Native Security, Exploitation & Advanced Analysis - Advanced

1. 01

   Module 1: Threat Modeling & Runtime Attack Surface Methodology

   5 topics

   • Systematic attack surface mapping in Android applications
   • Differentiating Java, native, IPC, and runtime attack layers
   • Identifying where critical controls reside (Java, native, VM)
   • Chained reasoning: input → primitive → impact
   • Risk prioritization and exploit chain modeling
2. 02

   Module 2: Real-World Runtime Attack Vectors

   4 topics

   • Logic flaws and state manipulation attacks
   • In-memory tampering and runtime state modification (conceptual)
   • IPC / exported component abuse and chained exploitation scenarios
   • Cross-platform attack surfaces (Flutter / React Native boundaries)
3. 03

   Module 3: Runtime Security Mechanisms (System-Level)

   6 topics

   • Process injection vectors (attach / load / patch)
   • Dynamic library loading behavior and implications
   • Memory mapping and remapping techniques
   • Runtime code modification concepts
   • Observable syscall-level signals
   • Limitations of tool-based protection approaches
4. 04

   Module 4: Injection & Instrumentation Detection

   5 topics

   • Classification of runtime injection vectors
   • The role of ptrace and tracing mechanisms (high-level)
   • Practical impact of seccomp and restriction mechanisms
   • Kernel/userland observable security signals
   • Detection design: signal → decision → response model
5. 05

   Module 5: Exploitation Concepts for Mobile Platforms

   5 topics

   • The concept of exploitation in Android threat models
   • Classification of memory corruption types
   • Userland vs kernel exploit differences (impact perspective)
   • Exploitability assessment methodology
   • Proof-of-concept mindset and structured evaluation
6. 06

   Module 6: ASLR & Modern Mitigations

   5 topics

   • ASLR implementation in Android
   • Userland vs kernel ASLR
   • The role of information leaks in exploit chains
   • Why ASLR alone is insufficient
   • Evaluating mitigations as a combined defense strategy
7. 07

   Module 7: ARM64 Runtime Perspective

   4 topics

   • ARM64 calling convention analysis
   • Stack and heap behavior from a runtime perspective
   • ROP concepts in a mobile context
   • Limitations of modern mitigations (high-level)
8. 08

   Module 8: VM-Based Obfuscation Fundamentals

   5 topics

   • Virtual machine-based obfuscation architectures
   • Stack-based vs register-based VM designs
   • Dispatcher and handler analysis methodology
   • Security objectives and trade-offs of VM-based protection
   • Practical limitations of VM-based obfuscation
9. 09

   Module 9: VM Devirtualization Methodology

   6 topics

   • Encrypted bytecode analysis workflow
   • Runtime extraction methodology
   • Modeling opcode generation logic
   • Handler mapping strategies
   • Control flow reconstruction techniques
   • Automation approaches in VM analysis
10. 10

    Module 10: Kernel, SELinux & TrustZone

    5 topics

    • Android kernel architecture and security boundaries
    • SELinux enforcing mode analysis
    • Kernel ↔ userland separation model
    • ARM TrustZone architecture and its role
    • Why certain controls are moved to kernel or TEE layers
11. 11

    Module 11: Binder IPC Deep Dive

    5 topics

    • Binder IPC architecture (kernel perspective)
    • Role of the Binder driver
    • IPC-based attack surface analysis
    • Privilege escalation concepts (high-level)
    • Binder risk modeling methodology
12. 12

    Module 12: Real-World Protection Failures & Design Pitfalls

    4 topics

    • Common root / anti-debug design mistakes
    • Anti-hook and anti-instrumentation misconfigurations
    • Overestimated but weak protection strategies
    • The importance of measurable security signals and telemetry
13. 13

    Module 13: Advanced Protection Analysis & Breaking Workshop

    7 topics

    • Runtime protection analysis case study
    • Injection & instrumentation detection evaluation lab
    • Integrity verification bypass scenario
    • VM-based protection analysis exercise
    • Script-assisted devirtualization workflow automation
    • Multi-layer protection evaluation strategy
    • Large-scale protection analysis methodology

Learning Outcomes

By the end of this package, participants will:

• Analyze runtime security mechanisms at a system and architectural level.
• Classify and evaluate injection and instrumentation vectors.
• Apply exploit chain reasoning in structured threat modeling.
• Analyze and devirtualize VM-based protection systems methodically.
• Assess multi-layer mobile protection architectures holistically.