Course 42 - Mobile Malware Analysis Fundamentals | Episode 11: Dynamic Analysis for iOS and Android
Published 1 month, 3 weeks ago
Description
Dynamic Mobile Malware Analysis — iOS and AndroidThis episode expands dynamic malware analysis beyond basic runtime observation and introduces process instrumentation, debugging, network capture, and automated mobile-security frameworks across both iOS and Android.The central idea is:Static analysis tells you what a sample may be capable of; dynamic analysis shows what it actually does when executed.1. iOS Dynamic AnalysisThe iOS portion focuses on three major capabilities:
Runtime instrumentation with Cycript
Low-level debugging with LLDB
Network monitoring with tcpdump + Wireshark
2. Process Injection with CycriptCycript allows researchers to interact with a running iOS process and inspect or manipulate Objective-C objects at runtime.Conceptually:Running Application ↓ Cycript ↓ Attach / Inject ↓ Inspect Runtime Objects ↓ Modify Properties / Invoke Methods ↓ Observe Application Response For example, an analyst can investigate UI objects and modify properties while the application is running.This is useful because it allows researchers to test hypotheses without modifying the original application binary.Possible observations include:
UI changes
Method execution
Object properties
Runtime state
Application responses to manipulated conditions
3. Runtime InstrumentationThe important concept is instrumentation.Instead of simply watching the application externally, the analyst gains visibility into the application's internal runtime environment.This can help answer questions such as:
Which method is being called?
What arguments are being passed?
Which objects are created?
What happens after a specific condition is satisfied?
Does the application execute hidden functionality?
This makes runtime instrumentation particularly useful when static analysis identifies an interesting function but its actual behavior remains unclear.4. LLDB and Remote DebuggingThe episode then introduces LLDB, a powerful debugger used for low-level inspection.In a controlled research environment, LLDB can allow an analyst to examine:
Registers
Memory
Instructions
Breakpoints
Program execution
Function addresses
This provides a significantly deeper level of visibility than high-level instrumentation.5. ASLR and Address CalculationA major challenge during binary debugging is Address Space Layout Randomization (ASLR).ASLR changes where executable components are loaded into memory.Conceptually:Static Binary Address + Runtime ASLR Slide ↓ Actual Runtime Address Therefore, an analyst may need to determine the ASLR slide before translating an address observed during static analysis into the corresponding address in the running process.This is particularly important when setting breakpoints on specific functions.6. Network Monitoring with tcpdumpDynamic analysis isn't limited to the application's process.Network behavior is often one of the strongest sources of evidence.On a controlled research device, tcpdump can capture network traffic into a PCAP file.Conceptually:iOS Malware ↓ Network Activity ↓ tcpdump ↓ PCAP ↓ Wireshark ↓ Traffic Analysis Wireshark can then help identify:
Destination IP addresses
DNS queries
Connection patterns
Protocols
HTTP traffic
Suspicious infrastructure
If traffic is unencrypted, analysts may also be able to inspect transmitted content directly.7. Android Dynamic AnalysisThe Android portion focuses heavily on creating a controlled laboratory environment.The primary components are:
MobSF
Android Studio
Android Virtual Devices
ADB
Listen Now
Love PodBriefly?
If you like Podbriefly.com, please consider donating to support the ongoing development.
