Using AndHook and VirtualApp together.

[aslody]

Using AndHook and VirtualApp together.

[Rprop]

You can use AKLoadImage with absloute or relative path to load the specified lib, and then get stuff_addr via AKFindSymbol.
For more information, see https://github.com/Rprop/AndHook/blob/master/lib/include/AndHook.h

[jbro129]

What if the library I want to load does not have any symbols? Can I use AKHookFunction and specify an offset to hook? The library I want to hook all the functions are removed and the symbols are removed. I found the function I want to hook at an offset (let's say 0x12345 function name is sub_12345 with no symbol). How do I hook the library at a specific offset in the file?

[Rprop]

stuff_addr = AKGetBaseAddress + load_bias + offset

[jbro129]

Like this?

void *lib = 
AKLoadImage("/data/data/com.package.name/virtual/data/app/com.package.name/lib/libgame.so", 1, What Goes Here?);
            if (lib != NULL) {
                void *addr = (int)AKGetBaseAddress(lib) + load_bias??? + 0x12345;
                if (addr  != NULL)
                {
                    AKHookFunction(addr, hook_shotgun_Update, &orig_shotgun_Update);
                }
                AKCloseImage(lib);

What would go in the two spaces that I dont know what to fill with? The third parameter of AKLoadImage which is to do with Nougat and 'load_bias' which I do not know what that is.

is load_bias 'void *lib'?
( void *addr = AKGetBaseAddress(lib) + lib + 0x12345; )

[jbro129]

Can you please help me fill in the blanks for the code in the comment above? Thank you so much @Rprop ! 👍

[Rprop]

AKFindAnonymity(lib, 0x12345)

[jbro129]

My app crashed when I do System.loadLibrary("jbro"); in my MainActivity.

Here is libjbro.so
int (*orig_freedom_Update)(const int *) = NULL; // 0x12345 int hook_freedom_Update(const int *) { return 0; } void freedom() { LOG("starting native hook..."); { static bool hooked = false; if (!hooked) { void *lib = AKLoadImage("/data/data/com.package.name/virtual/data/app/com.package.name/lib/libgame.so",0, NULL); if (lib != NULL) { void *p = AKFindAnonymity(lib, 0x12345); if (p != NULL) { AKHookFunction(p, reinterpret_cast<void *>(hook_freedom_Update), reinterpret_cast<void **>(&orig_freedom_Update)); } AKCloseImage(lib); } //if hooked = true; } //if } }

Here is my logcat
06-27 02:10:27.568 11359-11359/? A/DEBUG: Build fingerprint: 'samsung/gts28vewifixx/gts28vewifi:7.0/NRD90M/T713XXU2BQI1:user/release-keys' Revision: '5' ABI: 'arm' pid: 11141, tid: 11141, name: ge_me_to_smthn4 >>> com.package.name <<< signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 r0 00cd3b44 r1 00000000 r2 c60fd6e9 r3 00000001 r4 e8ff9178 r5 c60fd6e9 r6 dbd73a90 r7 ffad0f20 r8 e8ff9178 r9 e90085bc sl e8ff9167 fp dbd73a90 ip 00000000 sp ffad0f20 lr c60fd6fd pc 00000000 cpsr 800f0010 06-27 02:10:27.573 11359-11359/? A/DEBUG: backtrace: #00 pc 00000000 <unknown> #01 pc 000006fb /data/app/com.package.name-1/lib/arm/libjbro.so #02 pc 00006039 /system/bin/linker (__dl__ZN6soinfo13call_functionEPKcPFvvE+84) #03 pc 00005f59 /system/bin/linker (__dl__ZN6soinfo10call_arrayEPKcPPFvvEjb+184)

//Edit 1 - I dont know why the Logcat is malformed like that.

[Rprop]

more detailed log?

[jbro129]

Yes I managed to find one more log
E/art: No implementation found for java.lang.String andhook.lib.AndHook.getVersionInfo() (tried Java_andhook_lib_AndHook_getVersionInfo and Java_andhook_lib_AndHook_getVersionInfo__)

[jbro129]

I removed using the java method andhook.lib.AndHook.ensureNativeLibraryLoaded(null); to load the libraries. I removed using that method and used System.loadLibrary("AK"); and System.loadLibrary("AKCompat"); instead before I do System.loadLibrary("jbro");
Now I get this.
java.lang.UnsatisfiedLinkError: dlopen failed: "/data/app/com.package.name-1/lib/arm/libAKCompat.so" has unexpected e_machine: 3