Detecting Zygisk Injection via the dlclose soinfo Gap
Detecting Zygisk injection via dlclose, a clever trick that catches Magisk's Zygisk hooks by watching for a suspicious library unload, with a full walkthrough of the technique.
Tag: linker
From Java to Native: How a .so's Functions Get Loaded, Step by Step
From Java to native: how a .so's functions get loaded, tracing the JNI bridge from a Java call down to the native symbol resolution, for anyone reversing similar targets.
Bypassing libmsaoaidsec.so Frida Anti-Debugging in an Unpacked App
Bypassing libmsaoaidsec.so Frida anti-debugging, walking through the detection routines and patching them so Frida stays hidden on the device, including the pitfalls and the fix.
A First Look at Android CRC Detection and Bypass
A first look at Android CRC detection and bypass, showing how apps checksum their own code at runtime and how to patch around those checks, with the commands and code included.
How Android Loads a Native SO: A Walk Through the Source
How Android loads a native SO file, walking through the source of the linker and ClassLoader to explain the full dlopen and JNI load path, with a full walkthrough of the technique.
Persistent Native Hooking Without Repackaging: Swap the .so and Inline-Hook the Linker
Persistent native hooking without repackaging: swap the .so and inline-hook the linker's dlopen and dlsym so every library load routes through your own code.