Offensive Mobile Reversing and Exploitation

This comprehensive course offers an in-depth exploration of both iOS and Android operating systems, focusing on their internals and security features. The iOS segment dives into the architecture of iOS, memory management, application sandboxing, code signing, and advanced mitigations like SPTM, TXM, PAC, PAN, and PPL. Students will also receive a thorough introduction to the ARM64 architecture, including static and dynamic analysis techniques, debugging tools, and disassembly tools.

Moving into iOS application security, students will explore topics such as code signing, encryption, secure communication, and the use of Frida for dynamic instrumentation. Advanced topics like hooking, memory manipulation, and instrumenting network communication will also be covered. The course also covers iOS malware analysis, including static, dynamic, and behavioral analysis, along with mitigation and prevention strategies.

On the Android side, participants will gain a broad understanding of Android system architecture, including drivers, modules, the Linux kernel, and the Android Binder. Hands-on experience in reverse engineering, exploit development for ARM platforms, memory management, and vulnerabilities will be provided. The course also covers Android's boot, recovery, rooting processes, and permissions, along with security features like DAC, CAP, SECCOMP, and SELinux.

For a practical learning experience, the course covers how to extract and decrypt boot images for Android devices, symbolicating the Android kernel, and porting exploits to other Android devices. Advanced Frida techniques such as custom tracing, profiling, and memory inspection are explored with real-world applications. Case studies on prominent malware and custom malware samples shed light on reverse engineering and advanced forensics techniques.