Secrets found in .so file (shared object file)

[xcypher78]

apkscan found RSA PRIVATE KEY in .so file how i can decompile .so file to check

[LucasFaudman]

Hey @xcypher78,

Thanks for the feedback.

In Android applications, a .so file (shared object file) typically contains compiled native code, often written in languages like C or C++. The purpose is to provide functionality that isn't easily achievable with standard Android SDK tools or to optimize performance-sensitive parts of an application.

Unfortunately, none of the decompilers APKscan currently supports, can handle .so files since they are most likely compiled C bytecode, and the current decompilers only work with Dalvik/Java bytecode.

As you've shown, you still can however scan these files for secrets since APKscan performs pattern matching on the file's bytes meaning it does not require readable strings to locate secrets.

What that means is that the RSA PRIVATE KEY pattern is found in your .so but'll need to take some additional steps to find it:

The simplest, but least effective method would be to try to just use strings and grep:

grep -A30 'BEGIN RSA PRIVATE KEY' <( strings /path/to/your/.so )

Note: the -A30 arg means show 30 lines after each match to try to find the whole key.

If this does not work, I'd suggest using a binary analysis tool such as:

• Radare2: An open-source software framework for reverse engineering and analyzing binaries. (My personal favorite tool for this purpose. )
• Ghidra: A free and open-source software reverse engineering tool developed by the NSA.
• IDA Pro: A commercial tool for disassembly, decompilation, and reverse engineering.

[LucasFaudman]

Also @xcypher78 just FYI if your .so is any of the following it is most likely a false positive:

• libflutter.so
• libhydra.so
• libopenvpn.so
• libovpncli.so

I'm going to close this issue for now since APKscan is working as expected, but thanks again for your feedback, I'm going to consider how to add support for this in future updates. Take care.

[xcypher78]

The file is libapp.so and thanks for your information Lucas