Android Malware Analysis - Android General

Hi folks,
I have just started exploring the prospect of Android Malware Analysis recently. As of now I have mostly done Static Analysis using tools like APKTool, APKManager, Dex2Jar, Jd-GUI. Cheers to people in the forum who have contributed with these tools and cleared the initial questions, that was really helpful.
Recently I was trying to analyze a malware that sends SMS to the C&C individuals, using the above mentioned tools I changed the C&C number which was hardcoded in the code to the port number of an emulator on my system. I was able to se the SMSes being diverted to the emulator.
I wanted to try something at the next level now, I was thinking of loading the apk in eclipse and putting breakpoints in the code so that I can catch the different activities. A scenario would be before the SMS is sent out of the app the code stops executing at my breakpoint so that I can view what is going on. Hoping that this feels similar to debugging an exe in OllyDBG. I hope I got my point right.
Right now I followed a number of tutorials online and imported the apk code onto eclipse. I have been following a tutorial highlighted here
http://kkinder.com/2011/11/27/so-you-want-to-reverse-engineer-an-android-app-apk/
So right now I have .smali code as well as java code ( which I am getting by opening the apk as a jar file in JD GUI and saving from there as mentioned in the tutorial). The problem is I am getting errors in every java file that I import in eclipse.
Is there a better and easier way to debug apk files on eclipse, or rather is there a tool which I can use to do something like adding breakpoints before an app sends out an sms for instance.
Pardon me for the long post but i thought ill provide as much information as possible so that you guys can help.
Thanks in advance :good:

Bump
skeptre said:
Hi folks,
I have just started exploring the prospect of Android Malware Analysis recently. As of now I have mostly done Static Analysis using tools like APKTool, APKManager, Dex2Jar, Jd-GUI. Cheers to people in the forum who have contributed with these tools and cleared the initial questions, that was really helpful.
Recently I was trying to analyze a malware that sends SMS to the C&C individuals, using the above mentioned tools I changed the C&C number which was hardcoded in the code to the port number of an emulator on my system. I was able to se the SMSes being diverted to the emulator.
I wanted to try something at the next level now, I was thinking of loading the apk in eclipse and putting breakpoints in the code so that I can catch the different activities. A scenario would be before the SMS is sent out of the app the code stops executing at my breakpoint so that I can view what is going on. Hoping that this feels similar to debugging an exe in OllyDBG. I hope I got my point right.
Right now I followed a number of tutorials online and imported the apk code onto eclipse. I have been following a tutorial highlighted here
http://kkinder.com/2011/11/27/so-you-want-to-reverse-engineer-an-android-app-apk/
So right now I have .smali code as well as java code ( which I am getting by opening the apk as a jar file in JD GUI and saving from there as mentioned in the tutorial). The problem is I am getting errors in every java file that I import in eclipse.
Is there a better and easier way to debug apk files on eclipse, or rather is there a tool which I can use to do something like adding breakpoints before an app sends out an sms for instance.
Pardon me for the long post but i thought ill provide as much information as possible so that you guys can help.
Thanks in advance :good:
Click to expand...
Click to collapse

Related

How do i develop a C# or C++ app to copy files

Basically what i want to do is what M2DC does.
i want the program to list all the .zip files that are in a certain theme folder and then when you apply the theme, it unzips the file and copies whatever is in that file and copy it to the windows folder.
Please help me.
i know NOTHING about programming.
you dont even need to show me, even if you give me a link that give me the necessary information to help me do so.
btw, i have Visual Studio 2008.
http://msdn.microsoft.com/en-us/windowsmobile/default.aspx
that is microsofts windows mobile developer center you may find some stuff there, but if you have no programing experience you may just want to get the developer of m2dc to help you out getting started
best of luck
forgot to mention i already looked there.
good tutorials. just none of which help me in this situation.
kidnamedAlbert said:
Basically what i want to do is what M2DC does.
i want the program to list all the .zip files that are in a certain theme folder and then when you apply the theme, it unzips the file and copies whatever is in that file and copy it to the windows folder.
Please help me.
i know NOTHING about programming.
you dont even need to show me, even if you give me a link that give me the necessary information to help me do so.
btw, i have Visual Studio 2008.
Click to expand...
Click to collapse
Did you download the free copy of visual studio?
bedaweed said:
Did you download the free copy of visual studio?
Click to expand...
Click to collapse
i have the full version
the only reason he would have asked is that you have to have the full version for windows mobile development....
okay well i do.
but im not a programmer so i need some help.
i started trying to jump in just recently, mostly i've just been skinning before so i am in the same boat
this is the c++ library reference, it may provide some help.
http://msdn.microsoft.com/en-us/library/cscc687y.aspx
the code should be the same on a pc performing the same operation
so such code exmpls should be fine too
i tried to do some searching but it appears that there is not very many beginners tutorials for windows mobile so I will just put a couple of suggestions out there.
If you have never written code before I would recommend starting with C#
I personally use C++ but that is because I started writing C++ while still in high school before C# even existed. From what I can tell C# would be a much less painful experience that learning c++.
If you are not all that interested in learning the ins and outs of programming I would take a took at mortscript because that basically gives you just about everything that you would need and I just checked the documentation they have everything you need, the ability to unzip files and make a simple gui
Whenever looking about learning a new programming language you will do best to look for a "Hello World" example, whenever I learna new language / platform (like i am currently doing with android) I always look for a hello world example so that I can get something simple up and running
I end up getting a lot of information from http://www.codeproject.com/ and http://www.pocketpcdn.com/ sometimes the information is outdated, but it is usually pretty good.
The latest and greatest programming website is stackoverflow.com You can ask a question and Usually you will get an answer to your question in a day or so.
If you are ever interested in looking at some C++ things you can look at the full M2DC source code by downloading the zip file from the google code page (latest source code). In the zip file there is a sln file somewhere, that is the entire solution for the program. You should be able to open that file with you copy of visual studio and build a fully working copy of M2DC
good luck
How to teach programming in one post...
Well I don't know where to start, Developing C# apps for PPC is similar to developing desktop apps. The best way to learn is to see what others have done and copy across the code you need (Lookup Popfly Development ).
I'd try and find the code for this in a Normal WinForms app to do this and then port it across to the PPC App.
I'd do it in C#. The un-zipping maybe complicated, I'm not sure what ZIP code is in the .Net Compact Framework.
Let me know if you need any help, I might even knock some code together for ya.
Ta
Dave
mpenguin14 said:
i tried to do some searching but it appears that there is not very many beginners tutorials for windows mobile so I will just put a couple of suggestions out there.
If you have never written code before I would recommend starting with C#
I personally use C++ but that is because I started writing C++ while still in high school before C# even existed. From what I can tell C# would be a much less painful experience that learning c++.
If you are not all that interested in learning the ins and outs of programming I would take a took at mortscript because that basically gives you just about everything that you would need and I just checked the documentation they have everything you need, the ability to unzip files and make a simple gui
Whenever looking about learning a new programming language you will do best to look for a "Hello World" example, whenever I learna new language / platform (like i am currently doing with android) I always look for a hello world example so that I can get something simple up and running
I end up getting a lot of information from http://www.codeproject.com/ and http://www.pocketpcdn.com/ sometimes the information is outdated, but it is usually pretty good.
The latest and greatest programming website is stackoverflow.com You can ask a question and Usually you will get an answer to your question in a day or so.
If you are ever interested in looking at some C++ things you can look at the full M2DC source code by downloading the zip file from the google code page (latest source code). In the zip file there is a sln file somewhere, that is the entire solution for the program. You should be able to open that file with you copy of visual studio and build a fully working copy of M2DC
good luck
Click to expand...
Click to collapse
actually thats the first thing i tried(using m2dc as a template)
but i was super confused.
i tried taking out unessicary things like softkeys, background, internet, etc. but it didnt want to build. and plus, i probably did it all wrong.
if i cant get a good mortscript to do it, ill look into those websites you recommended me.
im in high school right now and im trying to find classing that will teach me some basic programming.
my school is filled with idiots though.
but im moving to a different city, so maybe they can teach me better than i would here.
thanks again.

[Q] How to invoke internal APIs

Hi guys,
I know that there are a lot of people have been asking the same question but I couldn't find the right answer for it, except "it is not recommended". I understand why such approach is not recommended so let's not discuss that issue again here.
What I really want to do is to test some internal APIs in my app. We will, in the future, build our own ROM, but at the moment, we want to test some internal features to see if they serve our purposes. But once I import any internal Java class into my app's code, Eclipse displays errors (of course). And I am trying to get around by either copying that source code part from AOSD to our app or looking for some .jar files so that we can put them into Build Path and compile. But both ways didn't work.
Is there anyone here can help me to solve the problem?
And let's me know if I posted in the wrong forum.
reddevil00 said:
But once I import any internal Java class into my app's code, Eclipse displays errors (of course). And I am trying to get around by copying that source code part from AOSD to our app
Click to expand...
Click to collapse
That's what I did for an app just yesterday so I suppose that generally this approach is working. Though I had to include a hand full of classes until all errors were gone.
If you don't tell the detailed error messages then I guess noone can help any further.
Thanks ramdroid77. Seems that I got the right person
Ok, I want to use the following classes:
com.android.internal.telephony.Call
com.android.internal.telephony.CallManager
com.android.internal.telephony.Phone
Since these files depend on other classes as well, so I decided to copy the whole source code (.java files) in framework/base/telephony/com to src folder in my project. There were errors such as in AdnRecord.java "The method readStringArray(String[]) in the type Parcel is not applicable for the arguments()...".
But before trying to fix the errors, I realized that this seems not the correct way to do because those copied Java files will be compiled as well. But what I need is only the reference implementation of those classes to get over the compilation. When the app is run, it will invoke the real classes. That's why I changed to the second way looking for some .jar files that I can add to Build Path.
Btw, which approach did you use? Can you tell me roughtly how you did it? I'll follow and report the specific error messages then.
reddevil00 said:
But before trying to fix the errors, I realized that this seems not the correct way to do because those copied Java files will be compiled as well. But what I need is only the reference implementation of those classes to get over the compilation. When the app is run, it will invoke the real classes. That's why I changed to the second way looking for some .jar files that I can add to Build Path.
Click to expand...
Click to collapse
So compile all Android java files to jar and add it to classpath of your application.
Thanks guys. Sorted it out.
I had compiled Android source code earlier so I just needed to find those class files in the compiled source code and added to the classpath. Now it is working.

