adbi

adbi - The Android Dynamic Binary Instrumentation Toolkit

Simple binary instrumentation toolkit for Android ARM + Thumb.

Instrumentation is based on library injection and hooking function entry points (in-line hooking).

The toolkit consists of two main components the hijack tool and the base library.

hijack

The hijack tool provides the injection functionality. It supports a number of modes for supporting older and newer Android devices. hijack provides help on the command line.

libbase

The base library provides the hooking and unhooking functionality. The base library is compiled as a static library so it can be directly included in the actual instrumentation library. This is done so we can keep everything in /data/local/tmp.

Below we provide and easy to follow step-by-step instructions for howto build and use adbi. The example instrument hijacks epoll_wait() and logs every call to a file.

=== External Resources ===

more information at: http://www.mulliner.org/android/

slide deck about this toolkit: http://www.mulliner.org/android/feed/binaryinstrumentationandroid_mulliner_summercon12.pdf

old code (with more examples): http://www.mulliner.org/android/feed/collin_android_dbi_v02.zip

=== Prerequisites ===

Android SDK Android NDK

=== How to Build ===

= build the hijack tool =

cd hijack
cd jni
ndk-build
cd ..
adb push libs/armeabi/hijack /data/local/tmp/
cd ..

= build the instrumentation base code =

cd instruments
cd base
cd jni
ndk-build
cd ..
cd ..

= build instrumentation example =

cd example
cd jni
ndk-build
cd ..
adb push libs/armeabi/libexample.so /data/local/tmp/

=== How to Run ===

adb shell
su
cd /data/local/tmp
>/data/local/tmp/adbi_example.log
# GET PID from com.android.phone
./hijack -d -p PID -l /data/local/tmp/libexample.so
cat adbi_example.log

output should look similar to:

started
hooking:   epoll_wait = 0x4004c378 ARM using 0x4a84a588
epoll_wait() called
epoll_wait() called
epoll_wait() called
removing hook for epoll_wait()