Inside the Android platform: Binder, Zygote, ART and hardware-backed security
You learn how the platform works from boot to app process, the package manager, privileged apps, the TEE and key attestation.
Level 301 · 22 lessons · 18 practice labs
Lessons
Processes and communication
- The boot sequence: init, Zygote and system_server
- Binder: inter-process communication
- System services and reading dumpsys output
- ART, dex and ahead-of-time compilation
- Short task: extract an app's permission and component state from dumpsys output
Package management
- The package manager: packages.xml and the install flow
- Split APKs and app bundles (AAB)
- Shared UIDs and signature permissions
- System apps, priv-app and preinstalled software
- Short task: classify the preinstalled apps on the simulated device by privilege
Hardware-backed security
- The TEE, StrongBox and key attestation
- Gatekeeper, biometric classes and authentication-bound keys
- Device and app integrity verdicts: the concepts
- OTA updates: A/B partitions and Mainline modules
- Short task: read a key attestation certificate chain and interpret the device state
Logs and diagnostics
- logcat: buffers, tags and priorities
- The structure of a bugreport file
- Reading SELinux denials in the logs
- AppOps records and permission usage history
- Partitions and Treble: system, vendor, product
- Short task: find the crashing service and its cause in a bugreport
Capstone
- Capstone: write a technical note that traces one security feature from hardware to app
Practice labs
- Extract an app's permissions from dumpsys output: Separate an app's requested and granted permissions in dumpsys package output.
- List running services and their owners: Extract the foreground services and their packages from dumpsys activity services output.
- Produce a device state summary from system services: Pick the ten security-relevant lines from the package, battery, device policy and notification service outputs and write a summary.
- Find a package's record in packages.xml: Find an app's code path, UID and signature record in the given packages.xml export.
- Put split APKs together and examine them: List an app's base and split APKs and find which split carries the native libraries.
- Build an install timeline from package records: Produce a timeline of the last thirty days from the first-install and last-update times in the package records.
- Count and separate the preinstalled apps: List the packages that come from the system partition on the simulated device and state how many.
- Classify the privileged apps: Split the preinstalled apps into privileged and ordinary system apps and mark the vendor additions.
- Audit a privileged app's signature permissions: Extract the privileged permissions held by a vendor-preinstalled app and report the one out of proportion to its function.
- Read the device state in an attestation certificate: Find the boot state and patch level fields in a sample key attestation certificate.
- Verify the certificate chain up to the root: Order the attestation chain with openssl, verify it to the root and interpret the security level field.
- Tell the untrusted device from two attestation records: Compare two chains and show with evidence the software-level key and the unlocked device.
- Filter an app's lines in a logcat dump: Separate one package's error-level lines in the given logcat dump.
- Find the crashing service and its cause in a bugreport: Open a bugreport archive and find the service that keeps crashing and the cause in its stack trace.
- Draw a permission usage story from the logs: Combine AppOps records and logcat lines to write, in time order, when an app used the camera in one day.
- Read the active slot and partition details: Find the simulated device's active A/B slot and whether the system partition is read-only.
- List the Mainline module versions: List the updatable system modules on the device with their versions and flag the oldest.
- Trace one security feature from hardware to app: Write a technical note documenting, with device output, the path of an authentication-bound key through hardware, system service and app layers.
About this course
You learn how the platform works from boot to app process, the package manager, privileged apps, the TEE and key attestation.
What you will learn
- Processes and communication
- Package management
- Hardware-backed security
- Logs and diagnostics
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.