STA — UTF-16 Serialization Density Experiment

Experimental v0.2 — Measuring encoding characteristics relevant to Structured Text Amplification

⏳ Status: Experimental

This tool measures encoding and serialization characteristics of different character types. It does not assert that these differences cause resource amplification in Android components. The purpose is to quantify the density differences and to explore whether they correlate with observed STA behaviour.

🔬 Hypothesis under investigation:

This experiment evaluates whether differences in UTF-16 representation could affect downstream Android components that process or serialize string data (Binder, FragmentManager, libminikin, TaskPersister). The goal is to measure the density of different character types and to identify any thresholds where a change in encoding corresponds to a change in observed system behaviour.

Character:

Code points:

(or click a character above)

Generated string (70,000 code points):

📐 Code-point equivalence: —

To match the same UTF-16 footprint as the current character, a different character would require this many code points.

📊 Comparison: all character types at same code-point length

Character	Code points	UTF-16 units	UTF-16 bytes	UTF-8 bytes	UTF-16 / UTF-8 size ratio	UTF-16 bytes / code point

🔍 Threshold exploration

Current test: —

Equivalent ASCII baseline: (e.g., 70,000 ASCII = 140 KB UTF-16)

Equivalent code points needed for current character to match baseline UTF-16 footprint: —
This is the number of code points of the current character that would occupy the same UTF-16 memory as the baseline.

Saves current metrics with timestamp, device, Android version, and observed behaviour

📋 Observation log

No observations recorded yet.

📈 UTF-16 units vs code points

Each point represents a character type at the current code-point length. ● ASCII / BMP  |  ● Non-BMP

📘 About this tool:

• This PoC measures encoding density across different character types.
• The UTF-16 / UTF-8 size ratio indicates how much a string expands in memory.
• The code-point equivalence metric shows how many code points of another type would be needed to match the same UTF-16 footprint.
• The threshold exploration allows you to test whether a given number of code points of a non-ASCII character produces the same observed STA behaviour as a baseline ASCII payload.
• This is a measurement tool. The security impact of these measurements is evaluated separately in the STA research.
• Current STA hypothesis: Differences in UTF-16 representation may affect thresholds for Binder, FragmentManager, and libminikin resource exhaustion.

---

🔍 Next post: STA — Finding the Binder threshold — How many characters does it take to reach the 1 MB limit?

🤝 Collaborate: If you have access to a device running a different Android version or OEM skin, run the experiment and share your results in the comments or on social media with the hashtag #STAresearch. This research is collaborative.

---

📌 Published:
✅ STA — UTF-16 Serialization Density Experiment

📌 Coming next:
⬜ STA — Finding the Binder threshold
⬜ STA-005 — WhatsApp
⬜ STA-015-DL — Google Drive → SystemUI
⬜ STA-017 — Cross-engine ANR

---

— Lostmon · lostmon.blogspot.com

Structured Text Amplification (STA) — Research tool
Whitepaper v5 · lostmon.blogspot.com