3 ms·

I hate malware. I found two Android apps using an obfuscator loaded via JNI (libjiagu_64.so) which crashes on startup (on GrapheneOS) and I am at a loss at what

I hate malware. I found two Android apps using an obfuscator loaded via JNI (libjiagu_64.so) which crashes on startup (on GrapheneOS) and I am at a loss at what to do next which doesn't involve send reports into the void hoping it reaches an human with the time, skills and willingness to check what is really going on. Summary: https://user934.com/2025/04/29/investigating-suspicious-behavior-in-savefamily-savefamilygps-and-the-libjiagu_64-so-library/ https://user934.com/2025/04/29/investigating-suspicious-beha...

Cloudef 1y ago
That sounds familiar, I used <https://github.com/Cloudef/android2gnulinux https://github.com/Cloudef/android2gnulinux> to reverse one libjiagu program in past. The deobfuscated code eventually ends up in the ram, and you can then extract it.
ThePowerOfFuet 1y ago
>Disclaimer: This blog post was written by Gemini, a large language model from Google AI, specifically the Gemini Pro model. My knowledge cutoff is June 2024. The information provided is based on my understanding and should not be taken as definitive professional advice. I encourage you to cease contributing to the enshittification of the web. Also, what did you expect from cheap no-name IoT shit? As we say, the S in IoT stands for Security...
- fifteen1506 1y ago
  I'm sorry I don't earn enough to hire a maid but still like to write blog posts :(
- fifteen1506 1y ago
  Ok I could have been less snarky. What I meant is, I have ideas I like to explore but a two-liner blog post won't entice anyone. For example on https://user934.com/2025/04/22/securing-home-and-smb-networks-dns-interception-blocklists-and-zero-trust-with-raspberry-pi/ https://user934.com/2025/04/22/securing-home-and-smb-network... I mix several ideas together and define the test plan (chapter 5), and let LLM fill in the blanks. Plus I clearly identify it as mostly written by LLM, which is better than most SEO garbage spam. So I think I've achieved a good compromise.
  - techbrovanguard 1y ago
    you’ve taken a slightly smaller shit on the floor than the seo slop factory next to you. do you want a medal?
    - fifteen1506 1y ago
      yes, you purist! :)

Cloudef 1y ago

That sounds familiar, I used <https://github.com/Cloudef/android2gnulinux https://github.com/Cloudef/android2gnulinux> to reverse one libjiagu program in past. The deobfuscated code eventually ends up in the ram, and you can then extract it.

ThePowerOfFuet 1y ago

>Disclaimer: This blog post was written by Gemini, a large language model from Google AI, specifically the Gemini Pro model. My knowledge cutoff is June 2024. The information provided is based on my understanding and should not be taken as definitive professional advice. I encourage you to cease contributing to the enshittification of the web. Also, what did you expect from cheap no-name IoT shit? As we say, the S in IoT stands for Security...

fifteen1506 1y ago
I'm sorry I don't earn enough to hire a maid but still like to write blog posts :(
fifteen1506 1y ago
Ok I could have been less snarky. What I meant is, I have ideas I like to explore but a two-liner blog post won't entice anyone. For example on https://user934.com/2025/04/22/securing-home-and-smb-networks-dns-interception-blocklists-and-zero-trust-with-raspberry-pi/ https://user934.com/2025/04/22/securing-home-and-smb-network... I mix several ideas together and define the test plan (chapter 5), and let LLM fill in the blanks. Plus I clearly identify it as mostly written by LLM, which is better than most SEO garbage spam. So I think I've achieved a good compromise.
- techbrovanguard 1y ago
  you’ve taken a slightly smaller shit on the floor than the seo slop factory next to you. do you want a medal?
  - fifteen1506 1y ago
    yes, you purist! :)