Dynamic Hooking and Overwriting of Native Android Password Validation Using Frida

Introduction

Reverse engineering native libraries in Android applications provides a direct avenue for examining the intricate logic underpinning critical functions. This exploration employs Frida, a sophisticated dynamic instrumentation framework, to interact with and manipulate the password validation routine of a native Android application.

Hooking and Overwriting the Password Validation

Using Frida, we intercepted and manipulated the password validation logic within the application’s native codebase.

Java.perform(function () {
    var lib = Module.findExportByName("libnative-lib.so", "Java_com_optiv_ndkcrackme_MainActivity_b");

    if (lib) {
        console.log("Found function: " + lib);

        Interceptor.attach(lib, {
            onEnter: function (args) {
                try {
                    var input = Memory.readUtf8String(args[1]);
                    console.log("Intercepted password check. Input: " + input);
                } catch (e) {
                    console.log("Error decoding input string: " + e.message);
                }
            },
            onLeave: function (retval) {
                console.log("Original return value: " + retval.toInt32());
                retval.replace(1);
                console.log("Modified return value: " + retval.toInt32());
            }
        });

        console.log("[X] Password bypass hook installed.");
    } else {
        console.log("Failed to find target function in libnative-lib.so.");
    }
});

    

Key Steps

Return Value Manipulation: The onLeave method modifies the original return value to 1, coercing the function to treat all inputs as valid credentials.

Results: Password Bypass in Action

By executing the script within the application’s runtime using the following command:

frida -U -p <pid> -l bypass_password_v2.js
    

The password validation mechanism was successfully overridden. The application consistently displayed Password accepted! regardless of the input provided.

Addressing Runtime Function Loading

During the hooking process, it was observed that the target function resided within a native library dynamically loaded during runtime. This behavior necessitated attaching directly to the application’s PID:

frida -U -p <pid> -l bypass_password_v2.js
    

We successfully identified and hooked the function at memory address 0x738ad16478. This pattern underscores the necessity of adaptive analysis techniques to accommodate dynamic library behavior.

Conclusion

Frida’s dynamic instrumentation capabilities exemplify fine-grained control over native Android application behavior. By targeting Java_com_optiv_ndkcrackme_MainActivity_b, we demonstrated a concrete application of runtime hooking to bypass password validation. These techniques provide a comprehensive framework for advanced reverse engineering, debugging, and security evaluation.

Final Note

The methodologies articulated in this document are exclusively intended for scholarly and ethical application. Practitioners bear the responsibility of ensuring adherence to all pertinent legal statutes and professional standards when employing these techniques.