Android Operating System

Android is a Linux-based operating system, which means that many Linux concepts and commands apply to Android devices as well. Once shell access is obtained, users can interact with the device through a command-line interface, navigate the file system, manage files, and inspect system components.

Android Software Stack

Android is built on a layered architecture consisting of six main components as shown in the followng diagram:

Reference: https://developer.android.com/guide/platform

Linux Kernel

The Linux kernel is the foundation of the Android platform, and is responsible for managing device hardware such as the display, camera, bluetooth, wifi, audio, USB, and more. Android Runtime also relies on this layer to perform functionalities like threading and memory management.

Additionally, the Linux kernel allows Android to take advantage of numerous security features (like a user-based permissions model and process isolation) that:

• Prevent users from reading each other's files.
• Prevent users from exhausting each other's memory.
• Prevent users from exhausting CPU resources.
• Prevent users from exhausting devices resources, like telephony, GPS, and Bluetooth.

Hardware Abstraction Layer (HAL)

The Hardware Abstraction Layer (HAL) is a software layer that provides the Android operating system with a standardized interface for interacting with hardware components, such as cameras, Bluetooth, sensors, and input devices. Acting as a bridge between hardware and the higher-level software layers, HAL ensures consistency in how software accesses hardware features. Because different hardware components may have unique requirements and capabilities, writing portable software that works across devices can be challenging. HAL addresses this by isolating hardware-specific implementation details from the Android framework. It is implemented as a collection of shared libraries that are dynamically loaded by the Android framework at runtime. This architecture allows device manufacturers to implement custom support for their hardware while maintaining compatibility with the broader Android platform.

Android Runtime

Android Runtime (ART) is the managed runtime environment used by the Android operating system to execute applications. Introduced in Android 5.0 Lollipop as a replacement for the Dalvik virtual machine, ART brought significant architectural improvements to app execution. The primary distinction between ART and Dalvik lies in their compilation strategies: ART uses Ahead-of-Time (AOT) compilation, while Dalvik relied on Just-in-Time (JIT) compilation. With AOT, application code is compiled into native machine code at install time, resulting in faster app launch times and improved runtime performance.

ART is capable of running multiple virtual machines concurrently, even on low-memory devices, and it executes applications packaged in the DEX (Dalvik Executable) format. Importantly, ART maintains backward compatibility with applications originally built for Dalvik. Some of the core features and benefits of Android Runtime include:

• Improved garbage collection.
• Better memory management.
• Better debugging support.
• Optimized compression of the DEX file.

Native C/C++ Libraries

The Native C/C++ Libraries component is a set of libraries written in the C and C++ programming languages, and are included in the Android operating system. Developers generally use these libraries to achieve high performance or write low-level code to interact directly with the hardware. Hardening techniques for increasing security can also be implemented using native C++ code.

Android components like ART and HAL are created using native code, and in order for these components to work, access to native libraries is needed. Applications can access these libraries through the Java Native Interface (JNI), while programmers can use the Android NDK to access native libraries directly from their native code.

Java API Framework

Another essential part of the Android platform architecture is Java API Framework. This component provides software tools and interfaces for building Android applications. Below are some of the components that Java API Framework provides.

• View System
• Resource Manager
• Notification Manager
• Activity Manager
• Content Providers
• Location Manager
• Package Manager

System Apps

System Apps is the top layer core component of the platform architecture. This component includes all the pre-installed applications that come with the Android operating system. Such apps include:

• Contacts
• Messaging
• Camera
• Browser
• Calendar
• Maps
• Settings

Pre-installed apps can only be modified on rooted devices. However, developers can use them in their applications using the provided APIs. For example, a developer could create an app that uses the camera to scan a QR code.

Dalvik VM

The Dalvik Virtual Machine (DVM) was developed by Google and introduced with the first version of Android in 2008. Android applications written in Java or Kotlin are compiled into Java bytecode and then transformed into Dalvik bytecode, packaged in .dex (Dalvik Executable) or .odex (Optimized Dalvik Executable) file formats. Unlike the Java Virtual Machine (JVM), which is stack-based, the Dalvik VM is a register-based virtual machine. This architectural difference allows for more efficient execution on devices with limited CPU and memory resources, which is ideal for mobile environments.

Dalvik was the default runtime environment in Android versions prior to API level 21 (Lollipop). It was eventually replaced by the Android Runtime (ART), which was introduced as a preview in Android 4.4 (KitKat) and became the default in Android 5.0. ART maintains compatibility by using the same .dex bytecode format as Dalvik, but differs significantly in its execution model. While Dalvik used Just-in-Time (JIT) compilation, ART initially used Ahead-of-Time (AOT) compilation — compiling bytecode into native machine code at install time, resulting in faster startup and improved performance. In later Android versions, ART evolved to include hybrid JIT + AOT and Profile-Guided Optimizations (PGO), further enhancing runtime efficiency and battery performance.

Rooting

Android separates the flash storage into the following two main partitions.

• /system/
• /data/

The partition /system/ is used by the operating system, and the partition /data/ is used for user data and application installations. In Android, users don't have root access to the operating system, and some partitions (like /system/) are read-only. However, rooting the device can be achieved by exploiting security flaws. Having a rooted device enhances the capabilities and customizability of the device, and helps with debugging and overall security assessments. Rooted Android devices are also more susceptible to malicious viruses and malware, since the rooting process disables some of the built-in security features of the operating system. In some models like Google Pixel and OnePlus, rooting can also be achieved by unlocking the bootloader via the OEM Unlocking option.

Important Directories

Android's file structure is very similar to other Linux distributions. The directories listed below are some of the most important to consider while conducting Android app assessments.

Directory	Description
/data/data	Contains all the applications that are installed by the user.
/data/user/0	Contains data that only the app can access.
/data/app	Contains the APKs of the applications that are installed by the user.
/system/app	Contains the pre-installed applications of the device.
/system/bin	Contains binary files.
/data/local/tmp	A world-writable directory.
/data/system	Contains system configuration files.
/etc/apns-conf.xml	Contains the default Access Point Name (APN) configurations. APN is used for the device to connect to the carrier's network.
/data/misc/wifi	Contains WiFi configuration files.
/data/misc/user/0/cacerts-added	User certificate store. Contains certificates added by the user.
/etc/security/cacerts/	System certificate store. Non-root users do not have permission to access it.
/sdcard	Contains a symbolic link to directories such as DCIM, Downloads, Music, Pictures, etc.