Mobile › Module 2 › Lesson 1
Android Stack
Android stack names Linux kernel, HAL, ART, framework, and apps — map layers on YOUR $MOB_LAB emulator before static or dynamic work.
Visual · t27_android_stack
Android stack literacy. $MOB_LAB only. Original Cyberlium.
Opening
Every permission prompt and sandbox rule sits on a stack — literacy starts with layer names, not random hook scripts.
Android stacks from bottom: Linux kernel and drivers, Hardware Abstraction Layer (HAL), native libraries, Android Runtime (ART) with dex bytecode, Java/Kotlin framework APIs, and your app process in a sandboxed UID. Security boundaries — SELinux, permissions, Binder IPC — live between layers. Cyberlium maps the stack on YOUR $MOB_LAB AVD — note API level and whether Google Play services exist — never diagram a stranger's production handset without scope. Next: Components Named.
1. Stack layers (named)
Kernel: process isolation, networking, device nodes. HAL: vendor hardware interfaces. ART: runs dex/bytecode, JIT/AOT compilation. Framework: ActivityManager, PackageManager, ContentProviders. App: your APK process with its own UID and data directory.
On $MOB_LAB, sketch five layers with one security note each — no live stranger device required.
Command guide
Try these commands — Stack layers (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, python3. Reference sites: Android platform architecture (https://developer.android.com/guide/platform); Android security overview (https://source.android.com/docs/security/overview); OWASP MASTG Android (https://mas.owasp.org/MASTG/0x05a-Platform-Overview/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why stack literacy matters
Static analysis reads APK/dex; dynamic hooks attach at ART/native layers; network tools see transport above kernel. Misplacing a finding — 'kernel bug' vs 'app storage bug' — wastes remediation.
Defenders map controls to layers: SELinux at kernel, permissions at framework, pinning at app/network.
3. Lab boundary
Forbidden: claiming stack knowledge lets you test any device. Allowed: stack diagram card — five layers, one control per layer, $MOB_LAB API level.
Ship: Android stack card for YOUR emulator. Next: Components Named.
4. What you ship: Android stack card for $MOB_LAB
Five layers with one security note each. $MOB_LAB API level named. NO stranger devices. chmod 600.
5. What you record before the next lesson
Date. Stack card. $MOB_LAB named. File t27-m02-l01-android-stack.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip stack literacy and run random Frida scripts. Test stack on borrowed phone.
Right
Write Android stack card for YOUR $MOB_LAB emulator. Next: Components Named.
Mission: map Android stack on YOUR lab
1) Name five stack layers. 2) Add one security control per layer. 3) Record $MOB_LAB API level. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
API level drives permission behavior — note it on every lab card.
Knowledge Check
APPLY: Android stack literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: ART runs app dex/bytecode.
True or False
Knowledge Check
APPLY: Stack literacy supports:
Multiple choice