Abdullah Zafar
Mobile Security Researcher - Promon
Abdullah is a mobile security researcher at Promon, working on Promon Shield for Android. His work focuses on rooting and hooking frameworks — analyzing how they operate, finding ways to detect them, and hardening Shield against them. This talk comes straight out of that day-to-day: the offense-and-defense view of Android instrumentation.
From ptrace to Trampolines: How Android Hooking Works
Dynamic instrumentation is everywhere in mobile: attackers use it to bypass app logic, testers to understand how apps work, and defenders to check that their own protections hold. But how does a hook actually get into a running process, and what does it leave behind?
This talk follows the full path, from injection to hook to detection, across Java and native techniques, with concrete examples from Frida and renef.
You will leave able to:
- Explain the main injection methods (ptrace, library preloading, Zygote) and their trade-offs
- Understand how Java/ART and native inline and PLT/GOT hooks actually work
- Spot the traces hooking frameworks leave, and build simple detection from it
- See why no-ptrace frameworks like renef beat the common tells, and why detection stays an arms race