Fuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android
summary
Describes a practical fuzzing recipe that targets core Android components — Stagefright, mediaserver, installd, dex2oat/ART — using a toolchain (BFF based on Zuzu, fuzbox, Redamza, and an Android port of AFL), an automated triage that parses tombstones and program counters, and reproduction steps that rebuild APKs or run dex2oat. Results include thousands of crashes on small device clusters, dozens of unique bugs, and 6 CVE entries released by Google.
AI-written summary · about
chapters (23)
- 0:00Introduction to Android Fuzzing
- 1:19Fuzzing Methods and Monitoring
- 2:35Mutational vs Generation Fuzzing
- 3:44Fuzzing Toolset Overview
- 5:04Real-time Monitoring in Android
- 6:22Reproducing Crashes
- 8:03Triage Mechanism and Automation
- 9:20Triage Implementation Details
- 11:19Analyzing Crash Reports
- 12:46Debugging with Source Symbols
- 15:06Target: Stagefright Framework
- 16:49Stagefright Testing Process
- 20:26Stagefright Project Results
- 21:40Target: Application Installer
- 23:00Installer Testing Approaches
- 25:34Fuzzing APK Components
- 29:08Direct Fuzzing of Dex Files
- 30:52Dex File Validation Challenges
- 33:06Dex Fuzzing and Results
- 37:07Alternative Approach: AFL
- 38:26AFL on Android Prerequisites
- 41:00AFL and Custom Fuzzer Hybrid
- 43:35Conclusions and Future Work
related talks
20mD2T2 - A New Fuzzing Method for Android
53mDIFUZE: Android Kernel Driver Fuzzing
35mHey, Your Parcel Looks Bad - Fuzzing and Exploiting Parcel -Ization Vulnerabilties in Android
43mAttacking Android Applications
38mBuilding an Assurance and Secure Development Program
13mFully Automated Functional Fuzzing of Android Apps for Detecting Non-Crashing Logic Bugs
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug
48mMastering Android Security Research: A Guide for the Modern Security Researcher