Course 42 - Mobile Malware Analysis Fundamentals | Episode 11: Dynamic Analysis for iOS and Android

0:00With the American Express Platinum Card, you can access over $3,500 in annual value with benefits and eligible purchases across travel entertainment and more. There's nothing like Platinum. Learn more at americanexpress.com slash explore dash Platinum, enrollment requirements, monthly and other limits in terms of supply. McDonald's is putting value back on the menu. Whether you're craving a big mac, McNuggets or sausage egg and cheese, McGrittles, make it a meal and save. Your favorite is now your wallet's favorite to extra value meals are back. Get a big something extra with a big Mac or 10 piece McNuggets fries and a medium Coke all for just $9 limited time only promotion pricing may be lower than meal pricing. Kitchen and bathroom professionals know what goes behind the tile matters. That's why trade pros trust fiber cement party backer board to keep tile firmly in place. Resist cracking and help block moisture. Chosen over 40 million kitchens and bathrooms party backer board. What the best build on shop now at participating home depot, lows and floor into core stores.

1:09For more information visit James Hardy dot com slash Hardy backer. I want you to just imagine for a second that you're holding your smartphone right now in your hand. Okay, like really look at it. It presents itself as this impenetrable fortress. Well, absolutely. It's closed off. It's polished. It's this mysterious sleek little black box that you trust with literally everything. Your bank accounts private conversations, your location. Yeah, your whole life basically right. But the illusion of that black box completely shatters when you understand how to crack it wide open while an application is, you know, actively running. Exactly. I mean, we are talking about changing the text on the screen on the fly or intercepting hidden network traffic or even dissecting a really sophisticated piece of malicious software that is just desperately trying to hide inside his memory. Yeah, because the interface we interact with every single day, it's just a while it's a very convincing facade. Right. We tend to think of downloaded applications as these rigid, unchangeable artifacts.

2:12But to a malware analyst, an app is a living, breathing environment that have a pulse. It has a pulse. And if you have the right access, that environment can be paused. It can be manipulated and interrogated in real time. You're essentially taking off the blindfold and seeing the actual matrix of the operating system. And that transition, you know, from looking at static code to manipulating a living process is exactly what we were dissecting today. Welcome to our deep dive into the fascinating world of mobile dynamic analysis, covering both iOS and Android. That's going to be a fun one. It really is. Our mission today is to take these advanced cybersecurity techniques and just walk you through them step by step. So whether you're an aspiring malware analyst, a cybersecurity student or just insanely curious tech enthusiasts, this deep dive will reveal exactly how professionals manipulate running applications to uncover threats. Yeah, it's like magic once you see how it works. Totally. Okay, let's unpack this. I think we should start with iOS, which presents a pretty unique challenge, right?

3:14Because Apple's ecosystem is famously designed to keep you completely out of the underlying system files. Oh, yeah. Waldgarden. Exactly. So to even begin an analyst has to force their way in and literally inject themselves into a running application. How does that even work? Well, it requires some clever engineering to bypass those walls. That's for sure. Let's look at a classic script injection technique. Okay. And we'll use a harmless target for this, like just the standard iOS weather app. Makes sense. The prerequisite here is establishing a secure shell connection, assessing into a jailbroken iPhone as root. Read access. Right. You have to operate with absolute top level privileges. Otherwise, the operating system will simply deny your request to touch another app's memory. So once you have that root shell open, you just launch the weather app normally. So it's running in the background. But I mean, the operating system doesn't call it the weather app behind the scenes, right? It uses a number exactly every single process gets a unique process ID or PID.

4:15Okay. So from the command line, we run a process status, check the Lex command and filter the output with grab to find our specific target. So let's assume the system assigns the weather app, the process ID of, I don't know, 77764. Okay. 77764. That number is our target. We take a scripting framework. Cycript is a really heavily relied upon tool for this. And we point it directly at PID 77764. Wow. Yeah. We command the framework to attach itself to that specific process. And in just a fraction of a second, our script framework is injected into the live running memory of the weather application. Okay. Wait. Let's unpack the mechanics of that injection. When you say we're injected, what access does that actually grant us within the architecture of the app? So the script hooks into the UI application object. Right. In iOS development, UI application is basically the core, the central nervous system of the app itself. By hooking into that specific object, we gain the ability to iterate through everything else running inside that class. Oh, wow.

