Search papers, labs, and topics across Lattice.
WOOTdroid addresses limitations in Android system auditing by providing a whole-system online on-device tracing solution without requiring OS modification or application instrumentation. It uses WDSys, an eBPF-based syscall tracer, to reduce event loss under load, and WDBind, a Binder parcel capture and decoding mechanism, to bridge the semantic gap between low-level events and high-level behavior. The prototype on Pixel 9 devices running Android 16 demonstrates the reconstruction of security-relevant Binder transactions with minimal overhead.
Android's security-relevant IPC is now traceable on stock devices without app instrumentation, closing a critical visibility gap for security researchers and incident responders.
System auditing on Android faces two problems. First, existing syscall tracers lose events under load, silently overwriting entries faster than a user space reader can drain them. Second, security-relevant application behavior is mediated through Binder, Android's kernel IPC mechanism, and is therefore hidden from the syscall layer. The Binder parcels that the kernel does see carry no method names or typed arguments, a disconnect between low-level events and high-level behavior known as the semantic gap. Existing approaches address the semantic gap either by modifying the Android platform, making them difficult to adjust to OS updates, or by instrumenting the traced application in user space, which sophisticated adversaries can evade by bypassing the instrumented framework APIs. We present WOOTdroid, a design and prototype for on-device tracing on stock Android that addresses both problems without OS modification or application instrumentation. WDSys, an eBPF port of eAudit-style syscall auditing, runs on current Android with at most 3.6% Geekbench overhead and traces 33% more syscalls than ftrace. WDBind captures Binder parcels in the kernel and decodes them out-of-process against a framework signature table extracted via Java reflection. We demonstrate WOOTdroid on Pixel 9 devices running Android 16 with an end-to-end case study reconstructing ten security-relevant Binder transactions.
