Black-Box Fuzzing for Android Native Libraries

Many Android application developers are adopting C\C++ native language development in their Android mobile applications to exceed Java limits for performance issues. The use of native development in Android occurs by either using a known library in the application or using an in-house developed native library. Without the source code of native libraries, this could be a blind spot for penetration testers. Demonstrating the process of finding native functions, capturing a sample input data, and writing an Android application wrapper to implement and fuzz the native functions with AFL fuzzer may prove useful for mobile penetration testers to shed light on detecting memory management issues in Android.