Dive deep into the intricacies of Android Runtime (ART) for dynamic binary analysis in this conference talk from Nullcon 2021. Explore how Google has evolved ART with each Android release to optimize app performance, storage usage, and system updates. Learn about profile-guided and cloud profile optimizations based on user behavior, and understand how ART interprets and executes different code types. Discover techniques for stealing real-time information from executing apps by modifying ART, including smali code, interfaces, parameters, return values, fields, and stack traces. Gain insights into analyzing apps without accessing execution code using decompilers or disassemblers. Follow along as security researcher SungHyoun Song breaks down ART's structure, operation, and potential vulnerabilities in Android 10.
Overview
Syllabus
Introduction
Why ART
Profile Guide Optimization
Compile and Execute
Code Weber
Code Execution
Stacktrace
Demo
Conclusion
Taught by
nullcon