Android Operating System

 The objective of Android is to run user-level apps. Drivers are just buffers, you put data in and you get data out. There is a hardware Abstraction Layer, which abstracts access to drivers to interact with Hardware APIs. There are also native libraries and Android Runtime Libraries as well. There's also a Java Framework and Linux Kernel, which includes the drivers. 

Instead of the Java Virtual Machine, there's an Android Virtual Machine (AVM) now. 

There are also Native C/C++ libraries who use the C/C++ resources to help provide higher level API functionalities so the apps are able to interact with them. Out of all of that, there is a Java API framework, which provides a higher level abstraction for Java-Level apps. The Native Libraries call the HAL which invokes the ports in the Linux Kernel.

An Android App is an APK, or an Application Package Kit. The output is an APK file, and the APK file is installed in the android phone, and it is a compressed archive of the App manifest .xml file, and 3rd party libraries, with compiled Java Classes with Assets, Resources, and the App signature.

In the real world, there's a mechanism to sign your app, provided that you have a certificate.

The signature is an indication that the app is from the developers. 

There are Java Source Code, and various high-level surface interfaces. All of the XML files go to AAPT and that converts this into R.java. This is why you need to get to R.id, R.string, and etc. 

The steps are as follows:

1. Map the resources/interfaces to java files

2. Compile the Java files into lasses

3. Aggregate the Class files into one dex file.

4. Add all the resources to the apk

5. Sign the APK with a private key

6. Align uncompressed parts of the APK.

We can use APKTool to decompile an app, or to build an app again, where you need to do on some cases. 

It will get the class file and .dex files, and we can actually view the code in java. We do something if someone makes some changes to the app and recompile the APK.

Androguard is a Python Tool for Analyzing Android Apps.

We can call multiple commands, like getting:

APK can also used customized apps, which Breaks app signatures. 

Repackaged apps are the leading sources of Android malware. Be careful, nothing comes for free. 

Each app acts like a sandbox, which acts as both CPU and memory protection.

Each application is a different user, and Android is the equivalent of the Java framework + the Linux Kernel. The Application announce permission requirement? How? The inter-component communication reference monitor checks permissions.

A fileSystem check happens at the Kernel. There are many "permission checks" in regards to the app permission model.

Either the app can interact with the framework, or by another app (proxy) in order to perform a permission check.

You can update an app using the Google Assistant.

"Ok Google is  plausible effect." It will ask to unlock if something is not going right here.

The app can be very rudimentary and get all information in the background and get the hostnet. The hostmate an the data is being messaged.

Try to look for fake information, and we should be very careful and not jump into conclusions. Don't approve permissions, and do not open attachments or click on links.

The user Authentication needs to prove user identity. Some authentication mechanism are through patterns, pin, passcode, iris scan, face id, etc. 

Passcodes can be easy to steal passcodes, or shoulder-surfing attacks,, which looks over the shoulder of someone.

Biometrics are not resilient, and should accommodate with changes with user. But then you'll allow slightly larger rooms.

We can also fake voices

There are "fake fingers" and there is a finger from a real human being.