c0c0n @2025 | Hacking & Cyber Security Briefing

WORKSHOP OBJECTIVE

This three-day course is designed to provide participants an in-depth understanding of Android security and vulnerability exploitation. The training begins with an introduction to the Android Operating System and its security landscape, setting the groundwork for a deeper exploration of its inner workings. The trainers will guide the participants through key concepts, ranging from foundational knowledge to advanced techniques. The course is hands-on and covers Android kernel debugging, reverse engineering, and vulnerability analysis. Through practical exercises, the attendees will be able to learn topics such as APK decompiling, fuzzing, and Arm64 assembly. Kernel customization and memory mapping for debugging is also addressed in the course. Practical labs will ensure participants gain real-world experience, with additional emphasis on strategies for bypassing modern security mitigations.

COURSE AGENDA

Familiarization of Android operating system and kernels
Android security landscape
Familiarization of ADB and fastboot
Apk decompiling
Userland fuzzing and exploitation
Introduction to ARM64 assembly
Debugging and reverse engineering
Introduction to Android Open-Source Project (AOSP) and Android kernel
Android kernel memory mapping
Kernel customization for debugging and fuzzing
Android kernel debugging
Vulnerability exploitation

PRE-REQUISITE

Knowledge in C programming
Familiarity with assembly languages (desirable)
Basic operating knowledge of Linux, including file system navigation, shell commands, and basic scripting

HWRDWARE/SOFTWARE REQUIREMENTS

A laptop with following hardware and software requirements:

Base OS - Linux or Windows
Virtualization software that permits importing VMs in a standard OVA/OVF format and passthrough USB devices (VirtualBox)
At least 100 GB of free disk space
At least 16 GB of RAM

EQUIPMENT PROVIDED FOR LAB EXERCISES

Equipment issued for lab exercises (returnable) [ one for each group of two participants ]

Android Pixel smartphones
USB-C to USB-C breakout boards
USB To TTL serial cables
USB-C cables

WHAT WILL BE PROVIDED

Resource materials
Instructional materials

WHO SHOULD ATTEND

Information security professionals
Reverse engineers and exploit developers
Anyone with an interest in understanding Android kernel exploitation

TRAINING OUTCOMES

Familiarity with Android OS and kernel
Understanding Arm64 assembly
Kernel and userland debugging
Reverse engineering
Kernel vulnerability analysis and exploitation
Userland fuzzing, vulnerability analysis, and exploitation

DURATION

Duration: 3

Trainers

Dr. Satheesh Kumar S

Associate Director, Centre for Development of Advanced Computing (C-DAC)

Dr. Jiffy Joseph

Vulnerability Researcher

Saurabh Rai

Android Security Researcher

Ibrahim Badhsha

Vulnerability Researcher

Day wise Training Plan

DAY 1 -
- Introduction to Android operating system and kernel
  - Android architecture
  - Common kernel versions
  - Android boot process
  - Android partitions
  - Android studio
- Android security landscape
  - Discretionary Access Control (DAC)
  - Linux Capabilities (CAP)
  - SecComp
  - Samsung Knox, Real-time Kernel Protection (RKP) and Trusted Execution Environment (TEE)
  - SELinux
  - User Access Override (UAO)
  - Kernel Address Space Layout Randomization (KASLR)
- ADB and fastboot
  - Components of ADB
  - Communication flow of ADB
  - ADB commands and usage
  - Installation and setting up of ADB
  - Familiarization of fastboot
  - ADB and fastboot lab
- Apk decompiling tools
  - Jadx
  - Apktool
- Dynamic instrumentation using Frida
DAY 2 -
- Introduction to ARM64 assembly
  - ARM64 architecture
  - ARM64 registers
  - ARM64 instruction set
  - ARM64 calling conventions
- Debugging and reverse engineering
  - Debugging using GDB
  - Assembly analysis of a binary file
  - Debugging challenge
  - Stack overflow example
  - Reverse engineering using Ghidra
- Userland fuzzing and exploitation
  - Introduction to fuzzing
  - Fuzzing workflow
  - Fuzzing terminology
  - Types of fuzzing
  - Userland fuzzing
  - Userland fuzzing lab
  - Userland exploitation
- Introduction to AOSP and Android kernel
  - Acquiring AOSP source code
  - Compiling AOSP source code
  - Compiling Android kernel - lab
DAY 3 -
- Android kernel memory mapping
- Kernel customization for debugging and fuzzing
  - Android debugging setup
  - Serial console, KGDB, and KASAN setup
  - Android kernel debugging
  - Overview of vulnerabilities
  - Kernel fuzzing basics
- Android kernel debugging lab
  - Setting up of serial console for debugging
  - Working with Minicom
  - Familiarization of basic struct’s
  - Privilege escalation
- GPU and Kernel vulnerability exploitation
  - GPU vulnerability exploitation
    - Mali GPU source
    - Familiarization of basic tools
    - Triggering the vulnerability
    - Disabling SELinux
    - Gaining root access
  - Kernel vulnerability exploitation
    - Familiarization of binder
    - Vulnerable code analysis
    - Physical memory shaping
    - pipe_buffer leaking
    - UAO bypass
    - Arbitrary Read Write (ARW)
    - Escalating Privilege
  - CTF Challenge

Contact Info

Social Links

WS-04

Android Security Primer

07-09 October, 2025

Smart Device Forensic Team, C-DAC Thiruvananthapuram