Abstract

This course has as goal to provide students with relevant information and practical techniques to perform security research on Android devices.

Through this training we will review key topics such as Android architecture, security and memory management. Afterwards, student will learn Binder, Storage and Connectivity stacks, followed by a brief ARM64 review. At the next part of training students will review static and dynamic analysis foundations, learn how to use dynamic instrumentation and Android debugging. Finally, the the class reach to your main goal that is to explain on vulnerability research and and show details about exploitation on Android.

This class focuses on Android malware and associated devices.

Who Should Attend

This class should be attended by professionals interested in learning Android security research as well as professionals who want to expand their current knowledge on Android internals and reverse engineering. Class attendees from different areas such as programming, exploit development, malware analysis, incident response, threat hunting, pentesting and cyber defense will enjoy and benefit from this training.

Key Learning Objectives

This class has the following goals:

  • Explain how to build an infrastructure for Android research.
  • Explain Android foundation.
  • Review Android architecture.
  • Review Android security.
  • Explain Binder, Storage and Connectivity stack.
  • Explain Linux kernel for Android.
  • Explain Android vulnerability classes.
  • Explain exploitation techniques.
  • Explain Android exploitation.

Prerequisite Knowledge

Students should be have:

  • Previous experience in reverse engineering or malware analysis area.
  • Daily experience on Android devices.
  • Previous experience programming might be useful.
  • Basic experience with debuggers and disassemblers such as IDA Pro might be useful.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation or Hyper-V (with WSL) installed on the system.
  • IDA Pro or IDA Free.
  • A virtual machine running Ubuntu 24.04+.
  • (optional) A Android phone might be help, but is not strictly required.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

  • Introduction.
  • Building the Android research infrastructure.
  • Android system architecture.
  • Linux kernel architecture for Android.
  • Memory management on Android.
  • Binder, Storage and Connectivity stacks.
  • Android Static Analysis.
  • Android Dynamic Analysis.
  • Dynamic Instrumentation.
  • Android Debugging.
  • Brief about hardware-related stuff.
  • Vulnerability classes on Android
  • Finding and checking vulnerabilities on Android.
  • Android Exploitation.

Note: Topics can be added, merged or removed without prior notice!