Research And Implementation Of Semi-Automated Fuzzy Test Tool For Android System Service

With the rapid development of mobile Internet,smart mobile devices are gradually popular.Currently the most popular mobile operating system is Google's Android system.At the same time,smart phone security issues are gradually emerging,such as remote positioning,information leakage on mobile phones are becoming more common.Many of these problems are caused by system vulnerabilities.The impact of the system's own security problems is huge and serious,Google releases Android security patches every month for device vendors to patch.However,the primary concern of equipment manufacturers is to introduce value-added services to improve their market competitiveness,but the detection and repair of system vulnerabilities is relatively lagging.Their security schemes are closed and their security capabilities are quite different.The thesis proposes a set of fuzzing test solutions for Android system services,with the goal of detecting Android native services and third-party service vulnerabilities.The research results of this paper include:1.A collection solution for APP's underlying transactions,based on the hook principle and transaction dependence ideas.It can capture the underlying data of APP calling service methods without modifying the Android source code;2.A Binder interface fuzzing solution based on the semi-valid input and coverage-guided ideas.It performs mutation based on the captured transaction data,and performs general and effective fuzzing on Java and Native system service interfaces;3.Fuzzing toolset,including "APP Sandbox" and "BinderFuzzer"tools,corresponding to the implementation of the above two sub-schemes;4.Two Moderate severity vulnerabilities confirmed by Google but not yet be officially disclosed,affecting Android 6.0?9.0.