androidfrida

frida load gadget config in android fail

I am trying to use frida gadget in android. but the libfrida-gadget.config.so load fail.

The file directory structure:

app/src/main/jniLibs/arm64-v8a/
├── libfrida-gadget.config.so
├── libfrida-gadget.script.so
└── libfrida-gadget.so

Then I try write below code to check:

        String fname = "frida-gadget.config";
        System.loadLibrary(fname);

It report a error:

AndroidRuntime: java.lang.UnsatisfiedLinkError: dlopen failed: "/data/app/~~LgSFpSMUlww0tmXhMEtdcw==/com.xxx.xxx-Vd0JiwQAV2Pr5oWPiEBacA==/base.apk!/lib/armeabi-v7a/libfrida-gadget.config.so"

That means dlopen actually can access this file, it report error since it's actually a text file, but share library. but frida can not.

Any API in android can access this file?

Solution

  • Why do you try to load the libfrida-gadget.config.so file?

    That file is a fake .so file which contains JSON configuration data, you can not load it as it is no library.

    You should simply execute the following command for loading Frida gadget library:

    System.loadLibrary("frida-gadget");

    Note that the Frida gadget and the way the the gadget loads it's configuration file was designed for Android apps that extract the .so files as part of the APK installation. Modern Android apps often do not extract .so files from the APK file anymore instead directly use them from within the APK. This works because the files are uncompressed and aligned to 4KB boundaries and the Android Dalvik native library knows this special way to load libraries directly form within an APK file.

    I don't think Frida gadget can load it's config file when the .so files are not extracted. To check if your APK file will extract the contained .so files see useLegacyPackaging and extractNativeLibs attributes in AndroidManifest.xml.