Google API for Java

I'm relatively new to programming and am currently learning Java.
Google provides their API in Java for their various products. I downloaded it, followed the instructions to use ANT to get it all ready to go, but I'm stuck on how to actually start using it. I can't get their libraries to import into my programs using the JVM compiler. It just says a bunch of, "that package doesn't exist", and things of that nature. I can't even get Google's sample code to load any of the API packages.
How does one actually use the API once it's all extracted and in the C:\Program Files\Java\gdata folder? Can I not use the JVM compiler? I had to use ANT to set it all up... does that mean I have to somehow use ANT to use the API? I'm a little confused.
If somebody could write up a step-by-step on how to start using the API, that would be so awesome.
thesecondsfade said:
I'm relatively new to programming and am currently learning Java.
Google provides their API in Java for their various products. I downloaded it, followed the instructions to use ANT to get it all ready to go, but I'm stuck on how to actually start using it. I can't get their libraries to import into my programs using the JVM compiler. It just says a bunch of, "that package doesn't exist", and things of that nature. I can't even get Google's sample code to load any of the API packages.
How does one actually use the API once it's all extracted and in the C:\Program Files\Java\gdata folder? Can I not use the JVM compiler? I had to use ANT to set it all up... does that mean I have to somehow use ANT to use the API? I'm a little confused.
If somebody could write up a step-by-step on how to start using the API, that would be so awesome.
Click to expand...
Click to collapse
Judging from your post, you seem to be referring to the GData APIs. It's worth noting that Google is pushing Google APIs Client Library for Java for all new Google JSON APIs.
These APIs + samples are built with Maven2 and are pretty easy to setup.
Also judging from your post, you might want to get up to speed with basic java stuff like project setup in your IDE (Eclipse / IntelliJ ?), Build tools (Maven / ANT). Learn those things first before getting into the Google APIs. Go to the maven site and see how you can build a simple project. See how to import that project in Eclipse, and checkout the Maven plugin for Eclipse.
Most of the samples for Google APIs Client Library for Java (ex: The Books API Sample) provide step by step instructions on how to get things up and running (starting with checking out the code from the google versioning control to building it and running the sample on your environment).
Hijacking this threat a bit, but I'm also learning about APIs, Facebook and Twitter in particular.
With regard to android and java, I've done the tutorial for logging into facebook and posting basic status update but don't really understand the code; which parts are the API?
Really appreciate it if you could point me to another thread or site that explains how to use the API. I'm stuck on how to create a method that does event creation for facebook.
Thanks in advance!

