# JNI Static Linking

**Linking must be done “manually”**, by the binary code, before the methods are used.

* Allows methods to have any name (read obfuscation!).
* A fixed method (`JNI_OnLoad`) is called after the lib is loaded.
* Library registers the mapping between Java methods and native methods using `RegisterNatives`.
  * Must do this once for each method called.

```
jint RegisterNatives(JNIEnv *env, jclass clazz, const JNINativeMethod *methods, jint nMethods);
typedef struct {
    char *name;
    char *signature;
    void *fnPtr;
} JNINativeMethod;
```

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2Fq3lSi6Zd9JUsLF53i9Te%2FScreenshot%20from%202024-03-04%2017-36-54.png?alt=media&#x26;token=df5018ca-ffc4-47cd-a3cb-23e7357f30ad" alt=""><figcaption></figcaption></figure>

Reverse engineering of the library blob is the most viable alternative.

* Some symbols must always be available: `JNI_Load`.
* The remaining symbols usually are available, although they may have obfuscated names.

## Process

* Load the library in a tool: ghidra, IDA, BinaryNinja, R2, etc…
* Find the `JNI_Load` method.
* Determine when `RegisterNatives` is called.
* Determine the arguments passed to the function.
  * This will allow determining the method mapping and the arguments of each function.
  * The arguments may also help identify the method.
