Android Application Framework provides a whole bunch of system services, such as PackageManagerService, ActivityManagerSerive. Most of the services are in the System Server process. The framework also provides a whole bunch of APIs to apps in the form of a set of proxy classes, such that when an app invokes proxy.API_foo(), the invocation will be handled, through the Binder mechanism, as a Remote Procedural Call by one of the system services.
My question is that, since all the proxy classes are in the memory address space of the app process, isn't is vulnerable to attacks by a hacked app? E.g., I can overwrite the "this" pointer of a proxy class of interest, such that "this" points to an arbitrary virtual function table.
Does the system provide any write-protection for those proxy class objects, so that they cannot be manipulated?
You may be wondering why I asked this silly question. Some apps rely on system service calls to return correct values for some security purposes:
I am considering such scenario: assuming you can add code into an app, and the malicious code can manipulate the memory storing the proxy classes, I guess I can hack/fool the high-value app (say a banking app, a health care app) somehow by returning fake values when system service APIs are called.
I found this but don't quite get it: http://shadowwhowalks.blogspot.com/2013/02/android-replacing-system-classes.html
I also found a paper: http://ceur-ws.org/Vol-1575/paper_10.pdf
But the hacking requires the root privilege. Is that really necessary?
Links about System Services: