Skip to content

Latest commit

 

History

History
344 lines (218 loc) · 9.06 KB

Android-Dynamic-Analysis.md

File metadata and controls

344 lines (218 loc) · 9.06 KB

Android Dynamic Analysis

Interaction with Devices

androidtool-mac

One-click screenshots, video recordings, APK installations for Android phones and smartwatches connected to your Mac

https://github.com/mortenjust/androidtool-mac

python-adb

Python ADB + Fastboot implementation

https://github.com/google/python-adb

fb-adb

A better shell for Android devices

https://github.com/facebook/fb-adb

rootadb

restart adbd with root privileges

https://github.com/poliva/rootadb

p2p-adb

https://github.com/kosborn/p2p-adb/

adbkit

A pure Node.js client for the Android Debug Bridge. https://github.com/CyberAgent/adbkit

apk-view-tracer

http://code.google.com/p/apk-view-tracer/

Apk-view-tracer is a trigger tool for Android Dynamic Analysis and it can be used in android anti-virus dynamic analysis.

Also it provides a group open-API for developer. It can trace Apk view without source code. So it also can be used in black-box testing of Android Development.

It is based on tracing apk view, and it implement two functions for Android development :

  • It provides apk automated testing interface.
  • It provides a event trigger tool for apk dynamic analysis.

adb auto-complete

http://romannurik-code.googlecode.com/git/misc/bash_completion/adb

Debugging and Tracing

AndBug

https://github.com/swdunlop/AndBug

AndBug is a debugger targeting the Android platform's Dalvik virtual machine intended for reverse engineers and developers. It uses the same interfaces as Android's Eclipse debugging plugin, the Java Debug Wire Protocol (JDWP) and Dalvik Debug Monitor (DDM) to permit users to hook Dalvik methods, examine process state, and even perform changes.

android_debug

https://github.com/wuntee/android_debug

agdb

http://code.google.com/p/rxwen-blog-stuff/source/browse/trunk/tools/agdb.py

An Android cross platform gdb wrapper.

GDB 7.4.1 for Android

http://gnutoolchains.com/android/

Android-OpenDebug

Make any application debuggable on a device.

https://github.com/iSECPartners/Android-OpenDebug

NDroid

A dynamic information flow tracing system for Android

https://github.com/0-14N/NDroid

db-wa

Web App and Database for DroidBox

https://github.com/bbokorney/db-wa

Injection, Hooking and Instrumentation

Xposed

http://forum.xda-developers.com/showthread.php?t=1574401

Cydia Substrate

http://www.cydiasubstrate.com

android_ddi

https://github.com/crmulliner/ddi

adbi

https://github.com/crmulliner/adbi

PIN for Android

http://software.intel.com/sites/default/files/article/256671/pindroid-tutorial-01.pdf

Hooker

https://github.com/AndroidHooker/hooker

libandroid_injector

https://code.google.com/p/libandroidinjector/

Frida

http://www.frida.re/

dexposed

dexposed enable 'god' mode for single android application.

https://github.com/alibaba/dexposed

android-lkms

Android Loadable Kernel Modules - mostly used for reversing and debugging on controlled systems/emulators

https://github.com/strazzere/android-lkms

aihl

Android import hook library

https://github.com/HiddenRambler/aihl

AndroidEagleEye

An Xposed based module which is capable of hooking both Android system APIs and applications' methods.

https://github.com/MindMac/AndroidEagleEye

SqlCipherHook

Xposed module for obtaining SQLCipher crypto keys

https://github.com/jakev/SqlCipherHook

arminject

An application to dynamically inject a shared object into a running process on ARM architectures.

https://github.com/evilsocket/arminject

AllHookInOne

A project contains all method hook approachs for android such as dalvik hook, art hook, elf hook and inline hook

https://github.com/boyliang/AllHookInOne

APKIL

https://github.com/kelwin/apkil

http://code.google.com/p/droidbox/wiki/APIMonitor

injection_by_ptrace

https://github.com/boyliang/injection_by_ptrace

ltrace

https://github.com/floe/ltrace

hooker

Hooker is an opensource project for dynamic analyses of Android applications. This project provides various tools and applications that can be use to automaticaly intercept and modify any API calls made by a targeted application.

https://github.com/AndroidHooker/hooker

apkil_apimonitor

This is an extension from DroidBox APIMonitor to instrument and monitor the entry and exit of specified methods.

https://github.com/ericjyc/apkil_apimonitor

Valgrind

http://valgrind.org

Sandbox

DroidBox

http://code.google.com/p/droidbox/

DroidBox provides:

  • an Android system image, which can log and output behaviours of applications running in it.
  • APIMonitor, a tool which can automatically modify APK file and add log codes for sensitive APIS.

taintdroid_runner

https://github.com/dbaeumges/taintdroid_runner

Anubis

http://anubis.iseclab.org

Andrubis executes Android apps in a sandbox and provides a detailed report on their behavior, including file access, network access, crypto operations, dynamic code loading and information leaks. In addition to the dynamic analysis in the sandbox, Andrubis also performs static analysis, yielding information on e.g. the app's activities, services, required external libraries and actually required permissions.

