Listen to this Post
Here’s the full presentation:
You Should Know:
Key Techniques Discussed in the Presentation
Laurie Kirk’s research focuses on forcing Android malware to self-unpack, bypassing obfuscation techniques used by attackers. Below are some critical takeaways and practical implementations:
1. Dynamic Analysis with Frida
Frida is a powerful dynamic instrumentation toolkit used to hook into Android apps and manipulate runtime behavior.
Example Frida Script to Bypass Anti-Debugging:
Java.perform(function () {
var Debug = Java.use('android.os.Debug');
Debug.isDebuggerConnected.implementation = function () {
return false; // Spoof debugger check
};
});
2. Automated Unpacking with Custom Tools
Laurie released a tool for auto-decompilation of packed Android malware. Below is a sample workflow:
Steps to Decompile APK:
1. Extract APK using `apktool`:
apktool d malicious.apk -o output_dir
2. Analyze Smali Code for hidden payloads.
3. Use Frida/GDB to intercept decryption routines.
3. Bypassing Native Layer Protections
Many malware samples use native (C/C++) code for stronger obfuscation.
Using `radare2` for Binary Analysis:
r2 -A -d libmalicious.so aaa Analyze all s sym.decrypt_function Seek to decrypt function pdf Disassemble
4. Forcing Runtime Dumping
Use GDB to dump decrypted memory regions:
gdb -p <pid> dump memory dumped_region.bin 0x1000 0x8000
5. Static Analysis with Ghidra
- Import APK into Ghidra.
- Identify JNI (Java Native Interface) calls.
- Reverse-engineer decryption logic.
6. ADB Commands for Live Analysis
adb shell dumpsys package <malicious_package> adb logcat | grep -i "malicious_tag"
What Undercode Say
Android malware is evolving with advanced packing and anti-analysis tricks. Laurie Kirk’s approach of forcing self-unpacking is a game-changer for reverse engineers. By combining Frida, GDB, radare2, and Ghidra, security researchers can dissect even the most obfuscated malware.
Expected Output:
- A fully unpacked malware sample.
- Extracted payloads and C2 (Command & Control) details.
- Automated scripts for future analysis.
For deeper insights, watch the full presentation: RECon 2024 – Laurie Kirk.
References:
Reported By: Laurie Kirk – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
