On March 27, I gave a presentation at Black Hat Asia 2015 in Singapore. My session highlighted possible ways to create user-mode rootkits by taking advantage of Androids new runtime. The new Android Runtime (ART) is based on publicly disclosed Android OS code and not leveraging vulnerabilities. The main advantage of ART over Dalvik is better app performance due to ahead-of-time compilation. We can use dex2oat to generate OAT files from modified versions of installed apps or system frameworks.”]
Source: https://securityintelligence.com/hiding-behind-android-runtime/