Exploring Runtime Evolution in Android: A Cross-Version Analysis and Its Implications for Memory Forensics

• URL: http://arxiv.org/abs/2512.18517v1
• Date: Sat, 20 Dec 2025 21:59:23 GMT
• Title: Exploring Runtime Evolution in Android: A Cross-Version Analysis and Its Implications for Memory Forensics
• Abstract summary: This paper presents the first systematic study of Android runtime (ART) structural evolution and its implications for memory forensics.<n>Our findings reveal that over 73.2% of structure members underwent positional changes, significantly affecting adaptability and reliability of memory forensic tools.<n>We recommend that memory forensic tools in general and Android in particular evolve toward hybrid approaches.
• Score: 0.4771971685916732
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Userland memory forensics has become a critical component of smartphone investigations and incident response, enabling the recovery of volatile evidence such as deleted messages from end-to-end encrypted apps and cryptocurrency transactions. However, these forensics tools, particularly on Android, face significant challenges in adapting to different versions and maintaining reliability over time due to the constant evolution of low-level structures critical for evidence recovery and reconstruction. Structural changes, ranging from simple offset modifications to complete architectural redesigns, pose substantial maintenance and adaptability issues for forensic tools that rely on precise structure interpretation. Thus, this paper presents the first systematic study of Android Runtime (ART) structural evolution and its implications for memory forensics. We conduct an empirical analysis of critical Android runtime structures, examining their evolution across six versions for four different architectures. Our findings reveal that over 73.2% of structure members underwent positional changes, significantly affecting the adaptability and reliability of memory forensic tools. Further analysis of core components such as Runtime, Thread, and Heap structures highlights distinct evolution patterns and their impact on critical forensic operations, including thread state enumeration, memory mapping, and object reconstruction. These results demonstrate that traditional approaches relying on static structure definitions and symbol-based methods, while historically reliable, are increasingly unsustainable on their own. We recommend that memory forensic tools in general and Android in particular evolve toward hybrid approaches that retain the validation strength of symbolic methods while integrating automated structure inference, version-aware parsing, and redundant analysis strategies.

