Using LD_PRELOAD in Android

Question

I am trying to use LD_PRELOAD to dynamically load a .so file during application launch. I built the native library using Android Studio (creating a native project and then extracting the .so file from the apk).

I followed the steps in (https://cedricvb.be/post/intercepting-android-native-library-calls/) to configure setprop but when I launched the application, the white screen appears and seems to hang but my constructor code did not get called (print a line to logcat).

I modified the simple constructor code from (https://www.gamedev.net/forums/topic/213849-linux-gt-so-files-entry-point/).

#include <jni.h>
#include <string>
#include <unistd.h>
#include <android/log.h>
#include <fcntl.h>
#include <dirent.h>
#include <dlfcn.h>

void simpleConstructor() __attribute__((constructor));
void simpleConstructor()
{
    __android_log_print(ANDROID_LOG_DEBUG,"constructor","constructor_code");
}

I configured the LD_PRELOAD variable as such

setprop wrap.com.x.y.z LD_PRELOAD=/data/local/tmp/libnative-lib.so

and the value is there when I ran getprop.

All I see in logcat are entries such as

04-07 18:03:54.850  1659  6548 I ActivityManager: Force stopping com.x.y.z appid=10209 user=0: from pid 9076
04-07 18:03:54.953  1659  6548 I ActivityManager: START u0 {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10000000 cmp=com.x.y.z/.MainActivity} from uid 2000
04-07 18:03:54.991  9083  9083 I com.x.y.z: Late-enabling -Xcheck:jni
04-07 18:03:55.093  1659  1680 I ActivityManager: Start proc 9083:com.x.y.z/u0a209 for activity com.x.y.z/.MainActivity
04-07 18:04:05.099  1659  1678 W ActivityManager: Process ProcessRecord{b809543 9083:com.x.y.z/u0a209} failed to attach
04-07 18:04:05.101  1659  1678 I ActivityManager: Killing 9083:com.x.y.z/u0a209 (adj -10000): start timeout

Appreciate any advice.

Answer 1

I was recently trying to do the same, i.e. inject a library into an application process using LD_PRELOAD, and I encountered the exact same issue with the application just hanging.

I somehow managed to solve the issue by building the library using the NDK instead of invoking the compiler directly. I do not know why this solve the issue, but here is what worked for me:

Create a jni folder and place your source file in it.
Create a Android.mk and a Application.mk files in the jni folder, with the following contents:

Android.mk:

LOCAL_PATH:= $(call my-dir)

include $(CLEAR_VARS)
LOCAL_MODULE := test         # Change to change the name of the resulting library
LOCAL_SRC_FILES := test.cpp  # Change to the name of your source file

LOCAL_LDLIBS := -llog        # Needed if you use __android_log_print
include $(BUILD_SHARED_LIBRARY)

Application.mk:

APP_ABI := armeabi-v7a arm64-v8a x86 x86_64   # You can remove the ones you don't need
APP_PLATFORM := 33

You can then simply run the ndk-build command to build the library.

Once you have the library, push it to the device and set the wrap property. Make sure to either disable SELinux or to change the context of the library for it to load in the app process.

adb push libs/arm64-v8a/libtest.so /data/local/tmp/libtest.so
adb shell su -c chcon u:object_r:system_lib_file:s0 /data/local/tmp/libtest.so 
adb shell su -c resetprop wrap.your.app LD_PRELOAD=/data/local/tmp/libtest.so

Hope this helps!