Dynamic Mobile Malware Analysis — iOS and AndroidThis episode expands dynamic malware analysis beyond basic runtime observation and introduces process instrumentation, debugging, network capture, and automated mobile-security frameworks across both iOS and Android.The central idea is:Static analysis tells you what a sample may be capable of; dynamic analysis shows what it actually does when executed.1. iOS Dynamic AnalysisThe iOS portion focuses on three major capabilities:
- Runtime instrumentation with Cycript
- Low-level debugging with LLDB
- Network monitoring with tcpdump + Wireshark
2. Process Injection with CycriptCycript allows researchers to interact with a running iOS process and inspect or manipulate Objective-C objects at runtime.Conceptually:Running Application ↓ Cycript ↓ Attach / Inject ↓ Inspect Runtime Objects ↓ Modify Properties / Invoke Methods ↓ Observe Application Response For example, an analyst can investigate UI objects and modify properties while the application is running.This is useful because it allows researchers to test hypotheses without modifying the original application binary.Possible observations include:
- UI changes
- Method execution
- Object properties
- Runtime state
- Application responses to manipulated conditions
3. Runtime InstrumentationThe important concept is instrumentation.Instead of simply watching the application externally, the analyst gains visibility into the application's internal runtime environment.This can help answer questions such as:
- Which method is being called?
- What arguments are being passed?
- Which objects are created?
- What happens after a specific condition is satisfied?
- Does the application execute hidden functionality?
This makes runtime instrumentation particularly useful when static analysis identifies an interesting function but its actual behavior remains unclear.4. LLDB and Remote DebuggingThe episode then introduces LLDB, a powerful debugger used for low-level inspection.In a controlled research environment, LLDB can allow an analyst to examine:
- Registers
- Memory
- Instructions
- Breakpoints
- Program execution
- Function addresses
This provides a significantly deeper level of visibility than high-level instrumentation.5. ASLR and Address CalculationA major challenge during binary debugging is Address Space Layout Randomization (ASLR).ASLR changes where executable components are loaded into memory.Conceptually:Static Binary Address + Runtime ASLR Slide ↓ Actual Runtime Address Therefore, an analyst may need to determine the ASLR slide before translating an address observed during static analysis into the corresponding address in the running process.This is particularly important when setting breakpoints on specific functions.6. Network Monitoring with tcpdumpDynamic analysis isn't limited to the application's process.Network behavior is often one of the strongest sources of evidence.On a controlled research device, tcpdump can capture network traffic into a PCAP file.Conceptually:iOS Malware ↓ Network Activity ↓ tcpdump ↓ PCAP ↓ Wireshark ↓ Traffic Analysis Wireshark can then help identify:
If traffic is unencrypted, analysts may also be able to inspect transmitted content directly.7. Android Dynamic AnalysisThe Android portion focuses heavily on creating a controlled laboratory environment.The primary components are:
8. MobSF — Automated Mobile AnalysisMobile Security Framework (MobSF) provides automated analysis capabilities for mobile applications.For an APK, it can quickly identify artifacts such as:
This makes MobSF useful for initial triage.However, automated findings should be treated as leads rather than definitive conclusions.A useful workflow is:APK ↓ MobSF ↓ Automated Findings ↓ Interesting Indicators ↓ Manual Static Analysis ↓ Dynamic Analysis 9. Android Virtual DevicesAndroid Studio's Android Virtual Device (AVD) system allows researchers to create isolated Android environments for testing.A malware-analysis environment should be separated from:
The purpose is to reduce the consequences of accidental malware execution.10. Android Debug Bridge — ADBADB is one of the most important tools in Android security research.It provides a command-line interface for communicating with an Android device or emulator.Conceptually:Analyst ↓ ADB ↓ Android Device / Emulator ↓ Application / Files / Processes ADB can be used for tasks such as:
For example:adb devices can verify that an Android device or emulator is available.An APK can be installed in a controlled lab with:adb install sample.apk 11. Root AccessThe episode also discusses obtaining elevated privileges in an Android research environment.Root access can provide significantly greater visibility into:
However, root should be treated as a research capability, not something that should automatically be enabled on production devices.12. Combining Static and Dynamic AnalysisThe most important lesson from the episode is that static and dynamic analysis complement each other.Static AnalysisAnswers:What can this application potentially do?You investigate:
Dynamic AnalysisAnswers:What does the application actually do?You observe:
13. Complete Mobile Malware WorkflowThe techniques from the entire module can be combined into one investigation pipeline: Malware Sample │ ▼ Initial Triage │ ┌────────┴────────┐ ▼ ▼ iOS Android │ │ ▼ ▼ IPA / Mach-O APK / DEX │ │ ▼ ▼ Static Analysis Static Analysis │ │ └────────┬────────┘ ▼ Behavioral Hypothesis │ ▼ Isolated Lab │ ┌────────┴────────┐ ▼ ▼ iOS Android │ │ Cycript / LLDB ADB / MobSF │ │ tcpdump / PCAP Runtime Logs │ │ └────────┬────────┘ ▼ Network Analysis │ ▼ Behavioral Evidence │ ▼ Final Assessment Key Takeaways
Golden ConceptThe strongest mobile malware investigations use a feedback loop: static analysis generates hypotheses, dynamic analysis tests those hypotheses, and the resulting runtime evidence guides the next round of static investigation.
You can listen and download our episodes for free on more than 10 different platforms:
