Despite its open source roots, the Android security ecosystem is still a black box for most users. To make his Nintendo Switch controllers work with his Android phone, Peter undertook binary patch analysis to uncover and develop a patch for the Android Bluetooth process. This research also identified pathways to patch other features of the phone, specifically the TrustZone kernel driver using an Inline hook to patch and enable interception of secure world communications between user mode processes and Trustlets. Due to significant improvements to the Android security model and chain of trust, this task was unexpectedly difficult, and required rebuilding of the phone's kernel, and implementation of a kernel-to-user in-memory patching driver to avoid unintended changes to the Android system. This talk will walk through the techniques and tools used to peer into the Android security black box, and come up with creative solutions to tricky problems, including patching kernel code, making in-memory changes to a running application and building/packaging an Android kernel.