Fast Rev-eng Is Definitely Awesome

Android Frida tutorial for 2019 AVAR

---

Authors: · Hsun-Jen Hsu (Vash Hsu) · Jen-Yu Tsai (Bill Tsai)

---

URLs and HTTPS Parameters

Network Traffic Inspection on TsSdk

Disconnected Network

script	sample/article
case_Android_HTTP_Inspect.js	C77D6BDE542CB19D919D01AAC5A3F2D572CF58CC2DFBD0E9B37CC8C73E438BBA
.	Adware Plagues Google Play Store. Retrieved September, 2019, from https://blog.avast.com/adware-plagues-google-play

---

Identity-Specific Malware

Root Detection and Evasion on Android

script	sample/article
frida_antiroot.js	https://play.google.com/store/apps/details?id=com.joeykrim.rootcheck&hl=en

IMEI Blacklist: BlackBaby

script	sample/article
case_blackbaby_adware.js	DE6706D324B667F2E7ED100D23D6B435651D55D49385790C5EF096BB222E6DA0
.	儿童游戏木马无所遁形 Retrieved September, 2019, from https://m.qq.com/security_lab/news_detail_462.html

script	sample/article
case_Android_Property_IMEI.js	com.example.imei.checker

---

The Variations of Dynamic Payloads

Dropper, Calling unlink/remove to Hide Files

case_Android_File_IO.js

script	sample/article
case_Banker_Dropper.js	46AEB04F2F03EBE7C716FC6E58A5DEA763CD9B00EB7A466D10A0744F50A7368F

Dropper in Advanced, DexClassLoader

script	sample/article
case_Android_dexClassLoader_hook.js	26A983760B78310BBD30CD4A75F72EA24C940303E27F059A6A80720EA25CAE5F

---

The Tricky In-Memory Cache

script	sample/article
case_Android_Cipher_Inspect.js	https://www.apklab.io/apk.html?hash=888e9a34a076b6f765f6fb3b54c885cfa3ab716ccf82a6cc56d057611a740932

Encrypting Ransomware

script	sample/article
case_Android_Ransomware_hook.js	61F73BF90C3234FAEB8AA7C90F24FA3F7A3A1D38B2E94D40CE96A21E7320FD28

---

Frida Meets Dirty Cow

script	sample/article
frida-hook-dirtycow.py	https://github.com/timwr/CVE-2016-5195
.	F8A6362CE444858A698320204B424BEF17A3807E92EF2D3BB3826B973C3F9324