2Y2s1mple / jni_helper

Find JNI function signatures in APK and apply to reverse tools.

JNI Helper

Find JNI function signatures in APK and apply to reverse tools.

Basic Usage

1. Use extract_jni.py to generate signature.json
2. Load signature.json into Ghidra/IDA/Radare2

extract_jni.py

Install dependences:

pip3 install -r requirements.txt

Usage:

$ ./extract_jni.py -h
usage: extract_jni.py [-h] [-o OUTFILE] apk

positional arguments:
  apk         /path/to/apk

optional arguments:
  -h, --help  show this help message and exit
  -o OUTFILE  save JNI methods as formatted json file

Ghidra

See Ghidra

Before	After

IDA

See IDA

Before	After

Radare2

WIP, see Radare2

Demo

Tested with demo APK: app-debug.apk

TODO

• support both C/C++ JNI functions
• support overloaded JNI functions
• remove Jadx dependence, all in Python
• support env->RegisterNatives JNI functions

LINKS

• android native-libraries
• 安卓逆向之自动化JNI静态分析