A virtualxposed-based inline hooking framework for android native methods

Hooking is an important technique for monitoring application performance and adding features to applications. Various hooking frameworks are developed to intercept events and process their own specific events. The hooking tools for Java methods are varied, however, the native hook has few methods. Besides, the commonly used Android hook frameworks cannot meet the requirement of hooking the native methods in shared libraries on non-root devices. Even some approaches are able to hook these methods, it has limitations or is complicated to implement. In the paper, a feasible hooking approach for Android native methods is proposed and implemented, which doesn’t need any modifications to both Android framework and app’s code. In this approach, the method’s reference address is modified and control flow is redirected. Beyond that, we combine this approach with VirtualXposed which aims to run it without root privileges. This hooking framework can be used to enforce security policies and monitor sensitive methods in shared objects. The evaluation of the scheme demonstrates its capability to perform hook operation without a significant runtime performance overhead on real devices and it is compatible and functional for the native hook.