Related papers

• Adaptive Protection for Evolutionary Feature Construction in Symbolic Regression with Application to Credit Classification [16.576526450285936]
  This paper introduces an adaptive protection mechanism that leverages feature importance metrics to selectively preserve constructed features during evolution.<n>The mechanism provides stronger protection for more important constructed features while still allowing less important features to be modified and to incorporate useful building blocks from more important features.
  arXiv  Detail & Related papers  (2026-08-14T11:36:31Z)
• Causal-AgentIR: Self-Evolving Causal Memory for Adaptive Image Restoration Agents [54.85451496831771]
  Causal-AgentIR is a hierarchical multi-agent framework with self-evolving causal memory for collective image restoration intelligence.<n>It organizes degradation patterns, image regions, restoration tools, actions, quality changes, and user preferences into a structured causal memory graph.<n>This graph supports graph-based retrieval and multi-hop causal reasoning, enabling agents to infer how specific restoration operations or tool sequences affect restoration quality under different degradation conditions.
  arXiv  Detail & Related papers  (2026-07-23T09:59:44Z)
• Dynamic analysis enhances issue resolution [53.50448142467294]
  DAIRA (Dynamic Analysis-enhanced Issue Resolution Agent) is an automated repair framework that embeds dynamic analysis into the agent's reasoning cycle.<n> Driven by a Test Tracing-Driven methodology, DAIRA utilizes lightweight monitors to extract critical runtime data.<n>When powered by Gemini 3 Flash Preview, DAIRA establishes a new state-of-the-art (SOTA) performance, achieving a 79.4% resolution rate on the SWE-bench Verified dataset.
  arXiv  Detail & Related papers  (2026-03-23T14:48:54Z)
• Architecture-Aware Multi-Design Generation for Repository-Level Feature Addition [53.50448142467294]
  RAIM is a multi-design and architecture-aware framework for repository-level feature addition.<n>It shifts away from linear patching by generating multiple diverse implementation designs.<n>Experiments on the NoCode-bench Verified dataset demonstrate that RAIM establishes a new state-of-the-art performance.
  arXiv  Detail & Related papers  (2026-03-02T12:50:40Z)
• Anatomy of Agentic Memory: Taxonomy and Empirical Analysis of Evaluation and System Limitations [6.566696478685466]
  Agentic memory systems enable large language model (LLM) agents to maintain state across long interactions.<n>Existing benchmarks are often underscaled, evaluation metrics are misaligned with semantic utility, performance varies significantly across backbone models.<n>This survey presents a structured analysis of agentic memory from both architectural and system perspectives.
  arXiv  Detail & Related papers  (2026-02-22T19:50:01Z)
• DynaQuery: A Self-Adapting Framework for Querying Structured and Multimodal Data [0.0]
  We present DynaQuery, a unified, self-adapting framework for querying unstructured data.<n>At the heart of DynaQuery lies the Introspection and Linking Engine (SILE), a novel systems primitive that elevates schema linking to a first-class query planning phase.<n>Our findings provide a validated architectural basis for developing natural language database interfaces that are robust, adaptable, and predictably consistent.
  arXiv  Detail & Related papers  (2025-10-20T19:02:35Z)
• PISA: A Pragmatic Psych-Inspired Unified Memory System for Enhanced AI Agency [50.712873697511206]
  Existing work often lacks adaptability to diverse tasks and overlooks the constructive and task-oriented role of AI agent memory.<n>We propose PISA, a pragmatic, psych-inspired unified memory system that treats memory as a constructive and adaptive process.<n>Our empirical evaluation, conducted on the existing LOCOMO benchmark and our newly proposed AggQA benchmark for data analysis tasks, confirms that PISA sets a new state-of-the-art by significantly enhancing adaptability and long-term knowledge retention.
  arXiv  Detail & Related papers  (2025-10-12T10:34:35Z)
• An Improved Time Series Anomaly Detection by Applying Structural Similarity [17.056935729423667]
  We propose StrAD, a novel structure-enhanced anomaly detection approach.<n>We show that StrAD improves the performance of state-of-the-art reconstruction-based models across five real-world anomaly detection datasets.
  arXiv  Detail & Related papers  (2025-09-24T14:45:00Z)
• CellPainTR: Generalizable Representation Learning for Cross-Dataset Cell Painting Analysis [51.56484100374058]
  We introduce CellPainTR, a Transformer-based architecture designed to learn foundational representations of cellular morphology.<n>Our work represents a significant step towards creating truly foundational models for image-based profiling, enabling more reliable and scalable cross-study biological analysis.
  arXiv  Detail & Related papers  (2025-09-02T03:30:07Z)
• Deep Learning Models for Robust Facial Liveness Detection [56.08694048252482]
  This study introduces a robust solution through novel deep learning models addressing the deficiencies in contemporary anti-spoofing techniques.<n>By innovatively integrating texture analysis and reflective properties associated with genuine human traits, our models distinguish authentic presence from replicas with remarkable precision.
  arXiv  Detail & Related papers  (2025-08-12T17:19:20Z)
• Dynamic Symbolic Execution for Semantic Difference Analysis of Component and Connector Architectures [0.3299877799532224]
  This paper investigates the application of Dynamic Symbolic Execution (DSE) for semantic difference analysis of component-and-connector architectures.<n>We have enhanced the existing MontiArc-to-Java generator to gather both symbolic and concrete execution data at runtime.<n>We evaluate various execution strategies based on the criteria of runtime efficiency, minimality, and completeness.
  arXiv  Detail & Related papers  (2025-08-01T16:24:58Z)
• AlphaFold Database Debiasing for Robust Inverse Folding [58.792020809180336]
  We introduce a Debiasing Structure AutoEncoder (DeSAE) that learns to reconstruct native-like conformations from intentionally corrupted backbone geometries.<n>At inference, applying DeSAE to AFDB structures produces debiased structures that significantly improve inverse folding performance.
  arXiv  Detail & Related papers  (2025-06-10T02:25:31Z)
• Geometric Deep Learning for Structure-Based Drug Design: A Survey [83.87489798671155]
  Structure-based drug design (SBDD) leverages the three-dimensional geometry of proteins to identify potential drug candidates. Recent advancements in geometric deep learning, which effectively integrate and process 3D geometric data, have significantly propelled the field forward.
  arXiv  Detail & Related papers  (2023-06-20T14:21:58Z)
• On the interplay of adversarial robustness and architecture components: patches, convolution and attention [65.20660287833537]
  We study the effect of adversarial training on the interpretability of the learnt features and robustness to unseen threat models. An ablation from ResNet to ConvNeXt reveals key architectural changes leading to almost $10%$ higher $ell_infty$-robustness.
  arXiv  Detail & Related papers  (2022-09-14T22:02:32Z)
• Comparative Code Structure Analysis using Deep Learning for Performance Prediction [18.226950022938954]
  This paper aims to assess the feasibility of using purely static information (e.g., abstract syntax tree or AST) of applications to predict performance change based on the change in code structure. Our evaluations of several deep embedding learning methods demonstrate that tree-based Long Short-Term Memory (LSTM) models can leverage the hierarchical structure of source-code to discover latent representations and achieve up to 84% (individual problem) and 73% (combined dataset with multiple of problems) accuracy in predicting the change in performance.
  arXiv  Detail & Related papers  (2021-02-12T16:59:12Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.