5:15Yeah, we can scour the entire memory region for specific elements using a memory inspection command known as choose the choose command. Right. We are essentially asking the live memory to report back on every single object. It is currently holding. So if we want to manipulate the user interface, we would use that inspection command to look for the view controllers. Exactly. We asked the memory to choose all instances of UI view controller. And the system will instantly report back with the handful of views currently loaded in memory. We can navigate into those views and examine their properties. But to actually change what the user sees, we drill down further and search for UI label. Ah, the text. Yep, which returns the underlying memory addresses for all the different text elements currently rendered on the screen. Okay. Let's trace this out practically. So the weather app is displaying a list of cities, right? Madrid, Barcelona, West Haven. Right. The analyst hunts through the dump labels until they isolate the exact memory address for the UI label holding the string Barcelona. Uh-huh.

6:17And once we hold that memory address, we basically control that piece of reality on the screen. Yeah, it's exactly like that. We map a new variable in our script to that specific memory address. Because we're operating from inside the app's own process, we just write a tiny bit of JavaScript to assign a new string of text to that variable. Like what? Well, we changed the text property to, let's say, Brian's house. And instantly, without the app crashing or reloading, the city name on the physical iPhone screen shifts from Barcelona to Brian's house. That is wild. It's literally like being a ghost in the machine, you know, rearranging the furniture in a house while the homeowner is just sitting on the couch. Entirely oblivious. It really is. And you can push this way beyond just modifying existing assets. You can spawn completely new elements. Wait, really? Like from scratch? Oh, yeah. If an analyst wanted to create a rogue pop-up message on the home screen, the iOS springboard, they would just drop the connection to the weather app and target the springboard's process ID instead.

7:17So you just goes directly into the home screen's process. Exactly. From there, you allocate a completely new message using the native UI alert view class. It requires standard objective season tax. Okay. So you code the alert. Right. You initialize the alert, set a custom title like, let's make it hexade degrees. And then you inject a message body saying something like learning with cyber will change your life. Love that. And then you set the delegate parameters to nil since we aren't handling any complex callbacks and attach a single button reading. Yes, change my life. And you've constructed this entire native UI element. Yeah, purely through the terminal, just sitting in the memory matrix. Yeah. To execute it, you just call the dot show method on that object and a native looking alert box forces this way onto the screen. Rubric is the security and AI operations company built for what happens after an attack hits, not just the moments before. AI has turned the threat landscape into quicksand moving too fast for any human to fully predict. That's why an agentic cyber resilience platform matters. Automated recovery, clean data, a business that keeps moving, no matter what hits.

8:25One platform, not a patchwork of stitch together tools and gaps. Don't wait for the next attack. Secure and accelerate your business at rubric.com again rubric.com. Kitchen and bathroom professionals know what goes behind the tile matters. That's why trade pros trust fiber cement party backer board to keep tile firmly in place, resist cracking and help block moisture. Chosen in over 40 million kitchens and bathrooms party backer board. What the best build on shop now at participating home depot, lows and floor into core stores. For more information, visit James Hardy dot com slash Hardy backer. Rubric is the security and AI operations company built for what happens after an attack hits, not just the moments before. AI has turned the threat landscape into quicksand moving too fast for any human to fully predict. That's why an agentic cyber resilience platform matters automated recovery, clean data, a business that keeps moving, no matter what hits. One platform, not a patchwork of stitch together tools and gaps. Don't wait for the next attack.

9:30Secure and accelerate your business at rubric.com again rubric.com. I mean, it is a brilliant demonstration of memory manipulation, but I do have to push back here for a second. Go for it. This is great for pranking a weather app, you know, modifying UI labels and throwing pop up boxes. It's a great parlor trick, but it is entirely surface level. That's true. If our goal is to tear apart a sophisticated piece of spyware or malware, don't we need to see the actual code. Changing a text label doesn't actually help us see what data the malware is exfiltrating right. You're absolutely right. Surface manipulation only proves we have the keys to the building, right to map out the actual threat to inspect the malicious logic as it executes under the hood. We have to move much deeper into the memory matrix using a debugger. Okay, how do we do that? For Apple environments, that means utilizing LLDB, which provides advanced low-level code instruction. But the immediate hurdle is that Apple's native development environment, Xcode, is strictly designed to debug applications that you possess the original source code for.

