androidxposedxposed-framework

How to redirect the load of .so lib in Android using Xposed?


I have an app that contains a lib (for example, "test.so") and I want to redirect the load of that .so to another "test.so" which is modified by me, I tried everthing using Xposed like:

public class xposed implements IXposedHookLoadPackage {
    public void handleLoadPackage(final LoadPackageParam lpparam) throws Throwable {
        if (lpparam.packageName.equals("package")) {
            findAndHookMethod("java.lang.System", lpparam.classLoader, "loadLibrary", String.class, new XC_MethodHook() {
                @Override
                protected void beforeHookedMethod(MethodHookParam param){
                    XposedBridge.log("(before) Loaded library: " + param.args[0]);
                    if (param.args[0].toString().equals("test")){
                        System.load("/data/data/package/modified_test.so");
                    }
                }
            });
        }
    }
}

The app crashes, I searched on Google and I found this: System.loadlibrary hook crash but when I want to hook into Runtime like rovo said it doesn't do nothing. Someone know any solution?

(Please don't tell me about changing the lib into .apk because if I want that I didn't asking this xD).


Solution

  • Your code can not work because you are hooking the wrong method.

    System.loadlibrary expects as parameter the library name without file path, without prepended lib and without file extension. Therefore if you replace the parameter with "/data/data/package/modified_test.so" as shown in your example the library loading will not work.

    I assume you may have more luck if you hook the method that is responsible for mapping the library name to the actual library file: System.mapLibraryName(String). You can see how it is used in Runtime.loadLibrary(String, ClassLoader)

    To do so use an afterHookedMethod, check the result value and overwrite the return value with the path to your modified library.