CyberCode Academy Podcast Por CyberCode Academy arte de portada

CyberCode Academy

CyberCode Academy

De: CyberCode Academy
Escúchala gratis

Welcome to CyberCode Academy — your audio classroom for Programming and Cybersecurity.
🎧 Each course is divided into a series of short, focused episodes that take you from beginner to advanced level — one lesson at a time.
From Python and web development to ethical hacking and digital defense, our content transforms complex concepts into simple, engaging audio learning.
Study anywhere, anytime — and level up your skills with CyberCode Academy.
🚀 Learn. Code. Secure.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
Copyright CyberCode Academy Diario Educación
Episodios
  • Course 42 - Mobile Malware Analysis Fundamentals | Episode 12: Dynamic Analysis Tools, Techniques, and Assessment

    Course 42 - Mobile Malware Analysis Fundamentals | Episode 12: Dynamic Analysis Tools, Techniques, and Assessment
    Sep 8 2026
    This episode covers dynamic analysis of Android applications, with a strong emphasis on runtime interaction, monitoring, and debugging.1. Android Dynamic Analysis with DrozerThe episode introduces Drozer, an Android security assessment framework that allows researchers to interact with application components while they are running.Key capabilities include:
    • Establishing communication between the analysis machine and Android device using ADB port forwarding.
    • Enumerating installed packages and examining metadata such as permissions, UIDs, and package information.
    • Identifying potentially exposed attack surfaces, including:
      • Exported Activities
      • Broadcast Receivers
      • Content Providers
    • Interacting directly with application components to observe their runtime behavior.
    This makes Drozer particularly useful for discovering insecurely exposed Android components that may not be obvious through static analysis alone.2. Runtime File-System MonitoringThe episode introduces FSmon for monitoring file-system activity in real time.Researchers can observe:
    • Files being created or modified.
    • Files being deleted.
    • Changes occurring while an application executes.
    • System-level activity associated with suspicious behavior.
    The collected information can then be analyzed to determine how an application interacts with the underlying operating system.3. Network MonitoringNetwork behavior is investigated using TCPDump.The general workflow is:Android Device → TCPDump → PCAP → WiresharkCapturing traffic allows analysts to investigate:
    • Remote connections.
    • Destination IP addresses.
    • DNS activity.
    • HTTP/HTTPS communications.
    • Potential command-and-control infrastructure.
    • Data transmitted by the application.
    Network analysis is particularly valuable when static analysis reveals suspicious URLs or networking functions but does not establish exactly when or why those connections occur.4. Debugging and InstrumentationThe episode also introduces several debugging approaches:
    • GDB for remote debugging sessions.
    • Android Studio for Java-level debugging.
    • Anbug as an additional Android debugging tool.
    Debugging provides a deeper level of visibility than simple behavioral monitoring because analysts can inspect program execution and investigate what happens at specific points during runtime.5. Connecting Android and iOS AnalysisThe knowledge check reinforces that the same fundamental methodology applies across both platforms:Static Analysis → Hypothesis → Dynamic Analysis → Observation → ConfirmationFor iOS, important concepts include:
    • UIApplicationMain
    • The five application lifecycle states.
    • Method swizzling for modifying or intercepting method behavior during runtime analysis.
    For Android, the focus is on ADB, particularly commands used to:
    • Install applications.
    • Communicate with devices.
    • Forward ports for remote analysis and debugging.
    Overall TakeawayThe major lesson is that static and dynamic analysis are complementary rather than competing approaches.Static analysis tells you:“What could this application do?”Dynamic analysis tells you:“What does this application actually do?”By combining component enumeration, filesystem monitoring, network capture, debugging, and static inspection, an analyst can move from an initial suspicion to a much stronger, evidence-based understanding of a mobile application's behavior.

    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy
    Más Menos
    28 m
  • Course 42 - Mobile Malware Analysis Fundamentals | Episode 11: Dynamic Analysis for iOS and Android