10:33Oh, so it fights you. Oh, it actively fights your attempts to attach a debugger to hostile third-party code. So we have to force the environment to accept foreign code. Exactly. So if you are analyzing this on a standard non-jail-broken device, you basically have to repackage the malware. You take open-source tools like IPA patch, rename the target application, manipulate the build settings, and essentially trick Xcode into deploying and debugging the malware as if you wrote it yourself. Right. Which completely bypasses the need for paying for an enterprise developer license. Right. But what if we are using a jailbroken device? If you're utilizing a jailbroken test device, the workflow shifts to network routing. You deploy a tool called iProxy, which creates a tunnel between your analysis machine and the debugging server running on the physical phone. OK, tunneling. Yeah. You establish one proxy for your secure shell connection, and a secondary proxy exclusively for the debugging traffic. Then you just launch LLDB locally, configure it for remote iOS debugging, and attach it to the process.

11:37So now we are tapped directly into the malware's brain. We are. But this is where we hit one of the most frustrating security mechanisms in modern computing, right? Mm hmm. A SLR. Yep. Address basically out randomization because the debugger is basically useless if it doesn't know where to look. Exactly. A SLR is a fundamental defense mechanism built into iOS and virtually all modern operating systems. Its entire purpose is to prevent attackers, or in our case, analysts from reliably predicting where specific functions live in memory. Wait, so ASLR is basically like someone completely rearranging the layout of a city streets every single time you boot up the phone. So your old map is completely useless. That is a perfect analogy. The physical buildings are the same, but their GPS coordinates are scrambled every time the app launches. So if I mapped out a malicious encryption function yesterday at like memory address 1234, today that same function might be relocated to address 9876. Exactly. Your old map is completely useless.

12:37But what's fascinating here is how we actually beat ASLR. Okay, how? Because that sounds impossible. Well, the layout of the city, the relative distance between the bank and the post office, that remains static. The operating system just moves the entire city to a new starting coordinate. Ah, nice. Our job is to calculate that new starting coordinate, a metric we call the ASLR shift. Okay, so walk through the math of translating that randomized coordinate. How do we find that shift? So inside the debugger, we run the command image dump sections, which prints out the current randomized memory map of the application. And we are hunting for two specific architectural addresses, the location of the text container and the location of the page zero container. Let's clarify what those actually represent in the architecture for a second. The tech container isn't just text, right? It is the segment of memory where the actual executable machine code of the app lives. Correct. And page zero is this protected unreadable segment of memory placed at the very beginning of the application space, specifically designed to catch null pointer errors.

13:41Spot on. So you isolate the physical memory address where the text container was randomly placed today. And you subtract the baseline address of the page zero container. Text minus page zero. Exactly. That calculation yields the ASLR shift. It tells you exactly how far the operating system displaced the application from its theoretical starting point. Wow. So we have our master key. We do. We store that resulting shift value in our debugger as a variable. Let's just call it delta. Okay, delta. Now we can bring in our static analysis map. We look at a disassembler like hopper, which analyzes the dead non-running code and maps out the relative distances. Hopper tells us, hey, the main entry point for this malware is located at this specific offset. But hopper's offset is technically incorrect because it doesn't account for today's ASLR scramble. Right. But because we calculated delta, we take the static offset from hopper at our delta variable to it and boom. We suddenly possessed the exact real time memory address of that malicious function on the live device.

14:44That is so cool. Yeah. We execute the disassemble command on that newly calculated address and the debugger reveals the actual running machine code. Which means we can finally set our traps. We instruct the debugger to set a breakpoint at that exact address, basically telling it to execute the program normally, but freeze the entire operating system, the absolute millisecond the app tries to run that function. Precisely. We monitor the memory for specific implementation methods. In iOS, seeing objcmsg send is a massive indicator that a method is firing. The moment the malware triggers it, we freeze the app and pull apart the registers to see exactly what data it is trying to process. But malware isn't just a static piece of code. Memory analysis gives you the internal logic. Sure. But it usually tries to phone home to a command and control server. It needs to exfiltrate the data its stole or get new instructions. Very true. So if we have the app frozen under a debugger and memory, how do we catch it whispering to the internet? We have to shift from inspecting memory to sniffing the network interface, right?