Tracedroid

http://tracedroid.few.vu.nl

CobraDroidBeta

CobraDroid is a custom build of the Android operating system geared specifically for application security analysts and for individuals dealing with mobile malware.

https://github.com/jakev/CobraDroidBeta

Mobile Sandbox

Home: http://mobilesandbox.org/

Project: http://www1.informatik.uni-erlangen.de/node/36

Mobile-Sandbox.com is part of the MobWorm project and provides static and dynamic malware analysis for Android OS smartphones.

https://github.com/mspreitz/mobile-sandbox

https://github.com/floe/mobile-sandbox

Sanddroid

http://sanddroid.xjtu.edu.cn/

AnaDroid

http://pegasus.cs.utah.edu:9090

CopperDroid

http://copperdroid.isg.rhul.ac.uk/copperdroid/

ForeSafe

http://www.foresafe.com/scan

AppsPlayground

http://list.cs.northwestern.edu/mobile/

http://dod.cs.northwestern.edu/plg/

VisualThreat

http://www.visualthreat.com

AMAT

http://dunkelheit.com.br/amat/analysis/index_en.php

AndroidSandbox

http://androidsandbox.net/

NVISO ApkScan

http://apkscan.nviso.be/

report: http://apkscan.nviso.be/reports/NVISO%20ApkScan%20-%20Android%20malware%20report%20-%202013.pdf

blog: http://blog.nviso.be/

A5

http://dogo.ece.cmu.edu/a5/

Privacy Grade

http://privacygrade.org/

Introspy-Android

Blackbox tool to help understand what an Android application is doing at runtime and assist in the identification of potential security issues.

https://github.com/iSECPartners/Introspy-Android

Introspy-Analyzer

Introspy is a set of iOS and Android tools designed to help understand what an iOS or Android application is doing at runtime and assist in the identification of potential security issues.

https://github.com/iSECPartners/Introspy-Analyzer

Android Antimalware

Dynamic malware analysis for the Android platform

https://github.com/VT-Magnum-Research/antimalware

DroidScope

https://code.google.com/p/decaf-platform/wiki/DroidScope

Environment Faker

RootCloak Plus (Cydia)

http://devadvance.com/rootcloakplus/

RootCloak

http://devadvance.com/rootcloak/

https://github.com/devadvance/rootcloak

DeviceFaker

http://site.kbc-brick.org/app/devicefaker

rootcloak

Open source module for Xposed Framework that hides root from specific apps

https://github.com/devadvance/rootcloak

Network Analysis

tcpdump

http://www.tcpdump.org

wireshark

http://www.wireshark.org

odo

https://github.com/groupon/odo

Burp Suite

http://portswigger.net/burp/

Fiddler

http://fiddler2.com

Charles

http://www.charlesproxy.com

Fiddler

http://fiddler2.com

Android-SSL-TrustKiller

Bypass SSL certificate pinning for most applications

https://github.com/iSECPartners/Android-SSL-TrustKiller

System Resources

Process Explorer for Android

https://github.com/opersys/process-explorer-web

https://github.com/opersys/process-explorer-app

fsdiff

https://github.com/wuntee/androidAuditTools/blob/master/bin/fsdiff.rb

otertool

https://github.com/wuntee/otertool

Memory Analysis

LiME

LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android.

https://github.com/504ensicsLabs/LiME

volatility

http://code.google.com/p/volatility/wiki/AndroidMemoryForensics

UI Automation

Dynodroid

https://code.google.com/p/dyno-droid/

Others

android_external_updateprop

Update Readonly Properties

https://github.com/trevd/android_external_updateprop

Android_S2E

Run android with S2E

https://github.com/michaekang/android_s2e

Android-KillPermAndSigChecks

Bypass signature and permission checks for IPCs.

https://github.com/iSECPartners/Android-KillPermAndSigChecks

botbrew

This project compiles various *nix tools and makes Opkg packages suitable for installation on ARM devices running Android.

https://github.com/jyio/botbrew