Laurie Kirk: Runtime Manipulation in Android to Evade Analysis
A DEF CON 31 talk on a new Android obfuscation technique — runtime manipulation. This approach alters an app’s behavior during execution, disrupting normal control flow and making analysis with decompilers and emulators more difficult.
The talk explains how to identify suitable injection points in Android code and implement such techniques in C++, intercepting Java methods via JNI and treating them as pointers. This enables hiding DEX loading traces and breaking cross-reference analysis in reverse engineering tools.
It also introduces a custom library for Android 13, allowing researchers to experiment with runtime manipulation and modify internal Java object structures.
The talk explains how to identify suitable injection points in Android code and implement such techniques in C++, intercepting Java methods via JNI and treating them as pointers. This enables hiding DEX loading traces and breaking cross-reference analysis in reverse engineering tools.
It also introduces a custom library for Android 13, allowing researchers to experiment with runtime manipulation and modify internal Java object structures.