REVERSING SAMSUNG'S H-ARX HYPERVISOR FRAMEWORK

Summary from the TLDR InfoSec newsletter

Mobile devices lead security with defense-in-depth strategies, moving sensitive data from untrusted kernels to higher trust levels like hypervisors and secure enclaves. Samsung's Real-time Kernel Protection (RKP), part of Knox on Exynos devices, uses H-Arx Hypervisor to protect the kernel. The post discusses how to reverse the hypervisor framework, which includes a common core (harx.bin) and loadable plug-ins in a proprietary uH format.