1. Saved cuts

2. Heap consolidation attack
dlmalloc Memory Allocator
Allocation meta-data is stored in band
Heap overflow can perform two arbitrary pointer overwrites
To fix, check:
b->fd->bk == b
b->bk->fd == b
Mateti
Android Security #1

3. Persistent System Partitions
Partitions (File Volumes) versus Directories (Mount Points)
Actual partition names: /dev/block/mmcblk*
Mount points on the right
In-mem Volatile Volumes (Dirs)
Mount points : /proc, /sys, /dev
Content in OS internal data structures
/ and /system dirs: Android's kernel as well as the OS libraries, application runtime, application framework, and applications.
Mounted read-only
Conceptual Names of Partitions
Boot
System
Recovery
Data
Cache
Misc
Mount Points of Sys Partitions /
/system
/data
/cache
/mnt/asec
SD card partitions mounted rw
/sdcard
/sd-ext
Mateti
Android Security #1

4. Interprocess Communication
Standard IPC
file system, local sockets, or signals.
Linux permissions still apply.
Binder: RPC mechanism for in-process and cross-process calls. Via a custom Linux driver.
Services: interfaces directly accessible using binder.
Intents: A message object that represents an "intention" to do something.
ContentProviders: A data storehouse
Mateti
Android Security #1