Ghidra Analysis of Android Native Code
Part 2 of the series on Native Android Code. Part 1 here:
• Where's the native code? (In Android)
In this video, we are going to look at the native code, and see how we can go back and forth between Java and Native code. We will also examine how native functions are called.
Timestamps:
00:00 Intro
00:46 Opening Sample
01:30 APK Contents
02:26 What is the Lib folder?
03:37 Ghidra Introduction
04:10 Creating a Project
04:42 Elfs? In my computer?
05:32 Analyzing
06:35 Method Names
07:38 JNI Onloading
07:54 Analyzing Native Code
08:07 What is the JNI?
08:46 Oracle JNI Reference
09:20 Native Pointer to the JNI Env
10:11 Importing Symbols
11:50 Calling JNI Methods
12:25 Defined Methods
13:11 Recap
---
Useful Links Mentioned in Video:
Ghidra: https://ghidra-sre.org/
JNI Functions Reference: https://docs.oracle.com/javase/7/docs...
JNI Symbols: https://github.com/Ayrx/JNIAnalyzer/b...
---
Malware Examined in the video (XLoader):
sha256:02c08ec2675abe6e09691419dd1a281194879c6e393de1cdfb150b864378d921
MalwareBazaar Link:
https://bazaar.abuse.ch/sample/02c08e...
---
laurieWIRED Twitter:
/ lauriewired
laurieWIRED Website:
http://lauriewired.com
laurieWIRED HN:
https://news.ycombinator.com/user?id=...
laurieWIRED Reddit:
/ lauriewired