Screen after Previous Screens: Spatial-Temporal Recreation of Android App...
summary
RetroScope reconstructs temporally ordered previous Android app screens from a single memory image by merging that image into a host emulator and driving the app’s own redraw code with a novel interleaved re‑execution engine. It is app‑agnostic, needs no passwords or app internals, and recovers 3–11 screens (avg 5–6) in evaluations. Reconstruction replays ~40k bytecodes and rebuilds ~150 Java objects and ~13k C/C++ structures per screen, and can reveal deleted messages and even a screen+1 preloaded while the app was backgrounded.
AI-written summary · about
chapters (5)
- 0:00Start
- 7:42Start the Symbiont App to host the memory image
- 8:33Initialize the Interleaved Re-Execution Engine (IRE)
- 9:45Redirect a redraw command to the Target
- 19:38Thank you! Questions?
related talks
21mReverse-Engineering apps on the device - how far can we go?
33mReverse - Engineering apps on the device - how far can we go?
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
29mEndoscope: Unpacking Android Apps with VM-Based Obfuscation
45mReverse engineering mobile apps: how, why, and what now?
50mQARK: Android App Exploit and SCA Tool
56mModern Android Hacking
29mA day in the life of a mobile reverse engineer