SoTap Lightweight in-app JNI (.so) behavior logger for Andro...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/RezaArbabBot/SoTap
• Blog Title: SoTap: Lightweight in-app JNI (.so) behavior logger for Android
• Suggested Section: Generic Methodologies & Resources > Basic Forensic Methodology > Malware Analysis

🎯 Content Summary

SoTap: Android Native Telemetry Library

SoTap is a lightweight Android native (.so) library that logs the runtime behavior of other JNI (.so) libraries within the same app process. It is designed to aid reverse engineering and dynamic analysis by providing in-app native telemetry without root.

What It Does

• Automatically logs activity of JNI-loaded libraries as soon as it is preloaded in the target app.
• Writes logs to multiple ...

  🔧 Technical Details

  Early JNI instrumentation via preloading: Insert System.loadLibrary("sotap") early (e.g., static initializer) so the logger initializes before other JNI libs. This ensures subsequent native loads and interactions are observable from process start.

  Resilient logging with multi-path fallback: Write logs to app-internal paths first, then external paths; if all fail due to sandbox/permissions, fall back to Logcat. This pattern guarantees telemetry even under restrictive storage conditions.

  ABI-aligned deployment: Always deploy the ABI-matching build (arm64-v8a, armeabi-v7a) so the loader can resolve libsotap.so and avoid UnsatisfiedLinkError, ensuring the instrumentation is active.

  🤖 Agent Actions

  I explored HackTricks to find the best place for SoTap-related content and confirmed there is no existing coverage of process-local, no-root JNI telemetry via preloaded .so. This technique is most relevant to Android native reversing/dynamic analysis, with secondary relevance to malware analysis. I updated existing pages accordingly (no new pages created):

  What I updated

  1. src/mobile-pentesting/android-app-pentesting/reversing-native-libraries.md
  • Added a new section: “Process-local JNI telemetry via preloaded .so (SoTap)”
    • What SoTap is, why it helps (no root, process-local logging), and how it works
    • Setup steps: ABI-aligned deployment, ensuring early load via System.loadLibrary, repack/sign/install workflow
    • Smali snippet for early loading
    • Full log path fallback list with Logcat fallback
    • Notes on troubleshooting (ABI mismatch, storage constraints) and source customization (sotap.c)
  • Updated References with:
    • SoTap repo
    • SoTap releases
    • “How to work with SoTap?” guide
  2. src/mobile-pentesting/android-app-pentesting/smali-changes.md
  • Added a subsection: “Loading a Native Library at Startup (System.loadLibrary)”
    • Smali examples to load library in and in Application.onCreate
    • Notes on ABI correctness and loading order
  • Added a “References” section with SoTap link at the bottom
  3. src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md
  • Added a short subsection: “Android in-app native telemetry (no root)”
    • Describes using a preloaded .so logger (SoTap) to collect JNI/native logs without root
    • Cross-references the Android reversing page for setup/log paths using:
      {{#ref}}
      ../../../mobile-pentesting/android-app-pentesting/reversing-native-libraries.md
      {{#endref}}
  • Updated References to include the SoTap repo

  Why these locations

  • The technique is primarily an Android dynamic analysis/reversing trick; the best fit is under Android native reversing. The smali modifications page is the right place to teach how to insert System.loadLibrary for early init. The malware analysis page benefits from a concise pointer for analysts, with a ref to the Android reversing page for operational details.

  References added

  • https://github.com/RezaArbabBot/SoTap
  • https://github.com/RezaArbabBot/SoTap/releases
  • https://t.me/ForYouTillEnd/13

  No other existing HackTricks content covered this lightweight, no-root, in-app JNI telemetry approach, so these additions fill that gap.

  ---

  This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

  🗑️ File Cleanup

  • searchindex.js removed: This auto-generated file has been removed to prevent conflicts.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/RezaArbabBot/SoTap

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Basic Forensic Methodology > Malware Analysis".

Repository Maintenance:

• MD Files Formatting: 878 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0