Extracts dlls from libmonodroid_bundle_app.so

app.py

from elftools.elf.elffile import ELFFile
from zipfile import ZipFile
import gzip, string
from io import StringIO, BytesIO

data = open('libmonodroid_bundle_app.so', "rb")
elffile = ELFFile(data)
section = elffile.get_section_by_name('.dynsym')
data.seek(0)
data_read = data.read()

for symbol in section.iter_symbols():
  if symbol['st_shndx'] != 'SHN_UNDEF' and symbol.name.startswith('assembly_data_'):
    print(symbol.name)
    dll_data = data_read[symbol['st_value']:symbol['st_value']+symbol['st_size']]
    dll_data = gzip.GzipFile(fileobj=BytesIO(dll_data)).read()
    outfile = open(symbol.name[14:].replace('_dll', '.dll'), 'wb')
    outfile.write(dll_data)
    outfile.close()

dependencies.md

Make sure to install these python 3 packages:

pip install pyelftools
pip install yara-python