![Page 1: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/1.jpg)
Timeliner“TippedOffbyYourMemoryAllocator”:
Device-WideUserActivitySequencingfromAndroidMemoryImages
RohitBhatia,BrendanSaltaformaggio,SeungJeiYang,AishaAli-Gombe,XiangyuZhang,DongyanXu,
GoldenG.RichardIII
![Page 2: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/2.jpg)
ImportanceofaTimeline
CrimeSceneReconstruction
"involvesevaluatingthecontextofasceneandthephysicalevidencefoundthereinanefforttoidentifywhatoccurredandinwhatorderitoccurred.“
Call/Messagedatabase,Webbrowsing,Chatlogs
![Page 3: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/3.jpg)
ImportanceofaTimeline
AppSpecificLogs
CoarseGrainedActions
NotaDevice-WideTimeline
Call/Messagedatabase,Webbrowsing,Chatlogs
![Page 4: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/4.jpg)
Isthisacrime?NOWhatifappisterminated?Isthisacrime?POSSIBLY–DistractedDriving
ImportanceofaDevice-WideTimeline
Cybercrimestypicallyinvolveavarietyofmobileapps,withcomplexsequencingofuser-actions
NeedaDevice-Widesolutiontorecoverpastuser-actionsthatisnotinfluenceablebythedevice-owner
Netflix
Maps
![Page 5: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/5.jpg)
Persistentstorageisnotenoughtore-sequenceadevice-widetimeline
MemoryForensics
Timelinercomplementsexistingmemoryforensictechniques
GUITAR[CCS2015]BestPaper
VCR[CCS2015] RETROSCOPE[UsenixSec.2016]
DSCRETE[UsenixSec.2014]BestStudentPaper
![Page 6: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/6.jpg)
ActivitiesAsUser-Actions
ActivitiesareAndroidabstractionsfora“single,focusedthingausercando”
WhatsApp VoipActivity RecordAudio CameraActivity
Signal ConversationList Conversation ShareActivity
Dialer InCallActivity CallLogActivity CallDetailActivity
Chase AccountsActivity TransferActivity QuickDepositStart
Netflix HomeActivity SearchActivity MovieDetails
SomeApplicationsandaFewExampleActivities
![Page 7: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/7.jpg)
Android
Apps
ActivitiesAsUser-Actions
ActivitiesareAndroidabstractionsfora“single,focusedthingausercando”
ActivityLifecyclehandledbyActivityManagerServicewhichprovidesdevice-widesupervision
ActivityManagerService
![Page 8: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/8.jpg)
ActivityStackAsASolution?
NoorderingavailablebetweendifferentActivityStacks
ActivityStackscontainthecurrentstate,andnotthepaststate–whichiswhatwewant
DialContactsActivity HomeActivity
SearchActivity
MovieDetailsActivity
Dialer Netflix(Current)
Android
Apps
![Page 9: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/9.jpg)
Timeliner
![Page 10: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/10.jpg)
TimelinerrecoversActivitiesusingkeyself-identifyingdatastructures
Launcher
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
Timeliner
![Page 11: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/11.jpg)
TimelinerrecoversActivitiesusingkeyself-identifyingdatastructures
Inferorderingbasedonallocatedlocationsinmemory
Launcher
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
Launcher
Timeliner
![Page 12: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/12.jpg)
Android
Apps
ResidualDataStructures
ActivityManagerService
MovieDetailsActivity
![Page 13: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/13.jpg)
Android
Apps
ResidualDataStructures
ActivityManagerService
MovieDetailsActivity
![Page 14: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/14.jpg)
Android
Apps
ResidualDataStructures
ActivityManagerService
MovieDetailsActivity
![Page 15: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/15.jpg)
Android
Apps
ResidualDataStructures
ActivityManagerService
Roots
Field/ValueMatches
MovieDetailsActivity
![Page 16: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/16.jpg)
Android
Apps
ResidualDataStructures
ActivityManagerService
MovieDetailsActivitynetflix.ui.MovieDetailsActivity
![Page 17: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/17.jpg)
“First-Available”Allocation
InCallActivity
DialContactsActivity
Launcher
SizeA SizeB SizeC
MemoryAllocator
![Page 18: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/18.jpg)
TemporalOrderingFromSpatialOrdering
{ (r1,a1),(r2,a2),(r3,a3)}
{ (r1,b1),(r2,b2),(r3,b3)}
{ (r1,c1),(r2,c2),(r3,c3)}
InCallActivity
DialContactsActivity
Launcher
SizeA SizeB SizeC
MemoryAllocator
![Page 19: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/19.jpg)
TemporalOrderingFromSpatialOrdering
TransitionGraph
allPrecede(e,f)=|{r|(r,m)∈e∧(r,n)∈f∧max(m)<min(n)}|anySucceed(e,f)=|{r|(r,m)∈e∧(r,n)∈f∧max(m)>min(n)}|
2
3
3
InCallActivity
DialContactsActivity
Launcher
SizeA SizeB SizeC
MemoryAllocator
![Page 20: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/20.jpg)
PruningErroneousEdges
TransitionGraph
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
4
2
3
3
Launcher
1
ErroneousEdge
![Page 21: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/21.jpg)
PruningErroneousEdges
Launcher
PlayerActivity
MovieDetailsActivity
TransitionGraph
4
SizeA SizeB SizeC
ExistingAllocation
Launcher
![Page 22: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/22.jpg)
PruningErroneousEdges
Launcher
DialContactsActivity
PlayerActivity
MovieDetailsActivity
TransitionGraph
4
31
SizeA SizeB SizeC
ExistingAllocation
Launcher
ErroneousEdge
![Page 23: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/23.jpg)
PruningErroneousEdges
Launcher
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
TransitionGraph
4
2
3
3
1
SizeA SizeB SizeC
ExistingAllocation
Launcher
ErroneousEdge
![Page 24: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/24.jpg)
PruningErroneousEdges
Min-Cut
PlayerActivity
UndirectedTransitionGraph
4
2
3
3
Launcher
1
ErroneousEdge
Launcher
SizeA SizeB SizeC
ExistingAllocation
DialContactsActivity
InCallActivity
MovieDetailsActivity
![Page 25: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/25.jpg)
PruningErroneousEdges
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
TransitionGraph
4
2
3
3
Launcher
![Page 26: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/26.jpg)
GlobalOrdering
Launcher
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
TransitionGraph
![Page 27: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/27.jpg)
LocalOrderings
GlobalOrdering
Launcher
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
TransitionGraph
TopologicalSortLauncher
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
![Page 28: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/28.jpg)
LocalOrderings
GlobalOrdering
Launcher
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
TransitionGraph
TopologicalSortLauncher
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
Launcher
OtherAllocations
![Page 29: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/29.jpg)
GlobalOrdering
GlobalOrdering
TransitionGraph
TopologicalSortLauncher
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
Launcher
DialContactsActivity
InCallActivity
PlayerActivity
MovieDetailsActivity
![Page 30: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/30.jpg)
GarbageCollection SizeA SizeB SizeC
GarbageCollectedActivity
PlayerActivity
ConversationList
Conversation
GarbageCollectionfreesuppriorruns,potentiallycausingaspatialdisordering
![Page 31: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/31.jpg)
GarbageCollection SizeA SizeB SizeC
PlayerActivity
OtherAllocations
Launcher
DialContactsActivity
InCallActivity
MovieDetailsActivity
![Page 32: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/32.jpg)
GarbageCollection
PlayerActivity
Launcher
DialContactsActivity
InCallActivity
MovieDetailsActivity
Launcher
JoinableLocalOrderingsdonotendinGarbageCollectedActivities
PeriodofGarbageCollectionActiveUsage:41-50minutesIdle:98-112minutes
![Page 33: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/33.jpg)
TestSequence
#ofActivityOrdered
#OfPaths
GroundTruthDistance
A 16 1 0
B 14 1 0
G 15 1 0
H 16 1 0
I 14 1 0
J 16 1 0
TestSequence
#ofActivityOrdered
#OfPaths
GroundTruthDistance
A 15 1 0
C 15 1 0
D 12 1 0
G 14 1 0
H 14 1 0
I 14 1 0
Micro-BenchmarksTestSequence
#ofActivityOrdered
#OfPaths
GroundTruthDistance
A 16 1 0
B 14 1 0
C 16 1 0
D 12 1 0
E 14 1 0
F 15 1 0
SamsungS4(Android5.0) LGG3(Android5.1) MotoG3(Android6.0)
AccurateResults
RecoveredActivityLaunchedBeforeTestSequence
10TestSequences
A-J
![Page 34: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/34.jpg)
DesignGenerality:SpywareAttackInvestigation
BroadcastY
ActivityA
BroadcastX
ActivityB
TransitionGraph
![Page 35: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/35.jpg)
DesignGenerality:SpywareAttackInvestigation
VideoTimeReceiver
FrontCameraActivity
StopRecordingReceiver
GmailComposeActivity
TransitionGraph
CommunicationReceiver
ConversationActivity
CallRecorderReceiver
InCallActivity
SMSSpyingService CallSpyingService
CameraPictureSpyingService
MicrophoneAudioSpyingService
CameraVideoSpyingService
![Page 36: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/36.jpg)
DesignGenerality:Extensiontojemalloc
SizeA SizeB SizeC
Slot
Android mozjemalloc
Region
Run Run
BinBucket
“First-Available”“First-Available”
![Page 37: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/37.jpg)
CaseStudy
![Page 38: “Tipped Off by Your Memory Allocator”: Device-Wide User ...€¦ · Timeliner “Tipped Off by Your Memory Allocator”: Device-Wide User Activity Sequencing from Android Memory](https://reader033.vdocuments.site/reader033/viewer/2022052004/60175ababb7eac194b74cfa6/html5/thumbnails/38.jpg)
Conclusion
Timelinerre-sequencesanAndroiduser’spastactions,evenforterminatedapplications
TimelinerinferstemporalorderingofActivitiesfrommemorylayoutofkeyself-identifyingdatastructures
AccuratereconstructionofvariousapplicablecrimescenariosandextensionbeyonduseractionsandAndroid