https://Avev.github.io/posts/Recent content in Posts on AvevHugoenThu, 11 Jun 2026 00:00:00 +0300https://Avev.github.io/posts/hooking_.init_array_functions/Thu, 11 Jun 2026 00:00:00 +0300https://Avev.github.io/posts/hooking_.init_array_functions/<p>Many advanced Android apps hide their anti-tampering and anti-analysis checks inside the <code>.init_array</code>. If you try to attach Frida normally, these checks run and kill the app before your script even loads.</p> <p>Here is how to deal with them.</p> <h3 id="what-is-init_array">What is <code>.init_array</code>?</h3> <p>Simply put: <code>.init_array</code> is a section inside an ELF binary (<code>.so</code> file) that contains an array of function pointers.</p> <p>The Android dynamic linker executes these functions <strong>extremely early</strong>—right when <code>System.loadLibrary()</code> is called, and long before <code>JNI_OnLoad</code> fires. Because it executes so early in the native lifecycle, it&rsquo;s a prime spot for developers to hide early anti-tampering mechanisms.</p>