|
| 1 | +# Firmware-level Android Backdoor via libandroid_runtime Zygote Injection |
| 2 | + |
| 3 | +{{#include ../../banners/hacktricks-training.md}} |
| 4 | + |
| 5 | +## Overview |
| 6 | + |
| 7 | +Supply-chain tampering of `/system/lib[64]/libandroid_runtime.so` can hijack `android.util.Log.println_native` so that **every app forked from Zygote executes attacker code**. The Keenadu backdoor adds a single call inside `println_native` that drives a native dropper. Because all app processes run this code, Android sandbox boundaries and per-app permissions are effectively bypassed. |
| 8 | + |
| 9 | +## Dropper path: native patch → RC4 → DexClassLoader |
| 10 | +- Hooked entry: extra call inside `println_native` to `__log_check_tag_count` (injected static lib `libVndxUtils.a`). |
| 11 | +- Payload storage: RC4-decrypt blob embedded in the `.so`, drop to `/data/dalvik-cache/arm[64]/system@framework@vndx_10x.jar@classes.jar`. |
| 12 | +- Load & execute: `DexClassLoader` loads the jar and invokes `com.ak.test.Main.main`. Runtime logs use tag `AK_CPP` (triage artifact). |
| 13 | +- Anti-analysis: aborts in Google/Sprint/T-Mobile system apps or if kill-switch files exist. |
| 14 | +- Zygote role split: |
| 15 | + - In `system_server` → instantiate `AKServer`. |
| 16 | + - In any other app → instantiate `AKClient`. |
| 17 | + |
| 18 | +## Binder-based client/server backdoor |
| 19 | +- `AKServer` (running in `system_server`) sends protected broadcasts: |
| 20 | + - `com.action.SystemOptimizeService` → binder interface for clients. |
| 21 | + - `com.action.SystemProtectService` → binder interface for downloaded modules. |
| 22 | +- `AKClient` (inside every app) receives the interface via broadcast and performs an `attach` transaction, handing an IPC wrapper so the server can load arbitrary DEX **inside the current app process**. |
| 23 | +- Exposed privileged operations (via `SystemProtectService`): grant/revoke any permission for any package, retrieve geolocation, and exfiltrate device info. This centralizes privilege bypass while still executing code in chosen target apps (Chrome, YouTube, launcher, shopping apps, etc.). |
| 24 | + |
| 25 | +## C2 staging, crypto, and gating |
| 26 | +- Host discovery: Base64 → gzip → AES-128-CFB decrypt with key `MD5("ota.host.ba60d29da7fd4794b5c5f732916f7d5c")`, IV `"0102030405060708"`. |
| 27 | +- Victim registration: collect IMEI/MAC/model/OS, encrypt with key `MD5("ota.api.bbf6e0a947a5f41d7f5226affcfd858c")`, POST to `/ak/api/pts/v4` with params `m=MD5(IMEI)` and `n=w|m` (network type). Response `data` is encrypted identically. |
| 28 | +- Activation delay: C2 serves modules only after ~2.5 months from an "activation time" in the request, frustrating sandbox detonations. |
| 29 | +- Module container (proprietary): |
| 30 | +``` |
| 31 | +struct KeenaduPayload { |
| 32 | + int32_t version; |
| 33 | + uint8_t padding[0x100]; |
| 34 | + uint8_t salt[0x20]; |
| 35 | + KeenaduChunk config; // size + data |
| 36 | + KeenaduChunk payload; // size + data |
| 37 | + KeenaduChunk signature;// size + data |
| 38 | +} __packed; |
| 39 | +``` |
| 40 | + - Integrity: MD5 file check + DSA signature (only operator with private key can issue modules). |
| 41 | + - Decryption: AES-128-CFB, key `MD5("37d9a33df833c0d6f11f1b8079aaa2dc" + salt)`, IV `"0102030405060708"`. |
| 42 | + |
| 43 | +## Persistence & forensic tips |
| 44 | +- Supply chain placement: malicious static lib `libVndxUtils.a` linked into `libandroid_runtime.so` during build (e.g., `vendor/mediatek/proprietary/external/libutils/arm[64]/libVndxUtils.a`). |
| 45 | +- Firmware auditing: firmware images ship as Android Sparse `super.img`; use `lpunpack` (or similar) to extract partitions and inspect `libandroid_runtime.so` for extra calls in `println_native`. |
| 46 | +- On-device artifacts: presence of `/data/dalvik-cache/arm*/system@framework@vndx_10x.jar@classes.jar`, logcat tag `AK_CPP`, or protected broadcasts named `com.action.SystemOptimizeService`/`com.action.SystemProtectService` indicate compromise. |
| 47 | + |
| 48 | +## References |
| 49 | +- [Keenadu firmware backdoor analysis](https://securelist.com/keenadu-android-backdoor/118913/) |
| 50 | +- [lpunpack utility for Android sparse images](https://github.com/unix3dgforce/lpunpack) |
| 51 | + |
| 52 | +{{#include ../../banners/hacktricks-training.md}} |
0 commit comments