Breaking the Android ClassLoader
summary
Demonstrates hijacking an app's class loading at runtime by reflectively replacing class loader fields and constructing loaders from APK paths or packaged dex bytes, implemented as the Black Mirror tool and published on GitHub at hswearblackmirror. Uses Android's PathClassLoader and hidden constructor taking assets/raw dex buffers to load classes, read BuildConfig values, invoke Retrofit interfaces and even POST an image through a neighbor app's API. Works on many devices including Pixel, but Samsung models block fields and Android P closes some reflective paths.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:56ClassLoader delegation model
- 3:47Android ClassLoader specifics
- 5:09Friday night hacking story
- 8:16Reflection and PathClassLoader
- 12:52BlackMirror project setup
- 14:57Interceptors for class loading
- 16:01Widget replacement attempt
- 18:27Loading code from assets
- 20:33Loading code from resources
- 21:36Running neighbor app code
- 23:43Extracting BuildConfig secrets
- 26:37Calling neighbor API methods
- 28:23Play Services and security
- 29:05Decompiler apps like Show Java
- 30:08Android P limitations
- 31:10Ethical considerations
related talks
32mBreaking the Android ClassLoader
33mReverse - Engineering apps on the device - how far can we go?
29mMy Other ClassLoader is Your ClassLoader Reloaded: Reviving Parcelable Objects
53mAndroid: He protec, but he also attac
48mA Novel Runtime Technique For Identifying Malicious Applications
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
33mWe Can Still Crack You! General Unpacking Method For Android Packer (no Root)
28mSecure Development whit Android