Tiana Razafindralambo holds a PhD from the University of Limoges, France, on the security of microcontrollers, from smart cards to mobile devices. He is a Senior Security Analyst at eShard and has more than ten years of experience analyzing complex systems and building practical exploitation workflows, from root-cause analysis to reliable proof-of-concepts. His work focuses on embedded, mobile, and connected-device security, with particular emphasis on reverse engineering, low-level vulnerability research, and exploitation scenarios that demand careful debugging and root-cause analysis. He has performed security evaluations of Java Card platforms and applications, as well as Android and iOS applications and Host Card Emulation solutions, and has contributed to research and publications on smart-card security and attack techniques.
Deep Dive into Android Binder
3-Day Hands-On Training ยท Tiana Razafindralambo
In this 3-day hands-on training, participants will understand, reproduce, and exploit CVE-2023-20938 using Time Travel Debugging. Starting from Binder internals and the vulnerable binder_transaction / binder_transaction_buffer_release path, the course guides attendees through building exploitation primitives and achieving local privilege escalation on a vulnerable Android kernel.
Why this training stands out
This course is built around a real Android kernel vulnerability and teaches participants how to move from root-cause understanding to stable exploitation. Rather than stopping at triggering a crash, it walks through the full exploitation journey using Time Travel Debugging to analyze failures, recover from unreliable exploit paths, and ultimately obtain a stable root shell.
What participants will do
- Understand Android Binder internals and the vulnerable code path behind CVE-2023-20938.
- Trigger the bug on a vulnerable Android kernel.
- Study the use-after-free and its impact on kernel memory safety.
- Build exploitation primitives including UaF, leak, controlled unlink write, and arbitrary read.
- Escalate the bug into local privilege escalation.
- Use full-system time-travel recordings to debug a crashing exploit.
- Trace faulty heap-spray eviction and double-kfree behavior back to userland root causes.
- Fix the exploit path to obtain a stable root shell.