  Smartphones and tablets have become prime targets for malware, due to the
valuable private and corporate information they hold. While Anti-Virus (AV)
program may successfully detect malicious applications (apps), they remain
ineffective against low-level rootkits that evade detection mechanisms by
masking their own presence. Furthermore, any detection mechanism run on the
same physical device as the monitored OS can be compromised via application,
kernel or boot-loader vulnerabilities. Consequentially, trusted detection of
kernel rootkits in mobile devices is a challenging task in practice. In this
paper we present JoKER - a system which aims at detecting rootkits in the
Android kernel by utilizing the hardware's Joint Test Action Group (JTAG)
interface for trusted memory forensics. Our framework consists of components
that extract areas of a kernel's memory and reconstruct it for further
analysis. We present the overall architecture along with its implementation,
and demonstrate that the system can successfully detect the presence of
stealthy rootkits in the kernel. The results show that although JTAG's main
purpose is system testing, it can also be used for malware detection where
traditional methods fail.
