features are available at this moment for JNIAnalyzer.

JNIAnalyzer Examples and Code Snippets

No Code Snippets are available at this moment for JNIAnalyzer.

Community Discussions

Trending Discussions on JNIAnalyzer

Find manually registered (obfuscated) native function address

QUESTION

Find manually registered (obfuscated) native function address

Asked 2019-Nov-06 at 10:30

I'm trying to understand an Android app which contains a native method named foo in class com.app.Bar

Inside class Bar there is a static clause that loads a shared object System.loadLibrary("libfoo.so") which I assume is build with -fvisibility=hidden because the only export is JNI_OnLoad, no JNIEXPORT void JNICALL Java_com_app_Bar_foo which means public native int foo does not follow the naming convention.

What is the process when foo is invoked ?
How can I extract the address of foo ? I'm familiar with Frida
Is there a way to output all JNINativeMethod[] methods ?

What have I tried so far ?

JNIAnalyzer outputs 13K lines that look like JNI_OnLoad@@Base+0x712e
Frida script to try to find foo address (did not work)

...

ANSWER

Answered 2019-Nov-06 at 10:30

I've solved it using Frida

Hooking art::JNI::RegisterNativeMethods(_JNIEnv*, _jclass*, JNINativeMethod const*, int, bool) and art::JNI::FindClass after libart.so module is loaded.

Code

Source https://stackoverflow.com/questions/51811348

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install JNIAnalyzer

Clone this repository (git clone https://github.com/Ayrx/JNIAnalyzer.git)
In the cloned repository folder, use the command gradle -PGHIDRA_INSTALL_DIR=<YOUR GHIDRA INSTALLATION DIRECTORY>; specifying your Ghidra installation directory
In Ghidra, at the Projects window, click File -> Install Extensions... and chose the .zip file present in the JNIAnalyzer/dist folder
Restart Ghidra

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: