Fuzzing APK as binaries to hit vulnerabilities
1. Install pre-requirements
sudo apt update
sudo apt install -y python3 python3-pip openjdk-17-jdk unzip wget
sudo apt install -y libxml2-utils
sudo apt install -y apksigner adb
python3 -m pip install --upgrade pip
python3 -m pip install --upgrade setuptools
python3 -m pip install --upgrade pip setuptools wheel networkx Pillow
python3 -m pip install --user "androguard==3.4.0a1"
2. Setup Android SDK root environment
mkdir -p "$HOME/android-sdk/cmdline-tools"
export ANDROID_SDK_ROOT="$HOME/android-sdk"
export ANDROID_HOME="$ANDROID_SDK_ROOT"
cd /tmp
wget https://dl.google.com/android/repository/commandlinetools-linux-13114758_latest.zip -O cmdline-tools.zip
unzip -q cmdline-tools.zip -d /tmp/cmdline-tools-unpacked
mkdir -p "$ANDROID_SDK_ROOT/cmdline-tools/latest"
mv /tmp/cmdline-tools-unpacked/cmdline-tools/* "$ANDROID_SDK_ROOT/cmdline-tools/latest/"
export PATH="$ANDROID_SDK_ROOT/cmdline-tools/latest/bin:$ANDROID_SDK_ROOT/platform-tools:$ANDROID_SDK_ROOT/emulator:$PATH"
export PATH="$ANDROID_SDK_ROOT/emulator:$ANDROID_SDK_ROOT/platform-tools:$ANDROID_SDK_ROOT/cmdline-tools/latest/bin:$PATH"
## Optional if you want to install it for good
cat >> ~/.bashrc <<'EOF'
export ANDROID_SDK_ROOT="$HOME/android-sdk"
export ANDROID_HOME="$ANDROID_SDK_ROOT"
export PATH="$ANDROID_SDK_ROOT/cmdline-tools/latest/bin:$ANDROID_SDK_ROOT/platform-tools:$ANDROID_SDK_ROOT/emulator:$PATH"
export PATH="$ANDROID_SDK_ROOT/emulator:$ANDROID_SDK_ROOT/platform-tools:$ANDROID_SDK_ROOT/cmdline-tools/latest/bin:$PATH"
EOF
source ~/.bashrc
## End of optional part
sdkmanager --sdk_root="$ANDROID_SDK_ROOT" --licenses
The install SDK for X86:
sdkmanager --sdk_root="$ANDROID_SDK_ROOT" \
"platform-tools" \
"emulator" \
"platforms;android-34" \
"system-images;android-34;google_apis;x86_64"
Or for ARM:
sdkmanager --sdk_root="$ANDROID_SDK_ROOT" \
"platform-tools" \
"emulator" \
"platforms;android-34" \
"system-images;android-34;google_apis;arm64-v8a"
and then
sdkmanager "build-tools;34.0.0"
3. Check installation:
adb version
sdkmanager --list | head
avdmanager list target | head
apkanalyzer --help | head
Which then returns something like this:
Android Debug Bridge version 1.0.41
Version 37.0.0-14910828
Installed as /users/anon/android-sdk/platform-tools/adb
Running on Linux 5.15.0-168-generic (x86_64)
[=======================================] 100% Computing updates...
Installed packages:
Path | Version | Description | Location
------- | ------- | ------- | -------
build-tools;34.0.0 | 34.0.0 | Android SDK Build-Tools 34 | build-tools/34.0.0
emulator | 36.4.9 | Android Emulator | emulator
platform-tools | 37.0.0 | Android SDK Platform-Tools | platform-tools
platforms;android-34 | 3 | Android SDK Platform 34 | platforms/android-34
system-images;android-34;google_apis;x86_64 | 14 | Google APIs Intel x86_64 Atom System Image | system-images/android-34/google_apis/x86_64
[=======================================] 100% Fetch remote repository...
Available Android targets:
----------
id: 1 or "android-34"
Name: Android API 34, extension level 7
Type: Platform
API level: 34
Revision: 3
Verb must be one of:
Usage:
apkanalyzer [global options] <subject> <verb> [options] <apk> [<apk2>]
Option Description
------ -----------
--human-readable Print sizes in human readable format
4. Install the emulator + start:
Run this:
avdmanager create avd -n test34 -k "system-images;android-34;google_apis;x86_64"
Check if it is created:
emulator -list-avds
And start the emulator:
emulator -avd test34 -no-window -no-audio -no-boot-anim -no-metrics -no-snapshot > /tmp/emulator.log 2>&1 &
adb wait-for-device
until [ "$(adb shell getprop sys.boot_completed | tr -d '\r')" = "1" ]; do sleep 2; done
adb devices -l
5. Install the simulator:
git clone https://github.com/honeynet/droidbot.git
cd droidbot
python3 -m pip uninstall -y androguard
python3 -m pip install "androguard>=3.4.0a1,<4"
python3 -m pip install -e .
adb -s emulator-5554 install droidbot/resources/droidbotApp.apk
adb -s emulator-5554 shell ime enable io.github.ylimit.droidbotapp/.DroidBotIME
You can read further on how to use this emulator: [https://github.com/honeynet/droidbot]
Then you can test with a valid APK:
python3 start.py -a ../ApkVulFuzz/Evaluation-SSBSE-2026/seeds/F-Droid.apk -d emulator-5554 -policy monkey -interval 0 -timeout 10 -o results/fdroid_run_10s -is_emulator -grant_perm
Number 1 problem and the root cause of 99% of the issues is not properly running "headless" environment. Ask LLM to solve it with this hint.
Some other issues are listed below.
If no emulator up:
user@node0:~/droidbot$ adb devices
List of devices attached
user@node0:~/droidbot$
to fix it, run:
sudo apt update
sudo apt install -y libpulse0
sudo gpasswd -a $USER kvm
sudo usermod -aG kvm $USER
newgrp kvm
emulator -avd test34 -no-window -no-audio -no-metrics &
If you can run the emulator, but get this error:
WARNING:DroidBotAppConn:Restarting droidbot app 51059 Traceback (most recent call last): File "/users/user/droidbot/droidbot/adapter/droidbot_app.py", line 140, in listen_messages _, _, message_len = self.read_head() File "/users/user/droidbot/droidbot/adapter/droidbot_app.py", line 131, in read_head header = self.sock_read(DROIDBOT_APP_PACKET_HEAD_LEN) File "/users/user/droidbot/droidbot/adapter/droidbot_app.py", line 122, in sock_read raise EOF()
Then run:
adb shell getprop sys.boot_completed
adb kill-server
adb start-server
adb install /users/anon/droidbot/droidbot/resources/droidbotApp.apk
adb shell settings put secure enabled_accessibility_services io.github.ylimit.droidbotapp/io.github.privacystreams.accessibility.PSAccessibilityService
adb shell settings put secure accessibility_enabled 1
pkill -f start.py
Partial list, we need to add the rest:
apksigner verify F-Droid_f35baa5a.apk
zipinfo F-Droid_f35baa5a.apk
zipinfo -v F-Droid_f35baa5a.apk
unzip F-Droid_fff8d915.apk
androguard axml AndroidManifest.xml
Run:
./scripts/search-blackbox.sh > all.log 2>&1
TODO
First, try this command:
apkanalyzer apk summary F-Droid.apk
Run this command to test if the apk is behaving oddly:
user@nmscmo008175 droidbot % python3 start.py -a ../F-Droid.apk -d emulator-5554 -policy bfs_greedy -count 100 -interval 2 -timeout 20 -o results/fdroid_run -is_emulator -grant_perm