You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Secrets found in .so file (shared object file) #10
In Android applications, a .so file (shared object file) typically contains compiled native code, often written in languages like C or C++. The purpose is to provide functionality that isn't easily achievable with standard Android SDK tools or to optimize performance-sensitive parts of an application.
Unfortunately, none of the decompilers APKscan currently supports, can handle .so files since they are most likely compiled C bytecode, and the current decompilers only work with Dalvik/Java bytecode.
As you've shown, you still can however scan these files for secrets since APKscan performs pattern matching on the file's bytes meaning it does not require readable strings to locate secrets.
What that means is that the RSA PRIVATE KEY pattern is found in your .so but'll need to take some additional steps to find it:
The simplest, but least effective method would be to try to just use strings and grep:
Also @xcypher78 just FYI if your .so is any of the following it is most likely a false positive:
libflutter.so
libhydra.so
libopenvpn.so
libovpncli.so
I'm going to close this issue for now since APKscan is working as expected, but thanks again for your feedback, I'm going to consider how to add support for this in future updates. Take care.
Activity
LucasFaudman commentedon Aug 2, 2024
Hey @xcypher78,
Thanks for the feedback.
In Android applications, a
.sofile (shared object file) typically contains compiled native code, often written in languages like C or C++. The purpose is to provide functionality that isn't easily achievable with standard Android SDK tools or to optimize performance-sensitive parts of an application.Unfortunately, none of the decompilers APKscan currently supports, can handle
.sofiles since they are most likely compiled C bytecode, and the current decompilers only work with Dalvik/Java bytecode.As you've shown, you still can however scan these files for secrets since APKscan performs pattern matching on the file's bytes meaning it does not require readable strings to locate secrets.
What that means is that the
RSA PRIVATE KEYpattern is found in your.sobut'll need to take some additional steps to find it:The simplest, but least effective method would be to try to just use
stringsandgrep:Note: the
-A30arg means show 30 lines after each match to try to find the whole key.If this does not work, I'd suggest using a binary analysis tool such as:
Radare2: An open-source software framework for reverse engineering and analyzing binaries. (My personal favorite tool for this purpose. )Ghidra: A free and open-source software reverse engineering tool developed by the NSA.IDA Pro: A commercial tool for disassembly, decompilation, and reverse engineering.LucasFaudman commentedon Aug 2, 2024
Also @xcypher78 just FYI if your
.sois any of the following it is most likely a false positive:libflutter.solibhydra.solibopenvpn.solibovpncli.soI'm going to close this issue for now since APKscan is working as expected, but thanks again for your feedback, I'm going to consider how to add support for this in future updates. Take care.
xcypher78 commentedon Aug 2, 2024
The file is libapp.so and thanks for your information Lucas
[-]decompile[/-][+]Secrets found in `.so` file (shared object file) [/+]