Runtime Manipulation & Protection Bypass - Intermediate

1. 01

   Module 1: Native Layer Fundamentals (NDK & JNI)

   5 topics

   • Android NDK architecture
   • ELF and shared object (.so) structure
   • JNI bridging mechanism
   • Java ↔ Native interaction flow
   • RegisterNatives analysis perspective
2. 02

   Module 2: Advanced Static Analysis & Smali Manipulation

   5 topics

   • Control flow analysis using Smali
   • Identifying critical decision points
   • Smali-level patching approaches
   • Obfuscation detection (ProGuard / R8)
   • Static identification of in-app security controls
3. 03

   Module 3: Runtime Debugging & Behavioral Observation

   5 topics

   • Runtime behavior observation methodology
   • Application state and control-flow tracking via logcat
   • Process memory layout (text, data, heap, stack)
   • Observing Android Keystore behavior at runtime
   • Correlating static findings with runtime behavior
4. 04

   Module 4: Runtime Instrumentation & Hooking

   5 topics

   • Frida architecture and execution model
   • Java-level method hooking
   • Native function interception concepts
   • Runtime data manipulation techniques
   • Controlled behavioral modification
5. 05

   Module 5: Security Control Mechanisms (Defensive Perspective)

   6 topics

   • Root detection design patterns
   • Debugger detection strategies
   • Runtime instrumentation and hooking detection techniques
   • Integrity verification mechanisms
   • Control Flow Integrity (CFI) concepts
   • Hash-based integrity validation
6. 06

   Module 6: SSL Pinning - Design, Implementation & Bypass

   10 topics

   • TLS validation flow in Android
   • TrustManager and certificate validation logic
   • OkHttp CertificatePinner implementation analysis
   • Public key pinning vs certificate pinning
   • Common implementation mistakes and limitations
   • Java-level TrustManager manipulation
   • CertificatePinner hook-based bypass
   • Runtime modification of validation logic
   • Native-level pinning detection and validation analysis
   • Evaluating robustness of pinning implementations
7. 07

   Module 7: Protection Bypass Methodologies

   5 topics

   • Root detection bypass logic
   • Anti-debug bypass techniques
   • Runtime integrity check bypass approaches
   • Hook detection evasion concepts
   • Native library patching principles
8. 08

   Module 8: Cryptography Misuse & Runtime Exposure

   4 topics

   • Improper AES / RSA / SHA-256 implementations
   • Runtime key generation and exposure risks
   • Memory-level secret extraction concepts
   • Limitations of client-side cryptography
9. 09

   Module 9: Cross-Platform Runtime Analysis (Flutter & React Native)

   4 topics

   • Flutter architecture and Dart runtime model
   • React Native JavaScript runtime model
   • Bridge mechanisms and trust boundaries
   • Moving security controls to native layers
10. 10

    Module 10: Hands-On Labs & Practical Workshops

    10 topics

    • JNI and native boundary observation lab
    • Static-to-runtime analysis workflow lab
    • Hooking fundamentals lab (Java-level)
    • SSL pinning bypass challenge (Java-level)
    • Root detection bypass lab
    • Anti-debug protection bypass exercise
    • Native library patching (ELF demonstration)
    • Memory inspection and secret extraction lab
    • Runtime integrity evaluation case study
    • Network traffic manipulation exercise

Learning Outcomes

By the end of this package, participants will:

• Perform advanced static and dynamic Android application analysis.
• Understand JNI/NDK fundamentals and analyze basic native flows.
• Conduct controlled runtime manipulation at Java and basic native levels.
• Evaluate and bypass common in-app security controls in structured scenarios.
• Build a solid foundation for advanced runtime security research.