I don't understand how this is a valid exploit/vulnerability? How would any device, Android or not, render the actual picture of the message on the GPU without having the unencrypted string in memory? It's not possible. If you have local memory/code execution, you will ALWAYS have access to the messages any client application is rendering/using.
This is an OS-/device-level attack---not an app exploit/attack.
I'd say this guy is trying a little too hard to promote his "Zimperim Mobile Security" brand here...
I am not knowledgeable in this field and I would like to learn more how to do most of these things, what would be a good resource to start off with?
Offset 0056e1c, 0x54ba8a1d is unixepoch 1421511197 - which is January 17th, at 16:13:17GMT - which, given that the author is in Tel Aviv (GMT+2), corresponds with the 6:13PM timestamp for 'Shlookiedo' seen in the photos.
There's literally no way to defend against this attack. About the best they could do is show a warning like "Warning: The version of Android you are using contains vulnerabilities attackers could use to take control of your phone. Please update your softw... buy a new phone to get the latest version of Android."
It is unsurprising that text can be found unencrypted in memory---even while during rendering it has to be decrypted somewhere.
The only mildly surprising/troubling thing was unencrypted data stored in the file one disk on the phone.
