DEF CON 31 - Runtime Riddles - Abusing Manipulation Points in the Android Source - Laurie Kirk

Android malware creators constantly struggle to devise innovative methods to obscure apps and impede reverse engineering. As numerous standard techniques have lost efficacy, I'll unveil the next frontier in Android obfuscation: runtime manipulation. Runtime manipulation alters standard application flow-of-control to bypass decompilers and emulators.

In this talk, I'll reveal my strategy for pinpointing manipulation targets in Android's source code. I will describe how I craft manipulators in native C++ once a suitable target has been located. This is accomplished by hooking Java methods via the Java Native Interface (JNI) and typecasting the handle to a C-style pointer. Runtime manipulation can entirely remove traces of ClassLoader calls which are unavoidable for standard Dalvik Executable (DEX) packing, but are also easily discovered and hooked. This technique also effectively breaks cross-reference calculations within all Android decompilers.

I will demonstrate and equip attendees with a custom Android library for devices running Android 13, providing a new tool that enables runtime manipulation experimentation. In addition, I'll demonstrate my methodology for pinpointing Java targets and modifying their underlying native data structures.

[dertyp]

Wait. Her surname isn't "wired" like in her youtube channel :O

[kkiller]

In the machine code hex at 29:16, I think the nibbles in each byte are backwards: if you swap the nibbles in 24 00 e0 you get 42 00 0e. The 0x2000 value is in there with a 4-bit offset.

[Aplysia]

Android developers: "Sure, you can shoot yourself in the foot by modifying what android apis do within your own program."

Obfuscators: "Shoot myself in the foot ... like a fox! "

[kkiller]

Her day job at Microsoft must be pretty gratifying if it is anything like the work that she did for reverse engineering this exploit.

[deckardpegasus]

Was it ever explained how a sandboxes app without root access is overwriting ART memory? And if the app has root access, what is the point of this talk? Also the code assembly code shown was x86, not ARM, so this is x86 Android?

[HyperVectra]

She talks like El Woods and is smart AF like El Woods

[SkyHighBeyondReach]

Thanks these videos were incredibly helpful

[ciCCapROSTi]

I must say, on her channel you can pretend she is just reading a script or something, but here you have to conciliate the cute and the expert, and it's not easy! I'm happy to do it, but it's a task.

[zetopr]

Very cool, like lain she is a tech god

[rigen]

a somewhat "legitimate" application for this is for anti-cheat system, where you can swap out and/or "reinforce" function pointers at runtime to prevent cheat software from finding or modifying them.

somewhat ironic, though, that an incredibly unsafe memory modification is used to prevent unsafe memory modification lol

[drdr]

Real life software hacking and exploitation. She's gorgeous and smart.

[nicolasfiore]

She's so f-ing perfect. I wish I could find a girlfriend like her. 😢