WOOTdroid: Whole-system Online On-device Tracing for Android

• URL: http://arxiv.org/abs/2604.27830v1
• Date: Thu, 30 Apr 2026 13:18:24 GMT
• Title: WOOTdroid: Whole-system Online On-device Tracing for Android
• Abstract summary: Existing syscall tracers lose events under load, silently overwriting entries faster than a user space reader can drain them.<n>Security-relevant application behavior is mediated through Binder, Android's kernel IPC mechanism, and is therefore hidden from the syscall layer.<n>We present WOOTdroid, a design and prototype for on-device tracing on stock Android that addresses both problems without OS modification or application instrumentation.
• Score: 16.426489065657716
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: System auditing on Android faces two problems. First, existing syscall tracers lose events under load, silently overwriting entries faster than a user space reader can drain them. Second, security-relevant application behavior is mediated through Binder, Android's kernel IPC mechanism, and is therefore hidden from the syscall layer. The Binder parcels that the kernel does see carry no method names or typed arguments, a disconnect between low-level events and high-level behavior known as the semantic gap. Existing approaches address the semantic gap either by modifying the Android platform, making them difficult to adjust to OS updates, or by instrumenting the traced application in user space, which sophisticated adversaries can evade by bypassing the instrumented framework APIs. We present WOOTdroid, a design and prototype for on-device tracing on stock Android that addresses both problems without OS modification or application instrumentation. WDSys, an eBPF port of eAudit-style syscall auditing, runs on current Android with at most 3.6% Geekbench overhead and traces 33% more syscalls than ftrace. WDBind captures Binder parcels in the kernel and decodes them out-of-process against a framework signature table extracted via Java reflection. We demonstrate WOOTdroid on Pixel 9 devices running Android 16 with an end-to-end case study reconstructing ten security-relevant Binder transactions.

