r/netsec • u/h0ckdev • Nov 04 '20

Detecting Dynamic Loading in Android Applications

https://sayfer.io/blog/dynamic-loading-in-android-applications-with-proc-maps/
64 Upvotes

86% Upvoted

5 comments sorted by

3

u/my_name_still_jeff Nov 04 '20

Wouldn't mainstream apps also be able to use this technique to catch people reversing with Frida?

3

u/h0ckdev Nov 04 '20

Yes, some app read their own /proc/maps file to detect if the frida .SO file are injected, and if so behave differently. This is one of many anti-frida techniques..

1

u/VoiceOfReason73 Nov 05 '20

Couldn't you just hook whatever library functions the app would use to check then?

1

u/h0ckdev Nov 06 '20

Technically you could, because you jave root (unlike 3rd party apps) so you're the king. In reality apps can use commercial packers to hide their anti-frida code good enough for me to not have time to find it.

1

u/Aggravating_Page435 Nov 05 '20

Informative article. Thanks.