Runtime Riddles: Abusing Manipulation Points in the Android Source
Laurie Kirk unveils runtime manipulation techniques in native C++ via JNI to alter Android execution flow, defeating emulators and decompilers.
Summary
The Limitations of Static DEX Obfuscation
Traditional Android malware packing and DEX class encryption techniques are increasingly ineffective against modern dynamic analysis sandboxes and automated unpacking tools.
Identifying Runtime Manipulation Points in Android Source
Laurie Kirk details a methodology for locating execution manipulation targets within the Android Open Source Project (AOSP) framework and ART runtime.
Manipulating Java Structures via Native C++ JNI
Hooking Java methods through the Java Native Interface (JNI) and casting method pointers in native memory allows manipulating execution flow without triggering standard ClassLoader hooks.
Breaking Decompiler Cross-References on Android 13
The author releases a custom library targeting Android 13 devices, demonstrating how runtime structure manipulation completely breaks cross-reference calculation in tools like Ghidra and JADX.
Related talks
Main Stage·47 min
Hugo Gonzalez · Caleb Howell
Deconstructs the anti-cheat and runtime integrity mechanisms in Pokemon Go, demonstrating mobile reverse engineering and integrity bypass tradecraft.
Main Stage·39 min
Agostino Panico
Presents a dynamic analysis framework for automatically unpacking and deobfuscating nested virtual-machine-based software protectors used in advanced malware.
Main Stage·47 min
Patrick Wardle
Patrick Wardle dissects macOS Ventura's Background Task Management architecture, releasing open-source tooling while demonstrating trivial evasion techniques.