PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Why are Frida and QBDI a Great Blend on Android?

blog.quarkslab.com | research | #android | #reverse-engineering | #tracing | #frida | #qbdi | #jni
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The post shows how combining Frida and QBDI gives instruction-level visibility into obfuscated native Android functions, based on a Pass The Salt 2020 talk about tracing JNI code.
Published
Collected

Related coverage

research · blog.quarkslab.com
Android greybox fuzzing with AFL++ Frida mode
How to greybox-fuzz native Android userland targets directly on a device with AFL++'s Frida mode, including strategies for fuzzing JNI functions that interact with Java bytecode.
research · blog.quarkslab.com
Android Native Library Analysis with QBDI
How QBDI's dynamic instrumentation, now with Thumb/Thumb2 and NEON support, helps reverse obfuscated Android JNI libraries, switching between instrumented code and native calls via ExecBrocker.
research · blog.quarkslab.com
Slaying Dragons with QBDI
Solving the CSAW CTF 2015 'Wyvern 500' crackme with QBDI and its Frida bindings: tracing basic blocks to locate the password check and inject valid inputs without a full reverse engineering effort.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · blog.quarkslab.com
Bypassing Android Hardware Attestation from the Analyst's Chair
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
research · blog.quarkslab.com
QBDI vs TritonDSE against a VM: who will be the fastest?
Quarkslab solves a custom-VM CTF challenge twice — with symbolic execution engine TritonDSE and instrumentation framework QBDI — and compares which approach gets to the solution fastest.
Back