Tag: soinfo

• Three Ways to Protect Android Native Libraries - Function Encryption, Program Header Obfuscation, and a Custom ELF Format

  2025-05-18

  Three ways to protect Android native libraries: function encryption, program-header obfuscation, and a custom ELF format, compared and explained, with the tools and offsets documented.

• Detecting Zygisk Injection via the dlclose soinfo Gap

  2025-05-11

  Detecting Zygisk injection via dlclose, a clever trick that catches Magisk's Zygisk hooks by watching for a suspicious library unload, with a full walkthrough of the technique.

• A First Look at Android CRC Detection and Bypass

  2025-02-28

  A first look at Android CRC detection and bypass, showing how apps checksum their own code at runtime and how to patch around those checks, with the commands and code included.