15:45Yeah. We utilize a packet analyzer, typically TCP dump, running directly on the jail broken device. We target the iPhone's primary networking adapter, which is usually designated as N zero. But standard network adapters are designed to be efficient. They ignore background traffic that isn't specifically requested by the active foreground process. Right to save battery and processing power. Exactly. So we have to override that behavior by forcing the hardware interface into promiscuous mode. Pramiscuous mode strips away all those hardware filters. It forces the network guard to blindly capture absolutely every packet moving across the interface regardless of its destination. Yes. The command is TCP dump, AIN0 in zero, TNP mal.pcap. We pipe that raw data stream into a temporary capture file, a PCA. But wait, the phone is constantly talking to Apple servers, fetching background updates, pulling for emails. It's a massive haystack of noise. It is, which is why you filter the noise at the command line using Grap. If our earlier static analysis revealed the malware contains a suspicious URL, string-like

16:51hexcapes, you pipe the TCP dump output through a search filter, so it only writes packets containing that specific domain to your file. Oh, nice. You trigger the malware, it attempts its call out, and the packet analyzer quietly records the entire conversation into the PCIP file. And then we take that resulting PCCAP file off the iPhone entirely, right? Because reading raw hexadecimal network packets in a command line terminal on a tiny screen is an exercise in misery. Oh, absolute misery, don't do that. So we move the file over to a dedicated analysis machine like a Calilinux workstation and open it in a visual tool like Wireshark. Exactly. Wireshark rebuilds the fragmented packets into a coherent conversation. You can visually track the HTTP GET requests, see the exact payload, the malware, attempted to transmit, and analyze the command server's response. It completes the picture. You have the memory logic from the debugger and the external communication from the packet counter. So what does this all mean? Look at the sheer amount of friction required to get those answers on iOS.

17:52We're assessing into jail-broken devices, calculating memory offsets to beat ASLR, tunnel and debug traffic through proxies. It is a walled garden that we constantly have to scale. It's exhausting sometimes. Right. What happens when we analyze malware on a platform that is notoriously open, making it a massive target for hackers? Let's pivot to Android. Let's do it. Android is fundamentally built on the Linux kernel. It is intrinsically open if you have the right privileges, which completely alters how we approach dynamic analysis. Oh, it's night and day. The open architecture of Android provides a massive ecosystem of specialized analysis tools. Because the environment isn't actively fighting your attempts to inspect it, the initial approach actually relies heavily on automation. So the first instinct is to take the malicious Android application package, the APK, and submit it to an online malware sandbox, right? Something like hybrid analysis. Exactly. These cloud-based sandboxes are incredibly robust. They spin up the application inside their own instrumented virtual environments, interact

18:55with it, and generate highly detailed reports of its behavior. Because Android's architecture is so thoroughly documented, a single automated run often highlights all the malicious activities. Often, yeah. That alone accomplishes a lot of your analysis goals. But hold on, let's say you're an incident responder for a Fortune 500 company, and you extract a highly targeted bespoke piece of espionage malware from an executive's device. If I upload that highly sensitive corporate APK to a public website like hybrid analysis, didn't I just expose my company's breach to the entire internet? Yeah. I immediately know I found their tool. This raises an important question, and the answer is yes. Public sandboxes are a catastrophic breach of operational security for sensitive analysis. Everything you upload is generally available for public consumption, or shared with threat intelligence platforms. So we can't use them for sensitive stuff. No. The solution is migrating that automated sandbox locally. Okay. We use something like the mobile security framework or MABSF.

19:56It runs locally on your host hardware. It takes maybe 10 minutes to set up, runs on Windows, Mac, or Linux, and keeps the malware entirely contained within your own perimeter. Right. Now, to utilize the virtual dynamic features, MABSF needs direct access to the host hardware of virtualization. It struggles to emulate an Android environment if you nest it inside another virtual machine. Oh, that makes sense. But once deployed, you upload the APK to your local dashboard, and it performs an exhaustive extraction immediately. It maps out every activity the app can trigger. Flag's risky permissions like a simple calculator requesting full internet access and extracts embedded URLs, emails, and hidden text strings. So MABSF provides a brilliant automated blueprint, but it is still a static report in a way. To truly watch the malware squirm to see how it reacts to input or how it attempts to evade detection in real time, we had to put it in a glass box and poke it ourselves. We need an emulator. We do. We build an Android virtual device and AVD.

