Breaking the Android ClassLoader
summary
A reflective exploit replaces the app's ClassLoader by setting the LoadedApk/packageInfo mClassLoader and installs a custom PathClassLoader called Black Mirror that logs and times loads, intercepts or short‑circuits class requests, and even loads packaged DEX from assets or other apps' APKs. A quick grep shows 664 usages of ClassLoader sites to consider. Prototype works on many devices (except some Samsung models) but breaks when targeting Android P / SDK 28 due to new private API restrictions.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:20Dont do this
- 1:05ClassLoader
- 2:32What happens at runtime
- 3:50What is Android ClassLoader
- 6:48What is the project about
- 7:41Where is classloader used
- 8:09Path classloader
- 14:09Black mirror class
- 16:18Init provider
- 17:59Time interceptor demo
- 20:50Using proxies
- 21:30Returning fake classes
- 22:26Package in
- 23:26Assets Helper
- 25:21Neighbor API
- 26:43BillConfig
- 28:27Play Services
related talks
33mBreaking the Android ClassLoader
29mMy Other ClassLoader is Your ClassLoader Reloaded: Reviving Parcelable Objects
47mAttacking Android Applications
53mAndroid: He protec, but he also attac
48mA Novel Runtime Technique For Identifying Malicious Applications
33mReverse - Engineering apps on the device - how far can we go?
40mAndroid Rootkits: Analysis from Userland and Kernelland
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps