Assessing the Forensic Viability of Android Memory Analysis Across Production Builds: A Cross-Version Study of Security Hardening and Structure Preservation

• URL: http://arxiv.org/abs/2607.13821v1
• Date: Wed, 15 Jul 2026 13:29:37 GMT
• Title: Assessing the Forensic Viability of Android Memory Analysis Across Production Builds: A Cross-Version Study of Security Hardening and Structure Preservation
• Abstract summary: This paper measures the gap between the unstripped development builds researchers use and the production builds that ship on real hardware.<n>Google has stripped most of that information from the binaries that ship on consumer phones as part of a broader security hardening effort.<n> Static symbols fell from 20,495 entries to zero, dynamic symbols dropped by roughly 60 percent, and source file references disappeared entirely.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Android memory forensics recovers evidence that never touches disk: decrypted messages, session credentials, and the live internal state of a running application. The tools that perform this recovery depend on debug symbols embedded in libart.so, the Android Runtime library, to locate data structures and interpret their layout. Across recent releases Google has stripped most of that information from the binaries that ship on consumer phones as part of a broader security hardening effort, yet no prior work has measured how far the stripping has progressed on the devices examiners actually encounter, or whether the memory architecture beneath the stripped surface still resembles what the forensics literature describes. This paper measures the gap between the unstripped development builds researchers use and the production builds that ship on real hardware, using binaries extracted from Pixel factory images across Android 8 through Android 15. Static symbols fell from 20,495 entries to zero, dynamic symbols dropped by roughly 60 percent, and source file references disappeared entirely. A compressed fallback section in the Android 15 binary restores thousands of function names but carries no structure layouts. Source code review and memory map comparisons across Android 8 and 15 show that the heap spaces, garbage collector infrastructure, and allocation bitmaps remain structurally intact, with visible changes limited to naming and arithmetic optimization. Live validation on a rooted, fully stripped Pixel 7 confirms that the runtime entry point is still locatable through the dynamic symbol table, and that structural offsets pulled from a version-matched development build resolve to valid pointers inside production memory.

Related papers

• Thinking With Tools, Not With Pixels: Tool Calls as Text Scaffolds for Visual Reasoning [75.00741348880044]
  Tool-augmented vision-language models increasingly "think with images"<n>Recent work using blind tests, gain decompositions, and attention analyses has shown that returned images contribute little.<n>We hypothesize that the load-bearing signal is the structured text emitted before any returned pixel arrives.
  arXiv  Detail & Related papers  (2026-08-10T14:52:10Z)
• PermaVid: Consistent Video Generation Across Edits via Disentangled Context Memory [80.58558679163197]
  PermaVid is a novel framework built upon a multi-modal context memory that disentangles spatial context into semantic appearance and geometric structure.<n>Our method maintains strong long-term semantic and structural consistency after edits, significantly outperforming state-of-the-art methods.
  arXiv  Detail & Related papers  (2026-06-15T09:20:32Z)
• MemGuard: Preventing Memory Contamination in Long-Term Memory-Augmented Large Language Models [56.31411457917676]
  We introduce MemGuard, a type-aware memory framework that preserves functional memory boundaries during memory construction and retrieval.<n>Across hallucination and long-horizon conversation benchmarks, MemGuard improves memory reliability by up to 28.27% while retrieving up to 5.8x fewer memory tokens than prior methods.
  arXiv  Detail & Related papers  (2026-05-27T06:04:19Z)
• WOOTdroid: Whole-system Online On-device Tracing for Android [16.426489065657716]
  Existing syscall tracers lose events under load, silently overwriting entries faster than a user space reader can drain them.<n>Security-relevant application behavior is mediated through Binder, Android's kernel IPC mechanism, and is therefore hidden from the syscall layer.<n>We present WOOTdroid, a design and prototype for on-device tracing on stock Android that addresses both problems without OS modification or application instrumentation.
  arXiv  Detail & Related papers  (2026-04-30T13:18:24Z)
• Exploring Runtime Evolution in Android: A Cross-Version Analysis and Its Implications for Memory Forensics [0.4771971685916732]
  This paper presents the first systematic study of Android runtime (ART) structural evolution and its implications for memory forensics.<n>Our findings reveal that over 73.2% of structure members underwent positional changes, significantly affecting adaptability and reliability of memory forensic tools.<n>We recommend that memory forensic tools in general and Android in particular evolve toward hybrid approaches.
  arXiv  Detail & Related papers  (2025-12-20T21:59:23Z)
• Automated Insertion of Flushes and Fences for Persistency [2.4669755725204845]
  CXL shared memory and persistent memory allow the contents of memory to persist beyond crashes.<n>Developers must manually flush the corresponding cache lines to force the data to be written to the underlying storage.<n>We present PMRobust, a compiler that automatically inserts flush and fence operations to ensure that code using persistent memory is free from missing flush and fence bugs.
  arXiv  Detail & Related papers  (2025-09-23T18:14:21Z)
• Text2Mem: A Unified Memory Operation Language for Memory Operating System [59.082901444153684]
  We introduce Text2Mem, a unified memory operation language for model agents.<n>Text2Mem provides a standardized pathway from natural correctness reliable execution.
  arXiv  Detail & Related papers  (2025-09-14T07:30:09Z)
• LeakGuard: Detecting Memory Leaks Accurately and Scalably [3.256598917442277]
  LeakGuard is a memory leak detection tool which provides satisfactory balance of accuracy and scalability.<n>For accuracy, LeakGuard analyzes the behaviors of library and developer-defined memory allocation and deallocation functions.<n>For scalability, LeakGuard examines each function of interest independently by using its function summary and under-constrained symbolic execution technique.
  arXiv  Detail & Related papers  (2025-04-06T09:11:37Z)
• ReF Decompile: Relabeling and Function Call Enhanced Decompile [50.86228893636785]
  The goal of decompilation is to convert compiled low-level code (e.g., assembly code) back into high-level programming languages.<n>This task supports various reverse engineering applications, such as vulnerability identification, malware analysis, and legacy software migration.
  arXiv  Detail & Related papers  (2025-02-17T12:38:57Z)
• Keep Me Updated: An Empirical Study of Proprietary Vendor Blobs in Android Firmware [2.124303952404961]
  We examine over 13,000 Android firmware releases between January 2018 and April 2024. About 82% of firmware releases contain outdated GPU blobs (up to 1,281 days) A significant number of blobs also rely on obsolete LLVM core libraries released more than 15 years ago.
  arXiv  Detail & Related papers  (2024-10-14T20:36:12Z)
• Recurrent Dynamic Embedding for Video Object Segmentation [54.52527157232795]
  We propose a Recurrent Dynamic Embedding (RDE) to build a memory bank of constant size. We propose an unbiased guidance loss during the training stage, which makes SAM more robust in long videos. We also design a novel self-correction strategy so that the network can repair the embeddings of masks with different qualities in the memory bank.
  arXiv  Detail & Related papers  (2022-05-08T02:24:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.