Lost In Memory

Prerequisites & Requirements

• Android Variable Scope & Lifecycle:
  • Understanding the difference between local variables and Class Fields (Instance Variables) .
  • Knowing that the onCreate method is the entry point for Activities where variables are often initialized.
• Frida JavaScript API (Intermediate):
  • Beyond basic method hooking, you need to know how to access Fields of a class instance.
  • Understanding the syntax difference between calling a function ( e.g ., this.method ()) and reading a variable ( e.g ., this.field.value ).
• JNI (Java Native Interface) Basics:
  • Recognizing that some data is generated in C/C++ layers (native-lib) and passed to the Java layer, making static analysis of the Java code insufficient for finding the actual value.

What will you learn?

• Runtime Memory Inspection:
  • Learning how to "freeze" the application state (by hooking onCreate) to peek into memory before the app creates the UI or encrypts the data.
  • Extracting values that are generated dynamically and stored in memory, rather than trying to reverse the generation logic itself.
• Frida Field Access:
  • Mastering the specific Frida syntax for reading instance variables. You will learn that while methods are called directly, fields must be accessed via the .value property ( e.g ., this.xorKey.value ).
• Hybrid Execution Flow:
  • Combining the execution of the original code ( this.onCreate (bundle)) with custom logic to dump internal state (logging the xorKey and the result of stringFromJNI) without crashing the application.

Tools

• JADX (Dex to Java Decompiler):
  • Used for Static Analysis . It allows you to identify the class name ( com.titoot.lostinmemory.MainActivity ) and the specific field names (xorKey, flag) that hold the sensitive data. It also reveals that the logic relies on a native library, hinting that dynamic analysis is a faster route than static reversing.
• Frida:
  • Used for Dynamic Instrumentation .
  • It allows you to attach to the running process and inject a JavaScript payload.