Allexandre Francisco Vieira dos Santos Relatore
I am a systems engineer and vulnerability researcher specializing in Android OS internals, ARM64 architecture, and native C/C++ development. With a bachelor's degree in Electrical Engineering, my work bridges hardware architecture and low-level software execution. I began my career in commercial Android application development before moving exclusively into systems engineering beneath the application framework.
Driven by a focus on bare-metal behavior and memory virtualization, I built allexOS—a custom operating system written from scratch to master boot routines, CPU state transitions, and process scheduling. In mobile security, I engineered HILDA, a native C dynamic instrumentation engine designed to navigate modern SELinux policies and manipulate ptrace on AArch64 devices.
Today, my research centers on the intersection of OS-level process isolation, hardware abstraction layers, and developing stealthy instrumentation tooling for embedded environments.
Lista Talk
- Anatomy of an Android Injector: Defeating ASLR and SELinux with Pure C Standard dynamic instrumentation frameworks have become the backbone of mobile vulnerability research. However, as anti-tamper mechanisms evolve, relying on off-the-shelf, high-level tools leaves researchers working inside a detectable black box. To truly understand modern Android process isolation, memory constraints, and evasion techniques, security engineers must understand how to execute these injection mechanics at the bare metal. This presentation dissects the architecture of HILDA, a custom-built, pure C dynamic instrumentation engine and ptrace-based loader designed specifically for modern AArch64 Android environments. Rather than relying on standard framework wrappers or installed APK components, I will demonstrate how to hijack a live Android process entirely from the native layer. We will walk step-by-step through the raw mechanics of native .so injection. The talk will cover the practical challenges of using ptrace on AArch64, including interrupting execution, manipulating CPU registers, and saving/restoring process state. I will detail how HILDA defeats ASLR by parsing virtual memory maps (/proc/pid/maps) and performs manual runtime symbol resolution for linker64 and libart to dynamically locate critical execution points in foreign memory. Furthermore, we will explore navigating SELinux memory protections to allocate executable memory in a remote process. To prove the capability, the session will conclude with a technical breakdown of a live payload execution: using the Python-driven orchestrator to force a target process (running on Android 17 / aarch64) to load a custom shared library (libpayload.so), invoking the Android Runtime (ART) via JNI directly from native space, and calling in-process Java APIs (such as getActiveNotifications()) to extract live, structured data (NDJSON) over an ADB pipeline—all without ever installing a target-facing APK. Attendees will leave with a demystified understanding of Android’s lowest-level execution boundaries, equipping them with the knowledge to build custom, stealthy, architecture-specific instrumentation tooling for advanced offensive research. - 16:00/16:45, 21 Nov 2026