← Back

UnCrackable Level 2 - Mobile Security Writeup

By Shay Mordechai | April 30, 2026

The `MainActivity` calls a Native function `bar` passing a byte array, stripping memory protections via JNI[cite: 14]. The `init()` function spawns a Worker Thread (`AsyncTask`) checking for debuggers every 100ms[cite: 14].

Ptrace Anti-Debugging: IDA Pro revealed a Linux mechanism where a `fork()` creates a child process that locks the parent using `ptrace(PTRACE_ATTACH)`, entering an infinite loop to block tools like Frida[cite: 14].

Frida Inline Hooking: Instead of patching the binary, I hooked `strncmp` exported by `libfoo.so`. By reading the memory pointers using `Memory.readUtf8String`, I intercepted the decryption comparison and successfully dumped the secret key in real-time[cite: 14].