byOpen v1.0

byOpen is an enhanced version of the dlfunctions library that bypasses mobile system limitations.

byOpen Features

Supports loading and using the Android system library interface in the App (even if the maps have not been loaded yet).

On Android 7 and above, dlopen and System.load are restricted from being called. Although there are currently libraries such as Nougat_dlfunctions on the Internet that bypass the loading restrictions by finding the so library from maps.

However, this method will not work for the so library in the app that has not been loaded into maps.

ByOpen not only supports fake dlopen loading from maps, but can also forcibly load so libraries that have not yet been loaded into maps, bypassing system restrictions, to achieve a more universal dlopen.

Note: The current implementation method is relatively universal in theory. At least it tested OK on my Android 10, but it has not been fully tested in detail. Please evaluate it by yourself whether to use it.

byOpen related principles

The specific implementation principle is relatively simple. It mainly draws on the idea and implementation of a simple method to bypass Android P's restrictions on non-SDK interfaces.

Although the main purpose of this article is to bypass the hide api, the method used in it to disguise itself as a system call can also be used with System.loadLibrary to make the system think that the system itself is calling System.loadLibrary.

This bypasses the classloader-namespace restriction of Android N, loads any so library in the system/system/lib into maps, and then uses fake dlopen to dlsym.

byOpen interface usage

The relevant static libraries and interfaces are in: dlopen.h

The relevant usage methods are exactly the same as the native dlopen

typedef by_char_t const* (*curl_version_t)();

by_pointer_t handle = by_dlopen("libcurl.so", BY_RTLD_LAZY);

if(handle)

{

by_pointer_t addr = by_dlsym(handle, "curl_version");

if (addr)

{

curl_version_t curl_version = (curl_version_t)addr;

by_print("curl_version: %s", curl_version());

}

by_dlclose(handle);

}