zorin-native-lab

A pure-native Android internals lab that compares the same device through three different security identities.

NativeActivity APK (NO DEX)
        |
        | automatic backend detection
        +----------------------+------------------------+
        |                      |                        |
  APP SANDBOX            ADB SHELL CORE v3       SYSTEM DEVICE CORE v2
  untrusted_app          shell / UID 2000         Rust + AIDL + SELinux
  app seccomp            authenticated loopback   custom AOSP image

The APK contains no classes.dex. UI, clipboard integration, Binder client, syscall probes and bridge client live in native ELF libraries.

What v2.0 adds

• The APK and ADB Shell Core probe the same 36 Binder service names, so COPY ALL can report an exact APP → SHELL exposure delta.
• Shell Core v3 runs validated, disposable-child kernel probes with meaningful arguments: io_uring_setup, BPF_MAP_CREATE, perf_event_open, userfaultfd, pidfd_open, memfd_create, membarrier, Landlock ABI discovery and setns to the process’s own network namespace.
• Added bounded /proc visibility checks including PID 1 and namespace metadata.
• COPY ALL now emits [SHELL CORE / PROCFS], [SHELL CORE / VALIDATED PROBES] and a machine-readable Binder differential summary.
• Repository hygiene for public Git hosting: .gitignore, .gitattributes, .editorconfig, Apache-2.0 license, CI, security/contribution docs, changelog and no committed private signing key.

Security boundary

ADB Shell Core binds only to 127.0.0.1 and privileged commands require a random bearer token generated by the authorized host. Its command set is fixed and read-only. There is deliberately no EXEC, arbitrary READ <path>, generic Binder transaction proxy, process injection or write primitive.

System Device Core is a separate Android platform component. It is started by init, registered with ServiceManager and protected by SELinux; policy decisions use Binder caller UID/PID rather than caller-supplied identity strings.

Build

Requirements on Linux: clang, lld, zip, python3, a JDK (for JNI headers) and openssl.

./scripts/build-all.sh

A local debug signing key is generated under app-native/.local/signing/, which is gitignored. Official development releases may be signed externally by setting:

ZORIN_SIGNING_KEY=/path/key.pem \
ZORIN_SIGNING_CERT=/path/cert.pem \
./app-native/build.sh

Run ADB Shell Core

From a release bundle on Windows:

Windows launcher scripts are compatible with Windows PowerShell 5.1 and PowerShell 7+.

adb-core/scripts/install-and-start.bat

On Linux/macOS:

./adb-core/scripts/install-and-start.sh

Then use COPY ALL in the APK and compare the APP, SHELL and (when available) SYSTEM CORE sections.

Repository map

• app-native/ — NO-DEX NativeActivity APK.
• bridge/ — ADB Shell Core v3 and host scripts.
• aosp/devicecore/ — Rust/AIDL/SELinux System Device Core sources.
• docs/ — architecture, diagnostic and security model notes.
• scripts/ — repository-level build/sync helpers.

This is a diagnostic/research project, not a privilege-escalation mechanism. It is most useful when it clearly identifies which Android security layer allows or rejects an operation.

Source · Apache-2.0