Android Hacker's Handbook

Chapter 8Exploiting User Space Software

This chapter introduces exploiting memory corruption issues in user-space software on the Android operating system. Well-known vulnerability classes, such as stack-based buffer overflows, are examined in the context of the ARM architecture. The chapter discusses key implementation details that are relevant when developing exploits. Next, it examines a few historic exploits so you can understand the application of the previously introduced concepts. Finally, the chapter wraps up with a case study in advanced heap exploitation using a remotely exploitable vulnerability in the WebKit browser engine.

Memory Corruption Basics

The key to understanding exploits for memory corruption vulnerabilities is abstraction. It is important to avoid thinking in terms of a high-level language such as C. Instead, an attacker should simply consider the memory of the target machine as a finite amount of memory cells that are only assigned a meaning by the target program's semantics. This includes any meaning implicitly induced by certain instruction types or functions, such as those that treat regions of memory as the stack or heap.

The following sections discuss certain specific incarnations of memory corruption and how they can be exploited on the Android platform. However, they all have one thing in common with any other exploitation method: The implicit assumptions the target code makes about certain memory regions are violated by the attacker. Subsequently, ...