Why Android APKs Are a Natural LLM Target

▶ Watch (01:39)

Android’s Dalvik executable format decompiles to human-readable Java. That makes APKs a natural fit for LLMs: feed decompiled source to a model and ask it to spot bugs. Static analyzers struggle with the pattern-matching problems Georgi targets — the kind where a developer looks at the code and immediately knows something is wrong, even if no rule fires. LLMs handle those well. Pwn2Own targets also carry no privacy constraint, so the full source goes straight to the API without redaction.

Two-Agent Architecture: Attack Surface Analysis Plus Bug Hunter

▶ Watch (05:39)

The system runs two agents in sequence. The first maps the Android manifest to produce a structured list of entry points — exported activities, intent filters, URI schemes. The second, the bug hunter, receives that list and works through it one component at a time, calling Jadx via MCP to fetch the Android manifest, retrieve method and class source, and search through defined classes. Both agents route through LiteLLM backed by Azure Foundry, with LangFuse handling observability.

The Jadx MCP itself was a forked open-source plugin that embeds an HTTP server inside Jadx and wraps its internal API as REST endpoints. A Python FastMCP layer exposes those endpoints as agent tools: fetch the manifest, get source for a method, get source for a class, list all classes.

What Broke First: Vague Objectives, Bad Errors, and Token Drain

▶ Watch (08:13)

The first prompt was “I’m looking for bugs. This is the app, go and find bugs.” The agent got confused, ran out of tokens, hit tool call limits, and produced nothing. The objective was too vague, and the MCP server made things worse: slow code search, error messages that just said “there’s been an error,” with no hint about what went wrong or how to fix the input.

“I realized at this point I’m dealing with a with an intern.” — Georgi G

The fix was narrowing scope — point the agent at one component, reachable via one specific intent filter, and return actionable errors so it could retry. The agent also kept proposing mitigations. Georgi’s system prompt addition: stop suggesting fixes, stop wasting tokens.

The Pwn2Own Exploit Chain: Smart Touch Call and Bixby WebView Bugs

▶ Watch (11:55)

The agent found over a dozen bugs; two got chained. Smart Touch Call loads an attacker-controlled URL into a WebView whose WebChromeClient silently grants camera, microphone, and geolocation — but only when a call is active. The Smart Touch Call bug report output (15:27) caught the sink, missed both details. Bixby validated only that the URL was a subdomain of mcsvc.samsung.com; those subdomains carry XSS, and a privileged JavaScript interface sits inside. The Bixby host-validation bug report output (17:44) flagged both. One link click opens the Bixby WebView, silently dials a number to satisfy the call check, then hands over the camera feed — the Pwn2Own live demo: one-click camera hijack (18:25).

“it’s also what makes it the perfect meme exploit for for the contest.” — Georgi G

Scaling the Pipeline: Deduplication, Deobfuscation, and Call-Graph Verification

▶ Watch (19:05)

After Pwn2Own, Georgi scaled the pipeline with four targeted fixes. The manifest analysis moved to a standalone deterministic script — no LLM needed for something that predictable. A deobfuscation hook now intercepts every source-code request, renames one- and two-letter method names into something meaningful, then hands the cleaned code to the bug hunter. Running the bug hunter between one and five times per entry point produces divergent results each run; a deduplicator agent collapses those into unique findings. A SootUp-based call-graph verifier checks whether each reported sink is actually reachable — it rejected one bug as unreachable because the code path only executes during an active call.

The roadmap adds ADB MCP and Frida MCP so the agent can trigger its own PoC, watch logcat, and refine the exploit without human involvement.

Notable Quotes

I realized at this point I’m dealing with a with an intern. Georgi G · ▶ 11:12

shut up. Stop wasting my tokens. I don’t care about any of this Georgi G · ▶ 11:51

it it’s it’s it’s shite. But it still found stuff. Georgi G · ▶ 12:14

it’s also what makes it the perfect meme exploit for for the contest. Georgi G · ▶ 16:28

Key Takeaways

  • Scope the agent to one entry point at a time — broad ‘find bugs in this app’ prompts burn tokens and produce nothing.
  • Return actionable error messages from MCP tools so the agent can self-correct input rather than silently fail.
  • Run the bug hunter three to five times per entry point and deduplicate — LLM non-determinism is a feature, not a problem.