The story starts where one of the previous stories you have heard about Android ends, with arbitrary code execution in both userland and kernel. Let’s assume we have defused SELinux, bypassed seccomp limitations and have full privileges over Linux kernel. What could we do next?

While Android lives in plain sight, the secure world lives in its shadow. Let us put light on it! First, let’s coin a few terms: