Virtualization Apps

App virtualization is a broad term. App virtualization can be achieved in many different ways and not necessarily by virtualizing the Android system. App virtualization is a good term for generalizing the idea of running applications in an irregular environment. Following are a few of the many different flavors of App Virtualization:

Work Profile Isolation

Some of the virtualization apps achieve virtualization by creating a separate work profile and isolating the virtualized app inside it. A work profile is a set up on an Android device to separate “work” apps and data from personal apps and data. The work profile lives on a separate part of the device isolated from the rest of the system. Isolating an app with a work profile is not necessarily good as a potentially malicious app running in regular user space, with root access, probably can’t be detected since the work profile isolated app can only see apps that are in the same work profile. For instance, such an attack strategy is being abused by game hackers that use GameGuardian on a rooted device with root privileges and run the target application in the isolated work profile. "The Island app is an application that is freely available on the Google Play store and allows users to clone particular applications. The Island app is also a good example of “work profile isolation”."

Cloning and Repacking

Another kind of virtualization app achieves virtualization by cloning or repackaging the target application. Usually, the process is straightforward. As a baseline, these apps are getting copied and their package name gets modified to some kind of unique package name. To bypass all kinds of checks and verifications, such virtualization apps inject their own code to patch or hook methods that are responsible for package name and signature retrieval, and other methods to make the application believe that it is the original app. Since the application ID has changed, both the original and cloned app can coexist on the same Android system. That kind of virtualization is the fastest since there is no virtualization overhead. The AppCloner app is one example of this kind of app. AppCloner is also freely available on the Google Play store.

Application Hosts

“Application hosts” are another kind of virtualization technique. Application hosts virtualize by loading the target application into itself and running it. This is a relatively simple approach to virtualizing an app, but it comes with certain limitations. For instance, such Application hosts can usually only run a single instance of the app at a time, or a very limited number of apps at the same time. Some virtualization technologies that employ such a strategy are shipped as SDKs allowing the user to create their own host app for specific apps with specific capabilities. Such SDKs also open possibilities for use of hooking frameworks and just in general application dynamic analysis with instrumentation. VirtualApk and Phantom are notable examples of such a virtualization approach.

Whole Android System Virtualization

Some virtualization apps are virtualizing the whole Android system. A few of them are even booting the whole Android system from any ROM (Read-only memory) image. This kind of virtualization is the slowest but the most powerful one since this approach literally emulates the entire Android phone. Custom ROM images or files can be patched, customized, rooted with Magisk, etc. There is almost no way for a virtualized application to interact with the outside Android system and know what is happening there. Virtualization like this can be used to run target applications in normal looking virtualized Android systems without root access, however, the original Android system could be rooted and run additional dynamic analysis software to tamper with virtualized app. Twoyi is one of the most popular apps that virtualize the whole Android system.

Partial Android Runtime Virtualization

Last but not least, some virtualization apps achieve partial Android system virtualization. Usually, such virtualization apps recreate the majority of the Android system using proxies and dummy processes. Hooking is a very important part of such virtualization techniques since many things need to be intercepted and patched during communication between virtualized app processes and the rest of the system. Also, this method is complicated to maintain between different Android versions and across different Android device vendors. Usually, such a virtualization approach suffers from stability issues. However, the partial Android runtime virtualization technique is one of the most powerful virtualization techniques: A well implemented partial Android runtime virtualization can be completely undetectable. VirtualApp is one of the most famous partial android runtime virtualizations available.