Dumping Android application memory with fridump

Say you need to dump an Android application’s memory, for example, to check whether or not sensitive information is kept in memory longer than it needs to be, this is a usual test case for applications handling highly sensitive information.

Any data that is required by the application needs to be in memory at some point in time, that’s for sure. However, the recommendation is to keep that data in memory only for the time strictly necessary and, when no longer needed, to remove it out of the memory.

For applications handling highly sensitive information this is important because an attacker may be able to access the application’s memory contents via a memory dump, a crash dump or through physical access and, if the data is still in memory, then it may be compromised.

Immutable objects

According to the documentation “an object is considered immutable if its state cannot change after it is constructed“, for instance, if you use a String object to hold sensitive information, that object is immutable; meaning that, if you try to change it’s contents, a new instance of a String object will be created, but the old one will remain unmodified.

In short, immutable objects are kept in memory until a garbage collection is triggered by the system. If you try to empty (or zero out) and immutable object, you are simply creating a new instance of an object, but the initial value remains in memory.

Dumping an application memory

Dumping an application memory will let you inspect the contents of the memory to check if sensitive information is kept for longer than needed. Enter fridump, “an open source memory dumping tool” that leverages the power or frida to dump the memory of an application.

If you want to learn more about frida check out the below article where we discuss how to setup and it’s basic usage for bypassing SSL Pinning on Android applications.

Bypassing Android SSL Pinning with FRIDA

Do note that the frida package is now divided into two different packages, frida-tools and frida. To install it you would do something like shown below:

#pip install frida-tools

#pin install frida

Running frida

To run frida you first need to push the frida-server into de Android device and run the executable within the device as well by means of an adb shell:

#./frida-server &

Back on your workstation you can check the connection to the frida server by using the frida-ps command with the -U options to connect to the already connected usb device:

#frida-ps -U

Using fridump

Once frida is setup, using fridump is quite simple, you just need need to clone or download the github repository here and follow the usage instructions. Let’s first run fridum help to understand what the tool can do:

#python fridump.py --help

Now, if we want to dump the memory of a specific application, we first need to run the application and make sure the sensitive information is put on memory. For this example we are going to use the application shown below, we login with credentials foouser@domain.com and foopassword:

Now we need the name of the application package, we can extract this information from the AndroidManifest.xml configuration file, in this case the package name is com.example.root.mobilesec and we run fridump on this package and use -U to connect to the usb device and -s to get the list of strings:

#python fridump.py -U -s com.example.root.mobilesec

This creates a folder in the current directory called dump and a file named strings.txt which contains all the memory strings, we inspect this file looking for the sensitive information (the password) and see that the data is still in memory: