Ghidra Analysis of Android Native Code

Part 2 of the series on Native Android Code. Part 1 here:
https://youtu.be/joM3YIVyjnc

In this video, we are going to look at the native code, and see how we can go back and forth between Java and Native code. We will also examine how native functions are called.

Timestamps:
00:00 Intro
00:46 Opening Sample
01:30 APK Contents
02:26 What is the Lib folder?
03:37 Ghidra Introduction
04:10 Creating a Project
04:42 Elfs? In my computer?
05:32 Analyzing
06:35 Method Names
07:38 JNI Onloading
07:54 Analyzing Native Code
08:07 What is the JNI?
08:46 Oracle JNI Reference
09:20 Native Pointer to the JNI Env
10:11 Importing Symbols
11:50 Calling JNI Methods
12:25 Defined Methods
13:11 Recap

---
Useful Links Mentioned in Video:
Ghidra: https://ghidra-sre.org/

JNI Functions Reference: https://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/functions.html

JNI Symbols: https://github.com/Ayrx/JNIAnalyzer/blob/master/JNIAnalyzer/data/jni_all.gdt

---
Malware Examined in the video (XLoader):
sha256:02c08ec2675abe6e09691419dd1a281194879c6e393de1cdfb150b864378d921

MalwareBazaar Link:
https://bazaar.abuse.ch/sample/02c08ec2675abe6e09691419dd1a281194879c6e393de1cdfb150b864378d921/

---
laurieWIRED Twitter:
https://twitter.com/lauriewired

laurieWIRED Website:
http://lauriewired.com

laurieWIRED HN:
https://news.ycombinator.com/user?id=lauriewired

laurieWIRED Reddit:
https://www.reddit.com/user/LaurieWired