PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Android Runtime Restrictions Bypass

blog.quarkslab.com | research | #android | #reverse-engineering | #runtime | #bypass | #dlopen | #api-restrictions
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Privilege-free techniques to bypass Android runtime restrictions: escaping the Android 7 dlopen() namespace limits on private libraries and the Android 9 block on internal Java APIs.
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · blog.quarkslab.com
Bypassing Android Hardware Attestation from the Analyst's Chair
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
research · blog.quarkslab.com
Bypass Apache Superset restrictions to perform SQL injections
Quarkslab bypassed Apache Superset's SQL-injection guards during an audit by leveraging PostgreSQL behavior, achieving injections on two API routes and escalating time-based to error-based.
research · blog.quarkslab.com
Let’s Go into the rabbit hole (part 2) — the challenges of dynamically hooking Golang programs
Part two of the Go hooking series: creating runtime hooks for Golang programs with FFI (foreign function interfaces), explaining why CGO and Go internals make dynamic instrumentation so challenging.
research · blog.quarkslab.com
Let’s Go into the rabbit hole (part 1) — the challenges of dynamically hooking Golang programs
First part of a series on dynamically hooking Golang programs: why runtime detours are needed to instrument cloud-native tools like Kubernetes and gVisor, and why Go hooking is uniquely hard.
research · blog.quarkslab.com
Digging Into Runtimes – runc
A deep dive into runc, the standardized low-level runtime beneath Docker: container history from LXC to OCI, and how runc spawns and manages containers on Linux.
Back