How to instrument system applications on Android stock images
Summary: Cisco Talos researcher Vitor Ventura documented a method for instrumenting headless Android system applications on stock images, presented at Recon Montreal 2022, using the Frida Framework and the MtpService app on a Pixel 4 XL emulator image with API 30. The approach requires uninstalling the original target, re-signing any applications that share its user ID, and patching smali code to load the Frida gadget library at the BOOT_COMPLETED action.
What you should know: Android's signature checks and non-uninstallable system apps mean a patched package cannot simply be installed over the original, so analysts must remove the target and re-sign every app sharing its UID - a chain of tampering that can bias results if vendor kernel protections like Samsung's restricted SELinux are absent from the analysis environment.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026