Related papers

• EchoPath: Execution-Level Replayable Memory for GUI Agents [45.101663136838916]
  We introduce EchoPath, a model-agnostic harness that converts artifact-validated GUI trajectories into standardized, parameter-controlled callable memories.<n>Each memory stores task-intent keys, application and state preconditions, flexible input parameters, GUI evidence, validation provenance, and lifecycle state.<n>In experiments with real computer-use tasks, EchoPath reduced median token cost by more than 90% and median execution time by about 60%.
  arXiv  Detail & Related papers  (2026-09-15T04:56:17Z)
• Assessing the Forensic Viability of Android Memory Analysis Across Production Builds: A Cross-Version Study of Security Hardening and Structure Preservation [0.0]
  This paper measures the gap between the unstripped development builds researchers use and the production builds that ship on real hardware.<n>Google has stripped most of that information from the binaries that ship on consumer phones as part of a broader security hardening effort.<n> Static symbols fell from 20,495 entries to zero, dynamic symbols dropped by roughly 60 percent, and source file references disappeared entirely.
  arXiv  Detail & Related papers  (2026-07-15T13:29:37Z)
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• PhoneHarness: Harnessing Phone-Use Agents through Mixed GUI, CLI, and Tool Actions [73.69976712292683]
  PhoneHarness is a mixed-action benchmark and execution harness for studying phone-use agents on verifiable mobile.<n>Its benchmark, PhoneHarness Bench, evaluates whether agents complete tasks with observable side effects, not only whether they produce plausible final answers.<n>Our findings suggest that reliable phone automation depends on action-surface routing and verifiable execution, not only visual GUI control.
  arXiv  Detail & Related papers  (2026-06-12T15:01:32Z)
• Lost in Migration: Exposing Android Framework Vulnerabilities in Parallel Java-Kotlin Implementations [9.349014404468695]
  We observe parallel implementations in the Android Open Source Project (AOSP) where the same component is implemented in both Java and Kotlin.<n>Such divergences are not vulnerabilities by themselves, but they provide useful clues that may reveal flaws in surrounding enforcement logic.<n>This paper presents the first systematic study of Java-Kotlin parallel implementations in the Android framework and examines their security implications.
  arXiv  Detail & Related papers  (2026-06-05T16:15:03Z)
• OpenMobile: Building Open Mobile Agents with Task and Trajectory Synthesis [98.43366988856592]
  We present OpenMobile, an open-source framework that synthesizes high-quality task instructions and agent trajectories.<n>Agents trained on our data achieve competitive results across three dynamic mobile agent benchmarks.
  arXiv  Detail & Related papers  (2026-04-16T14:53:08Z)
• FileGram: Grounding Agent Personalization in File-System Behavioral Traces [79.65734230265521]
  FileGram is a comprehensive framework that grounds agent memory and personalization in file-system behavioral traces.<n>It consists of FileGramEngine, FileGramBench, and FileGramOS.<n>By open-sourcing the framework, we hope to support future research on personalized memory-centric file-system agents.
  arXiv  Detail & Related papers  (2026-04-06T17:49:31Z)
• Shrinking the Kernel Attack Surface Through Static and Dynamic Syscall Limitation [9.260981761468491]
  Linux Seccomp is widely used by the program developers and the system maintainers to secure the operating systems.<n>Docker containers block about only 50 syscalls by default, and lots of unblocked useless syscalls introduce a big kernel attack surface.<n>In this paper, a systematic dependent syscall analysis approach, sysverify, is proposed by combining static analysis and dynamic verification.
  arXiv  Detail & Related papers  (2025-10-04T07:51:08Z)
• Deserialization Gadget Chains are not a Pathological Problem in Android:an In-Depth Study of Java Gadget Chains in AOSP [40.53819791643813]
  Java's Serializable API has a long history of deserialization vulnerabilities, specifically deserialization gadget chains.<n>We design a gadget chain detection tool optimized for soundness and efficiency.<n>Running our tool on the Android SDK and 1,200 Android dependencies, in combination with a comprehensive sink dataset, yields no security-critical gadget chains.
  arXiv  Detail & Related papers  (2025-02-12T14:39:30Z)
• Shelving it rather than Ditching it: Dynamically Debloating DEX and Native Methods of Android Applications without APK Modification [29.467587717542013]
  3DNDroid is a Dynamic Debloating approach targeting both DEX and Native methods in AnDroid apps.<n>It intercepts invocations of debloated bytecode methods to prevent their interpretation, compilation, and execution.<n> Evaluation demonstrates 3DNDroid's ability to debloat 187 DEX methods and 30 native methods across 55 real-world apps.
  arXiv  Detail & Related papers  (2025-01-09T04:34:00Z)
• I Know What You Sync: Covert and Side Channel Attacks on File Systems via syncfs [5.556839719025154]
  We show new types of side channels through the file system that break logical isolation.<n>The file system plays a critical role in the operating system, managing all I/O activities between the application layer and the physical storage device.<n>We construct three side-channel attacks targeting both Linux and Android devices.
  arXiv  Detail & Related papers  (2024-11-16T20:40:08Z)
• GUIOdyssey: A Comprehensive Dataset for Cross-App GUI Navigation on Mobile Devices [47.98821056800437]
  We present GUIOdyssey, a dataset for cross-app mobile GUI navigation.<n>GuiOdyssey comprises 8,334 episodes with an average of 15.3 steps per episode, covering 6 mobile devices, 212 distinct apps, and 1,357 app combinations.<n>We develop OdysseyAgent, an exploratory multimodal agent for long-step cross-app navigation equipped with a history resampler module.
  arXiv  Detail & Related papers  (2024-06-12T17:44:26Z)
• Making 'syscall' a Privilege not a Right [4.674007120771649]
  nexpoline is a secure syscall interception mechanism combining Memory Protection Keys (MPK) and Seccomp or Syscall User Dispatch (SUD) It offers better efficiency than secure interception techniques like ptrace, as nexpoline can intercept syscalls through binary rewriting securely. Notably, it operates without kernel modifications, making it viable on current Linux systems without needing root privileges.
  arXiv  Detail & Related papers  (2024-06-11T16:33:56Z)
• FCOS: A simple and strong anchor-free object detector [111.87691210818194]
  We propose a fully convolutional one-stage object detector (FCOS) to solve object detection in a per-pixel prediction fashion. Almost all state-of-the-art object detectors such as RetinaNet, SSD, YOLOv3, and Faster R-CNN rely on pre-defined anchor boxes. In contrast, our proposed detector FCOS is anchor box free, as well as proposal free.
  arXiv  Detail & Related papers  (2020-06-14T01:03:39Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.