20:57And the most effective way to construct it is by leveraging Google's official developer environment, Android Studio. You get granular command line control over the hardware and software configuration of the virtual phone. And a configuration is critical because we aren't building a phone for daily use. We are building a trap. Right. So when setting up the emulator, we walk through Android Studio's AVD manager. And the absolute goal and rule here is avoiding any system image that includes the Google Play APIs. Right. We have to pick the standard open source Android project images. Yes. This is crucial. System images bundled with Google Play APIs enforce strict production level security policies. They lock down the environment, completely preventing you from gaining root access. And without root, you're just a standard user. Exactly. And you cannot inspect the underlying system processes. You must maintain absolute administrative control root access over the emulator to analyze the malware effectively. You also configure the glass box with an older version of the Android operating system, don't you? Yes. Because if you deploy complex malware onto the newest, most heavily patched version of Android,

22:02the exploit might simply fail. The malware crashes and you learn absolutely nothing about its attack chain. Right. So we pick an older OS version and a basic device like a Pixel 3 within a by 86 image. By deploying it on an older vulnerable architecture, you allow the malware to succeed in its exploitation, giving you a front row seat to observe its entire payload delivery. And obviously you isolate this vulnerable virtual device on a host only network, routing all of its traffic through analysis tools like I net, Sim or Remnux, ensuring the malware cannot bridge the connection and infect your actual lab environment. Naturally. Oh, and pro tip. If rendering the virtual screen is consuming too much processing power, you execute the emulator in headless mode. It runs purely in the background to maximize hardware efficiency. Love that. Okay. So with the virtual device booted and root access secured, we interface with it using the command line via the Android debug bridge or ADB. Yep. ADB is your best friend here. Now, if we are trying to do this on a physical Android phone, we'd have to navigate through

23:04the UI, go to settings, tap the build number like a crazy person, 4, 3, 2, 1 to become a developer and manually authorize USB debugging. The emulator bypasses all of that friction. It does. ADB provides a direct privileged pipeline to the device. You type add devices to verify the connection and then command ab root to restart as root ensuring every subsequent command executes with top level system authority. Here's where it gets really interesting. Instead of typing out complex installation parameters, we use the debug bridge to seamlessly side load our analysis tools like the Jozor agent directly onto the device using ad install. Then we instruct ADB to drop us into the system shell with ab shell and the command prompt shifts to a pound sign. We are no longer interacting with Android. We are standing directly in the underlying Linux operating system. We have God mode over the device, allowing us to manually pull apart the Android malware just as deeply as we did with the iOS memory offsets earlier.

24:04It highlights the fundamental difference between the two platforms perfectly. iOS forces you to calculate offsets, inject scripts, and essentially pick the lock just to sneak a look inside. It hands you the architectural blueprints and the tools to build a custom interrogation environment. Provide it you understand the underlying Linux foundation. Both platforms though require a pretty deep understanding of how the operating system handles memory and processes. Absolutely. It's a profound shift in perspective. We started this deep dive by injecting JavaScript into a live iOS weather app to override its user interface on the fly. Brian's house. Right. Then we explored the architecture of address space layout randomization, calculating the exact ASLR shift between the physical executable code and its base padding so our debugger could locate functions hidden in scrambled memory. We forced network hardware into promiscuous mode to capture raw exfiltration attempts. Lot of ground covered. And finally we explored why analyzing Android requires abandoning public cloud tools to

25:05build localized root level virtual emulators that allow malware to execute its full attack chain under observation. These aren't just technical procedures. They are the foundational methodologies for forcing malicious code to reveal its true nature when it believes it's operating in the shadows. It really all comes back to how you build that environment. Before we go test yourself. If you're setting up an Android virtual device for malware analysis, why must you specifically avoid using images with Google Play APIs? To ensure you maintain root access. If you prioritize the convenience of a production ready environment, you sacrifice the administrative root access required to actually see what the malware is doing. You have to intentionally build a vulnerable open system to understand the threat. But and this is big but the threat landscape is evolving rapidly. Malware authors are acutely aware of these dynamic analysis techniques. Modern payloads are increasingly equipped with environmental awareness. They check CPU temperatures, screen resolutions and specific memory registers to detect if

26:08they are running inside of virtual device or if a debugger is attached. If they sense the glass box we built today, they simply refuse to execute. They played dead. Wow. Which means the interrogation room we built today might not work tomorrow. Nope. As malware becomes fully aware of the operating system it lives in, security researchers will have to move even deeper. We may have to stop relying on software-level debuggers and start building analysis capabilities directly into the physical silicon of the processors themselves. How will the next generation of mobile operating systems have to evolve to stay one step ahead of the code we can't even see? It makes you look at that sleek black box in your hand a little differently, doesn't it? It really does. It isn't just a phone. It's an active evolving battlefield. Well said. Thank you so much for joining us on this deep dive. Keep asking questions. Keep dismantling the technology around you and we will catch you next time.