{"id":10310,"date":"2022-05-19T09:59:16","date_gmt":"2022-05-19T09:59:16","guid":{"rendered":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/?post_type=session&#038;p=10310"},"modified":"2023-06-15T00:07:56","modified_gmt":"2023-06-15T00:07:56","slug":"take-a-picture-of-your-app-code-android-mri-interpreter","status":"publish","type":"session","link":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/","title":{"rendered":"Take a Picture of Your App Code &#8211; Android MRI Interpreter"},"content":{"rendered":"<p style=\"text-align: justify;\">Magnetic Resonance Imaging (MRI), a medical device, allows tomographic imaging of human organs and measurement of blood flow. Using these features, modern doctors can easily detect diseases without having to perform open surgery as in the past.<\/p>\n<p style=\"text-align: justify;\">If it were possible to perform tomography on the app\u2019s code through a simple procedure, such as taking a picture like an MRI without invasion the app\u2019s process, and trace the flow of data used within the code, it would be an effective way to find vulnerabilities. <strong>This paper proposes a new OS (interpreter, runtime, kernel) that performs MRI functions based on Android 12.<\/strong><\/p>\n<p style=\"text-align: justify;\"><strong>In this new Interpreter, the Android app takes a picture of the dalvik instruction and register value at runtime when the target (data or function) is used, generating a Control Flow Graph (CFG) that traces the target\u2019s forward and backward execution, providing an effective environment for analyzing the app and finding vulnerabilities.\u00a0Furthermore, I\u00a0will explain the vulnerabilities discovered in mobile apps using the developed OS.<\/strong><\/p>\n<p style=\"text-align: justify;\">Three functions were developed based on the Android Open Source Project (AOSP) in order to analyze and find vulnerabilities of apps in the Android 12 environment.<\/p>\n<ul style=\"text-align: justify;\">\n<li><strong>Firstly, a new MRI interpreter was developed that can inspect, trace, and print all the Dalvik instructions and register values executed in an Android app.<\/strong> However, in the Android 12 environment, some Dalvik codes in the app are compiled into native codes and run directly without going through the interpreter. Therefore, it is not possible to inspect all the codes with the developed MRI interpreter alone.<\/li>\n<\/ul>\n<ul style=\"text-align: justify;\">\n<li><strong>Secondly, to overcome this, we controlled the flow of code by the Android Runtime (ART) so that all code is executed as Dalvik code through the MRI interpreter.<\/strong> The interpreter developed in this way was installed on the device. However, in apps that provide sensitive functions, the Runtime Application Self-Protection (RASP) technique is applied to detect OS tampering, among other things, and prevent the app from running in a modified OS environment. To bypass this,<\/li>\n<\/ul>\n<ul>\n<li style=\"text-align: justify;\"><strong>Thirdly, we have developed a new kernel for Android, so that all of RASP&#8217;s detection functions are automatically bypassed.<\/strong> The new kernel adds a privilege escalation backdoor, SEAndroid bypass, and AVB bypass, enabling RASP to fail to detect OS tampering and allowing security analysts to obtain root privileges for analysis.<\/li>\n<\/ul>\n","protected":false},"template":"","class_list":["post-10310","session","type-session","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Take a Picture of Your App Code - Android MRI Interpreter - HITBSecConf2024 - Bangkok<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Take a Picture of Your App Code - Android MRI Interpreter - HITBSecConf2024 - Bangkok\" \/>\n<meta property=\"og:description\" content=\"Magnetic Resonance Imaging (MRI), a medical device, allows tomographic imaging of human organs and measurement of blood flow. Using these features, modern doctors can easily detect diseases without having to perform open surgery as in the past. If it were possible to perform tomography on the app\u2019s code through a simple procedure, such as taking [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/\" \/>\n<meta property=\"og:site_name\" content=\"HITBSecConf2024 - Bangkok\" \/>\n<meta property=\"article:modified_time\" content=\"2023-06-15T00:07:56+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/\",\"url\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/\",\"name\":\"Take a Picture of Your App Code - Android MRI Interpreter - HITBSecConf2024 - Bangkok\",\"isPartOf\":{\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/#website\"},\"datePublished\":\"2022-05-19T09:59:16+00:00\",\"dateModified\":\"2023-06-15T00:07:56+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Session\",\"item\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Take a Picture of Your App Code &#8211; Android MRI Interpreter\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/#website\",\"url\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/\",\"name\":\"HITBSecConf2024 - Bangkok\",\"description\":\"August 26 - 30 @ InterContinental\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Take a Picture of Your App Code - Android MRI Interpreter - HITBSecConf2024 - Bangkok","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/","og_locale":"en_US","og_type":"article","og_title":"Take a Picture of Your App Code - Android MRI Interpreter - HITBSecConf2024 - Bangkok","og_description":"Magnetic Resonance Imaging (MRI), a medical device, allows tomographic imaging of human organs and measurement of blood flow. Using these features, modern doctors can easily detect diseases without having to perform open surgery as in the past. If it were possible to perform tomography on the app\u2019s code through a simple procedure, such as taking [&hellip;]","og_url":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/","og_site_name":"HITBSecConf2024 - Bangkok","article_modified_time":"2023-06-15T00:07:56+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/","url":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/","name":"Take a Picture of Your App Code - Android MRI Interpreter - HITBSecConf2024 - Bangkok","isPartOf":{"@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/#website"},"datePublished":"2022-05-19T09:59:16+00:00","dateModified":"2023-06-15T00:07:56+00:00","breadcrumb":{"@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/take-a-picture-of-your-app-code-android-mri-interpreter\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/"},{"@type":"ListItem","position":2,"name":"Session","item":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/session\/"},{"@type":"ListItem","position":3,"name":"Take a Picture of Your App Code &#8211; Android MRI Interpreter"}]},{"@type":"WebSite","@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/#website","url":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/","name":"HITBSecConf2024 - Bangkok","description":"August 26 - 30 @ InterContinental","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/session\/10310"}],"collection":[{"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/session"}],"about":[{"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/types\/session"}],"wp:attachment":[{"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/media?parent=10310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}