Detecting Android Root Exploits by Learning from Root Providers
summary
RootExplorer learns environment checks from one‑click root apps and uses that to craft analysis targets: it extracts 167 exploit binaries (from 59 exploit families), builds a custom symbolic execution pipeline and an online kernel module plus userland service, synthesizes syscall return values and device files, and runs apps in emulators with 10‑minute UI fuzzing. The system triggers every known PoC/root exploit in tests (100% detection), reports no false positives, and uncovers real market apps with embedded root exploits.
AI-written summary · about
chapters (10)
- 0:00Android security challenges
- 2:59Kernel-level exploit threats
- 4:37The problem of customization
- 6:42Proposed solution approach
- 9:15Leveraging one-click apps
- 11:59Root explorer system design
- 14:21Symbolic execution for input
- 19:15Experimental setup
- 21:44Evaluation results
- 25:00Conclusion and Q&A
related talks
31mAll your Root Checks Belong To Us: The Sad State of Root Detection
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
40mAndroid Rootkits: Analysis from Userland and Kernelland
53mAndroid: He protec, but he also attac
33mWhen Attackers Go Mobile-First with AI
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
41mRoot: a stranger at home?
29mA day in the life of a mobile reverse engineer