Android Application-Level Virtualization (App Cloning)

Tip

学习和实践 AWS 黑客技术：HackTricks Training AWS Red Team Expert (ARTE)
学习和实践 GCP 黑客技术：HackTricks Training GCP Red Team Expert (GRTE) 学习和实践 Azure 黑客技术：HackTricks Training Azure Red Team Expert (AzRTE)

支持 HackTricks

Application-level virtualization (aka app cloning/container frameworks such as DroidPlugin-class loaders) 在单个宿主应用内运行多个 APK，宿主应用控制生命周期、class loading、storage 和 permissions。Guests 通常在宿主的 UID 下执行，破坏了 Android 正常的每应用隔离，使检测变得困难，因为系统只看到一个 process/UID。

基线安装/启动 与 虚拟化执行

  • Normal install: Package Manager extracts APK → /data/app/<rand>/com.pkg-<rand>/base.apk, assigns a unique UID, and Zygote forks a process that loads classes.dex.
  • Dex load primitive: DexFile.openDexFile() delegates to openDexFileNative() using absolute paths; virtualization layers commonly hook/redirect this to load guest dex from host-controlled paths.
  • Virtualized launch: Host starts a process under its UID, loads the guest’s base.apk/dex with a custom loader, and exposes lifecycle callbacks via Java proxies. Guest storage API calls are remapped to host-controlled paths.

滥用模式

  • 通过共享 UID 提权: Guests 在宿主 UID 下运行，并且可以继承 宿主授予的所有权限，即便在 guest 的 manifest 中未声明。权限过大的宿主（庞大的 AndroidManifest.xml）会成为“permission umbrellas”。
  • 隐蔽的代码加载: 宿主 hook openDexFileNative/class loaders，在运行时注入、替换或对 guest dex 进行插桩，从而绕过静态分析。
  • 恶意 host vs 恶意 guest:
  • Evil host: 充当 dropper/executor，对 guest 行为进行插桩/过滤，篡改崩溃处理。
  • Evil guest: 滥用共享 UID 访问其他 guests 的数据，ptrace 它们，或利用宿主的权限。

指纹识别与检测

  • 单个进程中多个 base.apk: Container 常常在同一 PID 中映射多个 APK。
adb shell "cat /proc/<pid>/maps | grep base.apk"
# Suspicious: host base.apk + unrelated packages mapped together
  • Hooking/插桩 工件: 在 maps 中搜索已知库（例如 Frida）并在磁盘上确认。
adb shell "cat /proc/<pid>/maps | grep frida"
adb shell "file /data/app/..../lib/arm64/libfrida-gadget.so"
  • 崩溃篡改探测: 故意触发异常（例如 NPE）并观察进程是否正常终止；拦截生命周期/崩溃路径的宿主可能会吞掉或重写崩溃信息。

加固建议

  • Server-side attestation: Enforce sensitive operations behind Play Integrity tokens so only genuine installs (not dynamically loaded guests) are accepted server-side.
  • Use stronger isolation: For highly sensitive code, prefer Android Virtualization Framework (AVF)/TEE-backed execution instead of app-level containers that share a UID.

References

Tip

学习和实践 AWS 黑客技术：HackTricks Training AWS Red Team Expert (ARTE)
学习和实践 GCP 黑客技术：HackTricks Training GCP Red Team Expert (GRTE) 学习和实践 Azure 黑客技术：HackTricks Training Azure Red Team Expert (AzRTE)

支持 HackTricks