FuzzMe – Reverse Engineering and Fuzzing an Android Shared L...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://hackmd.io/@sal/fuzzme-mobilehackinglab-ctf-writeup
• Blog Title: FuzzMe – Reverse Engineering and Fuzzing an Android Shared Library
• Suggested Section: Binary Exploitation -> Common Exploiting Problems (with cross-links from Mobile Pentesting -> Android Applications Pentesting -> Reversing Native Libraries and from Reversing -> Reversing Tools & Basic Methods), as a subsection like "Android AArch64 shared-library fuzzing & LD_PRELOAD hooking"

🎯 Content Summary

This write-up presents an end-to-end, highly practical workflow for reverse engineering and fuzzing an Android AArch64 shared library (libvalidate.so) to recover a hidden flag by driving a specific exported function (validate). Although designed as a CTF challenge, all techniques (binary inspection, harnessing, hooking, and fuzzing) generalize to real-world mobile binary assessment.

1. Target discovery and initial RE
The challenge provides a single AArch64 ELF shared libr...

🔧 Technical Details

1. Reverse engineering JSON-based validators in Android shared libraries
Given an AArch64 ELF shared library, first enumerate exported symbols with objdump to identify callable entry points (e.g., validate). Load the library into Ghidra or similar, inspect the decompiled function, and infer argument types (pointer + length). Follow the control flow to see if the input is treated as JSON or another structured format. By analyzing comparison branches and error paths, reconstruct the expected schema (e.g., mandatory top-level keys like magic, version, padding, nested root trees with constant type/level/num_children values). This allows crafting syntactically and semantically valid inputs that exercise deeper checks instead of failing on the first parse error.

2. Using C harnesses to drive exported ELF functions
To fuzz a single exported f...

🤖 Agent Actions

Summary:

• Expanded src/binary-exploitation/common-exploiting-problems.md with a new “Android AArch64 shared-library fuzzing & LD_PRELOAD hooking” section covering export triage, harness construction, schema reconstruction, LD_PRELOAD flag leaking, fuzz-space reduction, and an AFL-oriented harness (with collapsible code blocks).
• Added cross-references from that section to the existing Android native reversing and general reversing tooling pages for easier navigation.
• Introduced a consolidated “References” section citing the original FD/Socat resources and the new Android fuzzing write-up.

Tests: Not run (not applicable).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://hackmd.io/@sal/fuzzme-mobilehackinglab-ctf-writeup

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation -> Common Exploiting Problems (with cross-links from Mobile Pentesting -> Android Applications Pentesting -> Reversing Native Libraries and from Reversing -> Reversing Tools & Basic Methods), as a subsection like "Android AArch64 shared-library fuzzing & LD_PRELOAD hooking"".

Repository Maintenance:

• MD Files Formatting: 915 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0