Android on Security Notes

Android on Security Notes https://blog.omiilgo.com/tags/android/ Recent content in Android on Security Notes Hugo en-us Sat, 04 Jan 2025 10:00:00 +0800 NDK .so Session: readelf, llvm-objdump -d, JNI_OnLoad https://blog.omiilgo.com/posts/android-native-library-re-notes/ Sat, 04 Jan 2025 10:00:00 +0800 https://blog.omiilgo.com/posts/android-native-library-re-notes/ One lab APK, one arm64-v8a .so. file/readelf/llvm-objdump through JNI_OnLoad, Java_* exports, GetStringUTFChars, a 32-byte stack copy, tombstone and ASAN. Frida logs length and prefix only. Android Kernel LPE Classes, at Invariant Level, Plus a Userspace TOCTOU Lab https://blog.omiilgo.com/posts/android-kernel-lpe-classes/ Thu, 20 Jun 2024 10:00:00 +0800 https://blog.omiilgo.com/posts/android-kernel-lpe-classes/ Futex, perf_event, and get_user-era Android kernel LPE classes as broken invariants. No kernel exploit code. A toy C file-TOCTOU analog, a planted strcpy, ASAN output. AIDL Lab Service: Parcel Layout and Native onTransact https://blog.omiilgo.com/posts/android-binder-parcel-reversing/ Fri, 16 Feb 2024 09:00:00 +0800 https://blog.omiilgo.com/posts/android-binder-parcel-reversing/ Self-built AIDL service com.lab.binder. dumpsys and logcat Binder, Parcel bytes for writeInterfaceToken + int + string, ARM64 BnEcho::onTransact. No privilege escalation. Frida: Java Wrapper vs JNI Interceptor on the Same Call https://blog.omiilgo.com/posts/android-frida-jni-trace-lab/ Mon, 04 Sep 2023 11:00:00 +0800 https://blog.omiilgo.com/posts/android-frida-jni-trace-lab/ Lab APK com.lab.jni.trace. Hook NativeBridge.nInit in Java.perform and the Java_* export with Interceptor.attach, then compare argument length and prefix. Console output redacted. apktool Smali: if-eqz Chains That Want to Be a switch https://blog.omiilgo.com/posts/android-smali-control-flow-notes/ Tue, 08 Nov 2022 14:00:00 +0800 https://blog.omiilgo.com/posts/android-smali-control-flow-notes/ Lab APK with packed-looking if-eqz obfuscation around a 5-way dispatch. apktool smali, jadx Java, reconstruct a packed-switch, plus a planted stack copy crash. Not a commercial packer unpack. Finding Hidden JNI Methods: RegisterNatives in a Lab APK https://blog.omiilgo.com/posts/android-jni-registernatives-lab/ Wed, 09 Jun 2021 14:10:00 +0800 https://blog.omiilgo.com/posts/android-jni-registernatives-lab/ APK where nm -D shows no Java_* exports. Walk JNI_OnLoad, recover the JNINativeMethod table, map Java names to ARM64 IMPs, Frida-trace the native with arguments redacted. JNI_OnLoad vs Java_* Name Mangling on a Lab APK https://blog.omiilgo.com/posts/android-jni-onload-name-mangling/ Mon, 02 Dec 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/android-jni-onload-name-mangling/ Self-built APK where javah-style Java_com_lab_onload_Bridge_* exports sit next to a RegisterNatives table. readelf -s, ARM64 JNIEnv GetObjectClass, crash on an unbounded UTF copy.