FANS
A fuzzing tool for discovering vulnerabilities in Android native system services through automated interface analysis and testing.
What is FANS?
FANS is a fuzzing tool specifically designed for discovering security vulnerabilities in Android native system services. It provides a complete framework with four integrated components that work together to collect service interfaces, extract their models, infer dependencies, and execute targeted fuzzing. The tool helps security researchers identify weaknesses in critical Android components that could be exploited by attackers.
Security researchers, Android system developers, and penetration testers who need to analyze and test the security of Android's native system services. It's particularly valuable for those conducting security assessments of Android devices and custom ROMs.
FANS offers a specialized, systematic approach to Android system service fuzzing that goes beyond generic fuzzing tools. Its multi-component architecture provides deep insight into service interfaces and their dependencies, enabling more effective vulnerability discovery compared to traditional fuzzing methods.
Overview
FANS: Fuzzing Android Native System Services
Use Cases
Best For
- Security researchers analyzing Android system service vulnerabilities
- Penetration testing of Android devices and custom ROMs
- Android system developers validating service interface security
- Academic research on Android security and fuzzing techniques
- Device manufacturers conducting security assessments
- Finding zero-day vulnerabilities in Android native components
Not Ideal For
- Teams conducting quick vulnerability scans or penetration testing with tight deadlines
- Developers fuzzing userland Android applications or non-native components
- Projects targeting the latest Android versions without modification efforts
- Organizations lacking in-house expertise in AOSP compilation and system-level debugging
Pros & Cons
Pros
Automatically collects and extracts detailed models of Android native system service interfaces, enabling deep structural understanding for effective fuzzing, as highlighted in the four-component architecture.
Infers dependencies between service interfaces, allowing for more targeted and realistic test case generation, which is critical for uncovering complex vulnerabilities in system services.
Backed by a peer-reviewed paper presented at USENIX Security'20, indicating thorough research and validation of the methodology, adding credibility to its approach.
Provides extensive customization options through the fans.cfg file, allowing users to tailor the setup to specific environments and requirements, as detailed in the config section.
Cons
Requires compiling AOSP twice (with and without ASan), significant resources (1T SSD disk, many cores), and manual modifications to system files, making it impractical for quick or lightweight use.
Tested only on Android 9.0.0_r46 for Pixel 2 XL, so compatibility with newer Android versions or other devices is uncertain and may require substantial adaptation.
The README is brief and points to separate readme files for each component, which may lack step-by-step guidance or troubleshooting help, increasing the learning curve.
The disclaimer warns of uncertain outcomes, and modifying system properties (e.g., ro.adb.secure) could brick devices or require manual recovery, posing risks for non-experts.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.