Patching Android ARM64 library initializers for easy Frida i...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.nviso.eu/2025/10/14/patching-android-arm64-library-initializers-for-easy-frida-instrumentation-and-debugging/
• Blog Title: Patching Android ARM64 library initializers for easy Frida instrumentation and debugging
• Suggested Section: Mobile Application Security -> Android -> RASP/Anti-Debug Bypass -> Patching .init_array and JNI_OnLoad for early Frida instrumentation

🎯 Content Summary

What the post delivers
A step‑by‑step, copy‑pasteable method to neutralize Android ARM64 shared library constructors that run via .init_array (commonly abused by RASP for early detections) by: (1) removing INIT_ARRAY/INIT_ARRAYSZ from the DYNAMIC table so they don’t auto‑execute, (2) exposing the hidden constructor as a normal exported function (INIT0), (3) renaming JNI_OnLoad→JNI_OnLoad0 to prevent implicit ART calls, and (4) spinning up a minimal ART/JNI with JNIInvocation to invoke...

🔧 Technical Details

Make implicit constructors explicit: On Android ARM64, .init_array entries are filled by R_AARCH64_RELATIVE relocations whose addend is the target function. Locate the relocation inside .init_array via readelf --relocs; the addend (e.g., 0xa34 or 0x954) is the constructor. Remove INIT_ARRAY/INIT_ARRAYSZ from the DYNAMIC table so the loader won’t auto-execute it, then add a GLOBAL FUNC symbol (e.g., INIT0) at that address with LIEF so you can call it on demand.

Prevent implicit JNI initialization: Rename JNI_OnLoad→JNI_OnLoad0 in the symbol table. This stops ART from calling it implicitly. After attaching Frida/lldb and patching early checks, invoke JNI_OnLoad0(vm) yourself.

Standalone ART harness for repeatable testing: Use

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.nviso.eu/2025/10/14/patching-android-arm64-library-initializers-for-easy-frida-instrumentation-and-debugging/

Content Categories: Based on the analysis, this content was categorized under "Mobile Application Security -> Android -> RASP/Anti-Debug Bypass -> Patching .init_array and JNI_OnLoad for early Frida instrumentation".

Repository Maintenance:

• MD Files Formatting: 901 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge