Skip to content

No surefire way to bypass linker namespaces on Android 7.0 Nougat #2

@Chainfire

Description

@Chainfire

Linker namespace were introduced in Android 7.0 Nougat. The linker prevents libraries from outside of the namespace-permitted paths to be loaded into a binary.

There are a couple of ways to bypass linker namespaces, one is setting LD_LIBRARY_PATH before executing the binary that is being injected. That is not always a workable solution, though.

From Android 8.0 onwards, linker namespaces are relaxed for libraries loaded from tmpfs, so on 8.0+ we can simply move the library to be injected to /dev, but this still does not always leave us with an option for 7.0.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions