# Exercise 5 and 6

## strings

Do we have interfaces matching the functions we know to be native?

* `int bspatch(String str, String str2, String str3).`
* `void m2054a(String s)`

`strings lib/x86/librrnad.so |grep "(Ljava/lang/String"`

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FAyJT2e5dAKWFnhjZescA%2FScreenshot%20from%202024-03-04%2017-36-54.png?alt=media&#x26;token=a61f8d3d-c8ec-4a6d-925d-e43dd62a785a" alt=""><figcaption></figcaption></figure>

## nm

Do we have dynamic linking? Let's look for methods following the known pattern.

* `nm –gD lib/x86/librrnad.so |grep java_`, none is found.

Conclusion:

* We have artefacts pointing to Java types.
* We do not indicate Dynamic Linking.

## ghidra

Open ghidra, create a new project and load a library.

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2Fv6ZuNDHZG0r5zztNJIYg%2Fa.png?alt=media&#x26;token=4cbad3c6-45e3-49ac-91e5-3ed61004021a" alt=""><figcaption></figcaption></figure>

Several interesting functions were discovered.

* `JNI_Load,`
* `registerNatives, registerNativeMethods,`
* `FUN_00011230, FUN_000270, FUN_11290, FUN_112b4,`
* `native_setAppKey`

Coherent with Static Linking.

Explore the functions, exports, Classes, etc… lots of info.

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FT7pUPXO4JygIT9j3vbu5%2Fimage.png?alt=media&#x26;token=eee121d8-7e54-4020-bfca-3b8393bd5379" alt=""><figcaption></figcaption></figure>

Graph -> Block Flow from JNI\_OnLoad.

Decompile `JNI_OnLoad`

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FuhSTaBlVIkLqDLIzQQf5%2Fimage.png?alt=media&#x26;token=963efd3b-c001-44d8-a626-a1658b3262b6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FrJS5LpGfZwPhIZOLEn64%2FScreenshot%20from%202024-03-04%2018-02-46.png?alt=media&#x26;token=d3912220-5487-42e9-8733-dbab2df0a688" alt=""><figcaption></figcaption></figure>

Loading the `jni_all.gdt`, and retyping the variables, allows the resolution of symbols, such as the `FindClass`.

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FUqI9l2VofRTqxHaT1Ik9%2Fimage.png?alt=media&#x26;token=9d5bf5e2-05b4-4d59-bbfc-515faae90e44" alt=""><figcaption></figcaption></figure>

### `registerNatives`

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FfzWpGptWuMWSXpCMK24l%2FScreenshot%20from%202024-03-04%2018-04-09.png?alt=media&#x26;token=14699a82-25fb-4084-8bd2-7e420a63c38c" alt=""><figcaption></figcaption></figure>

### `registerNativeMethods`

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2Fh65SmngpCOz4Vs7XWAgp%2FScreenshot%20from%202024-03-04%2018-04-40.png?alt=media&#x26;token=1a623cf1-8f1c-45a9-92f9-b898f2046c50" alt=""><figcaption></figcaption></figure>
