Mobile › Module 2 › Lesson 1
Android Stack
Android stack names Linux kernel, HAL, ART, framework, and apps — map layers on YOUR $MOB_LAB emulator before static or dynamic work.
Visual · t27_android_stack
Android stack literacy. $MOB_LAB only. Original Cyberlium.
Opening
Every permission prompt and sandbox rule sits on a stack — literacy starts with layer names, not random hook scripts.
Android stacks from bottom: Linux kernel and drivers, Hardware Abstraction Layer (HAL), native libraries, Android Runtime (ART) with dex bytecode, Java/Kotlin framework APIs, and your app process in a sandboxed UID. Security boundaries — SELinux, permissions, Binder IPC — live between layers. Cyberlium maps the stack on YOUR $MOB_LAB AVD — note API level and whether Google Play services exist — never diagram a stranger's production handset without scope. Next: Components Named.
1. Stack layers (named)
Kernel: process isolation, networking, device nodes. HAL: vendor hardware interfaces. ART: runs dex/bytecode, JIT/AOT compilation. Framework: ActivityManager, PackageManager, ContentProviders. App: your APK process with its own UID and data directory.
On $MOB_LAB, sketch five layers with one security note each — no live stranger device required.
Command guide
Try these commands — Stack layers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Android platform architecture — https://developer.android.com/guide/platform (stack literacy) Android security overview — https://source.android.com/docs/security/overview (Linux kernel → app layer) OWASP MASTG Android — https://mas.owasp.org/MASTG/0x05a-Platform-Overview/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
python3 - <<'PY'
layers = ['Linux kernel', 'HAL', 'Native libs', 'Android Runtime (ART)', 'Framework', 'Apps']
print('Android stack literacy (YOUR lab context):')
for i, layer in enumerate(layers, 1): print(f' {i}. {layer}')
print('Security boundary: sandbox + permissions between apps')
PYCommand — copy this
curl -sS https://developer.android.com/guide/platform | head -8
Primary tools to practice this lesson: curl, python3. Reference sites: Android platform architecture (https://developer.android.com/guide/platform); Android security overview (https://source.android.com/docs/security/overview); OWASP MASTG Android (https://mas.owasp.org/MASTG/0x05a-Platform-Overview/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why stack literacy matters
Static analysis reads APK/dex; dynamic hooks attach at ART/native layers; network tools see transport above kernel. Misplacing a finding — 'kernel bug' vs 'app storage bug' — wastes remediation.
Defenders map controls to layers: SELinux at kernel, permissions at framework, pinning at app/network.
3. Lab boundary
Forbidden: claiming stack knowledge lets you test any device. Allowed: stack diagram card — five layers, one control per layer, $MOB_LAB API level.
Ship: Android stack card for YOUR emulator. Next: Components Named.
4. What you ship: Android stack card for $MOB_LAB
Five layers with one security note each. $MOB_LAB API level named. NO stranger devices. chmod 600.
5. What you record before the next lesson
Date. Stack card. $MOB_LAB named. File t27-m02-l01-android-stack.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip stack literacy and run random Frida scripts. Test stack on borrowed phone.
Right
Write Android stack card for YOUR $MOB_LAB emulator. Next: Components Named.
Mission: map Android stack on YOUR lab
1) Name five stack layers. 2) Add one security control per layer. 3) Record $MOB_LAB API level. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
API level drives permission behavior — note it on every lab card.
Knowledge Check
APPLY: Android stack literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: ART runs app dex/bytecode.
True or False
Knowledge Check
APPLY: Stack literacy supports:
Multiple choice