Open-source tool for unpacking stripped Android native (.so)…

If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where:

classes*.dex declares native methods, but lib/*.so has 0 exported Java_* symbols and wiped ELF section headers.
JNI_OnLoad constructs strings on the stack (MOVZ/MOVK), uses an OLLVM CSEL + BR X8 state machine, and registers JNI handlers dynamically.
Attaching Frida immediately crashes the app due to /proc/self/maps or libc prologue checks.

I released JNISleuth-MCP (Apache 2.0) to automate this part of Android malware triage: https://github.com/nighthawkk/JNISleuth-MCP

Recovers static JNINativeMethod triplets from .rodata / .data.rel.ro (with PT_LOAD fallback for section-stripped ELFs).
Extracts MOVZ/MOVK stack strings and XOR-encoded C2 strings from JNI_OnLoad / .init_array.
Resolves & patches ARM64 OLLVM CSEL + BR X8 indirect branches and .rodata jump tables.
Includes a C++/NDK Dobby agent that hooks RegisterNatives mid-function (+0x10) and dumps in-memory DEX payloads from art::DexFileLoader::OpenCommon without triggering standard Frida detections.
Syncs all 233 JNIEnv* vtable types and C signatures into Ghidra and IDA Pro 9.0, plus includes an MCP/LLM server.

Ships with a synthetic dropper APK (samples/banker_dropper.apk) so you can test all features offline.

Impact

JNISleuth-MCP itself is not malware but a tool that facilitates the analysis and unpacking of sophisticated Android malware that uses stripped native libraries and anti-analysis techniques. By enabling recovery of obfuscated JNI bindings and bypassing anti-debugging measures, it aids security researchers and analysts in understanding and dissecting malware samples more effectively. This can lead to improved detection and mitigation of Android banking trojans, droppers, and spyware that employ these evasion methods.

Defensive guidance

This is an analysis and reverse engineering tool, not a vulnerability or exploit requiring patching. No direct mitigation is needed. Security professionals can use JNISleuth-MCP to enhance their malware analysis capabilities and improve detection of advanced Android threats.

Summary

JNISleuth-MCP addresses challenges in analyzing modern Android malware that employs stripped native libraries with dynamically registered JNI methods and obfuscation techniques such as OLLVM BR X8 state machines and anti-debugging checks. It statically recovers RegisterNatives method triplets from ELF sections or fallback memory segments, extracts encoded strings from JNI_OnLoad, and patches ARM64 indirect branches. The tool includes a stealth native agent to hook RegisterNatives dynamically on-device, bypassing common Frida detection methods. It synchronizes JNI environment types and function signatures into reverse engineering tools and supports a unified Model Context Protocol server for AI-assisted analysis. This enables seamless tracing of data flow across Java and native boundaries, improving the efficiency and accuracy of Android malware reverse engineering.

Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracing

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 29 Oct 2026, 06:20 UTC

Technical details

References

Community reviews

Related threats