4

I am trying to decompile a Android ARM native binary using Hex-Rays IDA Pro. IDA detects the possible formats as

  • ELF for ARM (Shared object)
  • Binary file

If I choose ELF for ARM (Shared object), then it correctly decompiles and detect most of the standard functions like tan/sin/cos etc. But when I try to run the remote android debugger, I am getting the alert messages

  • Input file is a dynamic library, it cannot be run by itself. Please specify the host application.
  • The file can't be loaded by the debugger plugin. Please verify that the parameters are valid.

If I select Binary file, then it is not decompiling correctly. Also remote android debugger option is not listed in debuggers list.

I am able to execute the binary file directly on an Android ARM emulator.

What am I doing wrong? How can I debug a ELF for ARM binary executable file with IDA pro?

Edit: I have already tried with android_server running on an AVD and a physical device. When I try to connect [ELF for ARM (Shared object)], I can see the following output in android_server

=========================================================
[7] Accepting connection from 127.0.0.1...
[7] Closing connection from 127.0.0.1...

Are all ARM binary executables detected as shared object? Or is my executable file being misidentified as a .so file?

Joyce Babu
  • 141
  • 1
  • 1
  • 5
  • If the file is loaded as a Shared Object, then it is a likely a '.so' file and is actually a shared library.

    Are you positive that this application can be run independently from the command line (adb)?

    If it is a shared library, you will need to attach to a process that can load and call the functionality that you want to step through in IDA.

     – diff May 27 '15 at 22:11

3 Answers3

4

You'll need to create an Android Virtual Device, copy your ELF program and <IDA directory>\dbgsrv\android_server to the virtual device, and run android_server on the virtual device. You can then use IDA to debug the ELF file.

Here are two pages with detailed instructions on how to do this:

enter image description here

Jason Geffner
  • 20,681
  • 1
  • 36
  • 75
  • I have already tried it with an AVD and a physical device. When I run the remote android debugger, I can see the following output in android_server ========================================================= [7] Accepting connection from 127.0.0.1... [7] Closing connection from 127.0.0.1... – Joyce Babu Apr 25 '15 at 21:19
2

As I've stated in my comment to your question, the file is loaded as a Shared Object, then it is a likely a '.so' file and is actually a shared library. Are you positive that this application can be run independently from the command line (adb)?

If it is a shared library, you will need to attach to a process that can load and call the functionality that you want to step through in IDA. You can do this using an "shim" application that I created and posted online;

https://github.com/rednaga/native-shim

It include directions on how you would compile it, push it to the device and point IDA Pro at it. This allows you to pass the shared library as an argument and allow it to be "run" via IDA Pro. Hopefully this solves your issue.

diff
  • 358
  • 1
  • 11
0

You can check the tutorial on this link. It explains how to debug with both gdb and IDA Pro: http://www.aldeid.com/wiki/Category:Architecture/Android#tab=Android_Remote_debugging

William Coen
  • 1