Hiding Behind Android Runtime (ART)
summary
Claim: Android Runtime (ART) can host a user-mode rootkit by editing framework or app bytecode, regenerating oat files with dex2oat, and patching dex file location and checksum in the resulting oat/boot.art. The attack replaces framework.jar or a target APK, needs root to write dalvik-cache, and persists until OTA/app recompile; Google Nexus/Lollipop (Android 5.x) is shown. Demo hides a malicious APK from Settings’ installed-apps and running-process lists by removing entries from getInstalledApplications/getRunningAppProcesses.
AI-written summary · about
chapters (11)
- 0:00Introduction to Art Rootkits
- 2:29Art Architecture Overview
- 7:15Understanding Art File Formats
- 10:45Parsing the Oat File Format
- 13:30Deeper Look into Oat Headers
- 16:52Method Compilation and Offsets
- 22:31User-Mode Rootkit Approach
- 26:16Framework Code Modification
- 36:07Replacing Specific App Code
- 44:03Rootkit Demonstration
- 48:05Conclusion and Q&A
related talks
15mExploiting Android Apps with Counterfeit Art
48mA Novel Runtime Technique For Identifying Malicious Applications
40mAndroid Rootkits: Analysis from Userland and Kernelland
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
38mAdvanced Techniques for Protecting Android Apps
43mSecurity in Android Applications
53mAndroid: He protec, but he also attac
47mAttacking Android Applications