Android Rootkits: Analysis from Userland and Kernelland
summary
Tooling and results: a userland rootkit uses LD_PRELOAD to hide an app icon and a .so loaded from /data; the team builds Smart Alec (Frida-based) to capture pre/post states, diff modules, and dump offending .so for reversing; live acquisition uses Frida + LiME to stream RAM (2 GB emulator) and Volatility profiles to parse dumps; an automated LiME/kernel builder and a memory forensics workbench produce a knowledge graph with ~625 nodes to trace LD_PRELOAD, ptrace, syscall hooks and DKOM-based hiding.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:12Scope of the talk
- 2:29Userland rootkit demo
- 5:04Analysis approach
- 7:44SmartAlec tool demo
- 11:56Infection and dump
- 15:34Analysis and tool output
- 18:30Kernel analysis overview
- 22:15Knowledge graph integration
- 25:21Ptrace-based rootkits
- 27:46Syscall table hooking
- 28:55Graph-based visualization
- 32:10Automation and workbench
- 34:32Final demos and conclusion
related talks
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
53mAndroid: He protec, but he also attac
31mAll your Root Checks Belong To Us: The Sad State of Root Detection
53mHiding Behind Android Runtime (ART)
43m"A rootkits writer’s guide to defense"
29mA day in the life of a mobile reverse engineer
27mDetecting Android Root Exploits by Learning from Root Providers
47mAttacking Android Applications