    Course 42 - Mobile Malware Analysis Fundamentals | Episode 11: Dynamic Analysis for iOS and Android
    Sep 7 2026
    Dynamic Mobile Malware Analysis — iOS and AndroidThis episode expands dynamic malware analysis beyond basic runtime observation and introduces process instrumentation, debugging, network capture, and automated mobile-security frameworks across both iOS and Android.The central idea is:Static analysis tells you what a sample may be capable of; dynamic analysis shows what it actually does when executed.1. iOS Dynamic AnalysisThe iOS portion focuses on three major capabilities:Runtime instrumentation with CycriptLow-level debugging with LLDBNetwork monitoring with tcpdump + Wireshark2. Process Injection with CycriptCycript allows researchers to interact with a running iOS process and inspect or manipulate Objective-C objects at runtime.Conceptually:Running Application ↓ Cycript ↓ Attach / Inject ↓ Inspect Runtime Objects ↓ Modify Properties / Invoke Methods ↓ Observe Application Response For example, an analyst can investigate UI objects and modify properties while the application is running.This is useful because it allows researchers to test hypotheses without modifying the original application binary.Possible observations include:UI changesMethod executionObject propertiesRuntime stateApplication responses to manipulated conditions3. Runtime InstrumentationThe important concept is instrumentation.Instead of simply watching the application externally, the analyst gains visibility into the application's internal runtime environment.This can help answer questions such as:Which method is being called?What arguments are being passed?Which objects are created?What happens after a specific condition is satisfied?Does the application execute hidden functionality?This makes runtime instrumentation particularly useful when static analysis identifies an interesting function but its actual behavior remains unclear.4. LLDB and Remote DebuggingThe episode then introduces LLDB, a powerful debugger used for low-level inspection.In a controlled research environment, LLDB can allow an analyst to examine:RegistersMemoryInstructionsBreakpointsProgram executionFunction addressesThis provides a significantly deeper level of visibility than high-level instrumentation.5. ASLR and Address CalculationA major challenge during binary debugging is Address Space Layout Randomization (ASLR).ASLR changes where executable components are loaded into memory.Conceptually:Static Binary Address + Runtime ASLR Slide ↓ Actual Runtime Address Therefore, an analyst may need to determine the ASLR slide before translating an address observed during static analysis into the corresponding address in the running process.This is particularly important when setting breakpoints on specific functions.6. Network Monitoring with tcpdumpDynamic analysis isn't limited to the application's process.Network behavior is often one of the strongest sources of evidence.On a controlled research device, tcpdump can capture network traffic into a PCAP file.Conceptually:iOS Malware ↓ Network Activity ↓ tcpdump ↓ PCAP ↓ Wireshark ↓ Traffic Analysis Wireshark can then help identify:Destination IP addressesDNS queriesConnection patternsProtocolsHTTP trafficSuspicious infrastructureIf traffic is unencrypted, analysts may also be able to inspect transmitted content directly.7. Android Dynamic AnalysisThe Android portion focuses heavily on creating a controlled laboratory environment.The primary components are:MobSFAndroid StudioAndroid Virtual DevicesADB8. MobSF — Automated Mobile AnalysisMobile Security Framework (MobSF) provides automated analysis capabilities for mobile applications.For an APK, it can quickly identify artifacts such as:Dangerous permissionsEmbedded URLsSuspicious stringsApplication componentsSecurity weaknessesPotential indicators of compromiseThis makes MobSF useful for initial triage.However, automated findings should be treated as leads rather than definitive conclusions.A useful workflow is:APK ↓ MobSF ↓ Automated Findings ↓ Interesting Indicators ↓ Manual Static Analysis ↓ Dynamic Analysis 9. Android Virtual DevicesAndroid Studio's Android Virtual Device (AVD) system allows researchers to create isolated Android environments for testing.A malware-analysis environment should be separated from:Personal devicesProduction systemsCorporate networksSensitive accountsImportant filesThe purpose is to reduce the consequences of accidental malware execution.10. Android Debug Bridge — ADBADB is one of the most important tools in Android security research.It provides a command-line interface for communicating with an Android device or emulator.Conceptually:Analyst ↓ ADB ↓ Android Device / Emulator ↓ Application / Files / Processes ADB can be used for tasks such as:Installing APKsRemoving applicationsAccessing a shellTransferring filesCollecting logsInspecting the deviceDebugging applicationsFor example:adb devices can verify that an Android device or emulator is available.An APK can be installed in a controlled lab ...
    Más Menos
    24 m
  • Course 42 - Mobile Malware Analysis Fundamentals | Episode 10: The Essentials of Dynamic Analysis

    Course 42 - Mobile Malware Analysis Fundamentals | Episode 10: The Essentials of Dynamic Analysis
    Sep 6 2026
    Dynamic iOS Malware Analysis — Key Takeaways
    1. Application Entry Point
      • The standard entry point for an iOS application is UIApplicationMain.
      • It initializes the application runtime and connects the application to its App Delegate, which manages important lifecycle events.
    2. Method Swizzling
      • Method swizzling allows an analyst to intercept or replace a class method at runtime.
      • In a controlled malware-analysis environment, you can hook a method responsible for a network/environment check and alter its behavior so the application follows a different execution path.
      • This can help determine what the malware would do if the expected condition were satisfied.
    3. Languages
      • Objective-C is particularly important because iOS runtime behavior and method dispatch are heavily based on Objective-C's runtime.
      • JavaScript is useful when working with Cycript to interact with and manipulate the running process.
    Overall WorkflowStatic Analysis → Identify Interesting Method → Run in Isolated/Jailbroken Lab → Attach with Cycript → Hook/Swizzle Method → Observe Behavior → Document Network/File/System ChangesThe important conceptual transition here is that static analysis tells you what the application appears capable of doing, while dynamic analysis lets you observe what it actually does at runtime.

    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy
    Más Menos
    23 m
adbl_web_anon_alc_button_suppression_t1
Todavía no hay opiniones