IDA Split APK Debugging

An IDA plugin that restores segment names and rebasing when you debug native libraries loaded from a split APK.

When an app loads its native code the normal way, IDA recognizes the module in the debuggee's memory map and offers to rebase the database to it. With split APKs it doesn't. Every mapping that came out of split_config.<abi>.apk is named after the parent APK, so the Segments window gives you a wall of identically named entries and no rebase prompt:

Without that rebase, your breakpoints are silently dropped the moment you resume, because the database isn't mapped where the library actually lives. Picking the right segment by hand works, but it is slow, and you get to redo it every time the process dies.

This plugin does it for you: it reads the .so files out of the APK you point it at, fingerprints them, finds the matching regions in the live process, renames them to the real library names, and offers to rebase the database when the file you have open is one of them.

Requirements

• A rooted device (the debug server needs root to attach).
• platform-tools, preferably on your PATH.
• pyelftools, installed into the Python interpreter IDA uses (the one selected by idapyswitch, not necessarily your system Python):

  pip install pyelftools

Install

git clone https://github.com/ccc909/IDASplitApkDebugging.git

Copy segment_names.py into your .../IDAPRO/plugins folder and restart IDA.

Set up the debug session

The plugin works on a live process, so get debugging first.

1. Find the IDA debug server shipped in .../IDAPRO/dbgsrv: android_server for 64-bit (arm64-v8a) targets, android_server32 for 32-bit (armeabi-v7a) ones. Push it to the device:

   adb push ./android_server /data/local/tmp

2. Load the library you want to debug in IDA.
3. Press F9 and select the Remote ARM Linux/Android debugger.
4. Open Debugger → Process Options, set the hostname to localhost, and note the port.
5. Start the server on the device:

   adb shell
   su
   cd /data/local/tmp
   chmod 755 ./android_server
   ./android_server

6. Forward the port so IDA can reach it:

   adb forward tcp:<your_port_from_ida> tcp:<your_port_from_ida>

7. Start the target process on the device, then attach to it from IDA's process list.

At this point you are attached, but breakpoints still won't survive a resume. That is what the plugin fixes.

Run the plugin

With the process attached and paused, run the plugin from Edit → Plugins → APK segment renamer + rebasing, or press Ctrl+Alt+A.

You'll be asked to pick an APK. Select the split that actually contains the native libraries, usually split_config.arm64_v8a.apk or split_config.armeabi_v7a.apk, not base.apk. If you don't have the splits on hand, list and pull them:

adb shell pm path <package.name>

adb pull /data/app/.../split_config.arm64_v8a.apk

Every library that matches gets its segments renamed (refresh the Segments window to see the change), and if the file currently open in IDA is one of the matches, you'll be offered a rebase to its live load base. Progress and per-segment renames are logged to the Output window with an APKRenamer: prefix.

How the matching works

Knowing this mostly helps you pick the right APK and read the log when nothing matches.

For each .so under lib/arm*/ in the APK, the plugin hashes the first page of the executable, non-writable PT_LOAD segment, which is the same page the Android loader maps into memory. It then hashes the first page of every debugger segment and looks for hits. When a library carries a mapped GNU build-id, that ID is read back out of process memory and compared as confirmation; matches confirmed this way are marked in the log.

Matched libraries have all of their PT_LOAD segments renamed to <libname>_code and <libname>_data, numbered when a library has more than one of a kind. Rebasing is offered only when a matched library's file name is exactly the name of the file open in IDA, so base.so will never rebase you onto database.so.

Two consequences worth knowing: only ARM ABIs are scanned, so x86 and x86_64 splits are skipped, and libraries under 4 KB are ignored.

Troubleshooting

If IDA crashes during the rebase, turn off analysis before running the plugin and try again.

If nothing matches, check the Output window. The usual cause is the wrong APK: the library lives in a different split from the one you selected.

Contributing

If you hit a problem or have a feature in mind, please open an issue. And if this saved you some time, a star on the repo is appreciated.