house icon indicating copy to clipboard operation
house copied to clipboard

Hooks on a dynamic loaded class works, sometimes not

Open cryptax opened this issue 3 years ago • 0 comments

I am using malicious sample Android/Alien dc215663af92d41f40f36088ec1b850b81092ea94a4a061a9ce88178daee965a. I want to hook in class mgcmudrfccmnwasmkd.qalnmoqsc.oygfoqispqmmjqqkuij.gjavovxatuj, which is dynamically loaded, a method private String a(String arg5). I use:

  • Start panel: an Android emulator, via USB, and package name msqqqwokejyfwim.bzsotef.ftonpdptfkkfhcjxkrr
  • Hook panel: I specify the class and method name. I managed to get it to work without specifying anything more! (did not need to specify overload type nor dynamic path).

Sometimes it works. See below. house-decrypted This is good. But sometimes (often) it does not work. The most common error I get is [!] Process not found, trying to spawn it... Some other times I get [!]Error: Error: java.lang.ClassNotFoundException: Didn't find class "msqqqwokejyfwim.bzsotef.ftonpdptfkkfhcjxkrr.gjavovxatuj" on path: DexPathList[[zip file "/data/user/0/msqqqwokejyfwim.bzsotef.ftonpdptfkkfhcjxkrr/app_DynamicOptDex/jeSk.json"],nativeLibraryDirectories=[, /system/lib64, /vendor/lib64]] Note that the path /data/user/0/msqqqwokejyfwim.bzsotef.ftonpdptfkkfhcjxkrr/app_DynamicOptDex/jeSk.json corresponds to the dynamically loaded dex (unpacked). Sometimes I get "nothing". Nothing happens.

I am unsure if this is a bug, or if I am doing something wrong, but I'd be grateful to have a solution that works 100% all the time :)

cryptax avatar Mar 19 '21 14:03 cryptax