Kernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections
summary
Claim: modifying the Android kernel lets RASP checks be intercepted and falsified. Implements a custom ohas driver and either direct syscall table hooking or ftrace/kprobe/eBPF techniques, cross‑compiled into a OnePlus 6 Android 13 boot image. Tests show open faccess read bind connect interceptions and checksum spoofing defeat several RASP protections and Frida/Freda detection with negligible perf hit, but stability risks and device‑specific build steps remain and universal guarantees are limited to tested apps.
AI-written summary · about
chapters (12)
- 0:00Kernel Alchemy intro
- 3:57Android kernel & CIS calls
- 11:02RASP detection challenges
- 13:15Kernel driver setup
- 16:26Evasion techniques for RASP
- 20:09Custom driver code & compile
- 26:20Driver build & testing
- 28:47Evasion validation & impact
- 30:33Future RASP evasion limits
- 31:56Open-source resources
- 33:22Freda Gadget bypass
- 34:15Q&A
related talks
41mPrison Break Season 6: Defeating the Mitigations Adopted by Android OEMs
42mAndroid: Protecting the Kernel
53mAndroid: He protec, but he also attac
35mKSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features
42mD1T2 - Rooting Android 8 with a Kernel Space Mirroring Attack
15mExploiting Android Apps with Counterfeit Art
36mPhysical Attacks Against Smartphones
47mAdaptive Kernel Live Patching: An Open Collaborative Effort...