ARTDroid: A Virtual-Method Hooking Framework on Android ART Runtime

Various static and dynamic analysis techniques are developed to detect and analyze Android malware. Some advanced Android malware can use Java reflection and JNI mechanisms to conceal their malicious behaviors for static analysis. Furthermore, for dynamic analysis, emulator detection and integrity selfchecking are used by Android malware to bypass all recent Android sandboxes. In this paper, we propose ARTDroid, a framework for hooking virtual-methods calls supporting the latest Android runtime (ART). A virtualmethod is called by the ART runtime using a dispatch table (vtable). ARTDroid can tamper the vtable without any modifications to both Android framework and app’s code. The ARTDroid hooking framework can be used to build an efficient sandbox on real devices and monitor sensitive methods called in both Java reflection and JNI ways.