Mac Users&Android

Recently I've been trying to teach myself how to develop for our phone, but I'm using a Mac. I have a Windows Partition, and can run Windows on my Mac, but it's a pain to have to restart just to use a single program for whatever it is that I need done. So I've done some research and thought it would be nice to share all the programs that I've found that help in Android Development.
It would also be nice if other Mac Users would share what they have found as well or what they use when trying to accomplish certain tasks when working with android. So here goes:
--Android SDK--
This is rather obvious…that being said you can download this from android.com. However, if you chose to install Eclipse I find installing the SDK from Android to be rather Redundant, if you agree go on and read the part about Eclipse.
--Wine/MacPorts/xCode--
First, sometimes it's useful to use Windows programs on Mac, and an one quick way to do that without having to reboot is with Wine. It takes a while to set up, but it is useful for running MOST executables. The last two programs you install as part of the tutorial, so follow on:
So here is the website I used to set up Wine: http://www.davidbaumgold.com/tutorials/wine-mac/
All of his instructions are accurate excluding where he talks about installing xCode. It is OK to install xCode through the App Store, all you have to do afterwards is install Command Line Tools. To do this:
1. Open xCode
2. Open Preferences (cmd+,)
3. Click the Downloads tab
4. Use the link to create an Apple Dev account
5. Click Command Line Tools
Now you can continue to follow the rest of the Tutorial
--Eclipse--
This program is useful for creating Android Applications on your phone. If you choose to install Eclipse I would follow this guide once you're done. I realize it is for creating Android Applications but it also explains how to set up a working environment.
So here is the website I used to set up Eclipse: http://www.vogella.de/articles/Android/article.html
I would start at section 5.1
Also Eclipse can be used for compiling .9.png files…I found a good tutorial for this on XDA: http://forum.xda-developers.com/showthread.php?t=487001
Go hit damnitpud's thank meter if you find his thread useful
--APK Manager--
I found this tool extremely useful for pulling APK's and pushing them to your phone. This app can be used for Themeing apks, or editing the XML files.
I found this application on XDA as well: http://forum.xda-developers.com/showthread.php?t=1285130
Go hit s0niq3's thanks button, maybe it'll convince her that people actually care about her program.
--android-utility or AU--
This little program looks to be extremely useful, I found it while searching for a way to compile .9.png files without having to use Eclipse. But it also has a host of other applications and uses. Make sure you read the thread thoroughly and follow all instructions.
I found this application on XDA as well: http://forum.xda-developers.com/showthread.php?t=1167623
Go hit tommytomatoe's thanks button as well, he gave us a marvelous little program. There is also a version for windows now, well at least part of it.
[For windows, and Linux Users: http://forum.xda-developers.com/showthread.php?t=1272513]
Go hit kakomalo's thanks button
If you download the version 1.0.1 and you try to compile a .9.png file, and you receive an error telling you that aapt is missing, all you have to do is drag and drop the aapt from the Android SDK into /android-utility/utility/
--xUlitimate--
I'm not sure if this one is worth mentioning for Mac, but it would be kinda cool if someone figured out how to get this to work with Wine…so here it is:
So here is its link: http://www.droidforums.net/forum/xeudoxus/47283-release-xultimate.html
This one has some theme tools. I found it specifically for the Draw9Patch Compiler, but I could not get it to work nicely with wine.
--Gimp--
This one is well known, so I don't think it needs much explanation…but it is image editing software.
Here is the download link if you don't already have it: http://gimp.lisanet.de/Website/Download.html
---Finally
After spending hours searching, downloading, and finding out what works I thought I would share to save someone else the expense of having to go through the trial and error. I would love it if other Mac Users, or any one else would share their knowledge on programs they use when working with Android; to theme, compile ROMs, or any other activity related to Android while pertaining to Mac.
Also, if you mess up your computer while doing this it is your own responsibility
Don't know why you haven't got any thanks for this, here's one from me for a very detailed and informative post. I am not a Mac user but thanks for your contribution.
Well I guess I just gave you your first thanks!
This post should be a little useful for Mac users... especially those that don't understand Unix.
Developing on Mac can be very similar to developing on Linux. Mac is just slightly more GUI oriented. Unix commands are the same, though.
So Linux users could use this guide as well!
EDIT: After I posted... I noticed 4 more users had thanked you as well... o-o that was fast
Haha oh thanks guys! After the first couple of days I thought my thread was going to get swallowed up. I'm starting to think that Mac Users are rare amongst Android developers. I do realize that other Unix OSs like Ubuntu are favored more, but sometimes it's a pain to run these back and forth. I've even tried to VM UBUNTU, but I had a problem getting the USB to interface with the program, whether it was how I sent it up, or the program itself I have no idea. So I went out looking for alternatives. There is always triple booting I suppose.
Sent from my SAMSUNG-SGH-I727
I'm use a Mac at my office, and not by choice. Thank you for this extremely helpful post!
Great guide for anyone who is looking to start developing for Android. Better yet, for people who need to get the jist of what is going on in UNIX!

Decompiling APKs

Hello Everyone,
I was wondering, in this day and age what tools do I need for decompiling APK Files? I am also assuming that these tools would also serve me well if I just wanted to edit a file in an APK. If not, then what tools do I need for that as well?
I have scoured the net and found pages that gives many different answers. However those pages are from 2012 on back. So it could be old out dated information.
For now I am assuming the minimum Java JDK, Eclipse (or the new program that was highlighted a month back here on XDA but I forget the name of it), Android SDK, and a Java Decompiler (But which one is best??)
Guidance...Anyone...Anyone...Bueller?
After 52 Views no one has any suggestions? If you all think I answered my own question, that's fine but at least if someone has a suggestion on what a good JAVA Decompiler is to use, that would be helpful?
Thanks all.
Neither Eclipse nor the SDK would help you decompile apps.
To get the resources, use Apktool.
To get the Java, use Dex2jar and JDGUI.
Or use a simplified tool like VTS.

Categories

Resources