Java decompiling and JNI

Question

A little bit like this question How to lock compiled Java classes to prevent decompilation? , However I am well aware of how to decompile an application and try to understand it even if it is obfuscated but one thing im not too sure about is how the same process would work if the application loaded C libraries (.so files) using jni.

For example say if there was a calculator, if this calculator was built in pure java it would be possible to go in and mess up the square root button so that when you passed in 2 it would give back 2^3 rather then 2^2.

Now if this application used JNI to do all this math commands (so it passed the 2 to a native method), how would you be able to go into the C, change it so that it returns 2^3 and not 2^2?

score 3 · Answer 1 · answered Mar 26 '11 at 19:13

3

Just figure out the C function signature and compile your own object file that implements that signature.

Years ago, working in a mainframe shop, my boss made his own version of the system date function and re-linked a commercial app we were using so he didn't have to renew the time-limited license. It was illegal as hell, but it worked.

answered Mar 26 '11 at 19:13

Paul Tomblin

179,021
58
319
408

what is the name of the mainframe shop? – Dimas Crocco Nov 27 '19 at 20:29
2

@DimasCrocco The Ontario Ministry of Transportation and Communications. All the participants have long since retired, and the company that made the time-limited software doesn't exist any more. – Paul Tomblin Nov 28 '19 at 22:48

score 2 · Accepted Answer · answered Mar 26 '11 at 19:15

Decompilation is older than bytecode. Pretty much everything can be decompiled. It's definitely harder (both to decompile and to understand/modify the result) with mangled, optimized machine code with zero metadata preserved, but nonetheless possible. Of course you'd need a different decompiler, and - as hinted before - it would be a bit harder, but the fact (which makes all DRM tools imperfect, by the way) "if their CPU runs it, they can modify it", holds for native code as much as for any bytecode.

Everyones answer was spot on. Thanks everyone. – Faisal Abid Apr 09 '11 at 22:40 — Faisal Abid, Apr 09 '11 at 22:40

score 1 · Answer 3 · answered Mar 26 '11 at 19:14

1

One option is to use disassembler. A simpler option is to replace the library with your own library.I use it for test purposes almost every day.

answered Mar 26 '11 at 19:14

MByD

135,866
28
264
277

score 1 · Answer 4 · answered Mar 26 '11 at 19:21

You could use a debugger to step into the C code.

You could disassemble it. IDA (Interactive Disassembler) was (is?) a great example, and could produce high quality disassembled code (cross-references, documentation, name of system/lib functions in calls, ...).

It is then possible to patch the binary (which could be protected in some way).

If you concern is that you don't want the people who use your app to see the code or even change it, could you consider letting it run as a web or client/server application, where the user doesn't have access to the server? This would let you resolve the problem.

Java decompiling and JNI

4 Answers4