CNIT 128 6. Analyzing Android Applications (Part 1)
1 like1,066 views
The document outlines the process of analyzing Android applications, including creating an Android development environment, understanding application structure, security models, and reverse-engineering techniques. It discusses essential tools such as Android SDK, ADB commands, and various emulators for app testing, as well as the architecture and components of Android applications like activities, services, and intents. Additionally, it introduces Drozer as a security assessment tool for identifying vulnerabilities in Android applications.
More Related Content
Similar to CNIT 128 6. Analyzing Android Applications (Part 1) (20)
CNIT 128 6. Analyzing Android Applications (Part 1)
- 1. CNIT 128 Hacking Mobile Devices 6. Analyzing Android Applications Part 1
- 2. Topics • Part 1 • Creating Your First Android Environment • Understanding Android Applications • Part 2 • Understanding the Security Model • Reverse-Engineering Applications
- 3. Creating Your First Android Environment
- 4. Android SDK • Android Studio: complete app IDE • Integrated Development Environment • Command line tools only
- 5. Host OS • Mac or Linux is best • Windows causes many problems • Bluestacks is best emulator for Windows • We'll use Kali Linux • Android tools already installed
- 6. Android SDK Tools • adb • The main tool you'll use • Install apps • Pull files off the device • Get a shell • Read logs
- 7. Android SDK Tools • monitor • See running processes • android • Manage Android emulators • aapt • Used by apktool to package source code into binary form when building apps
- 8. Emulators • Genymotion has 133 of them available
- 9. Emulator Restrictions • Have root access • No physical USB, headphones, Wi-Fi, Bluetooth • Cannot make phone calls • Can simulate calls and SMS
- 10. Popular Emulators • Virtualbox running Android x86 • BlueStacks, YouWave, Windows Android • All run on Windows
- 12. Android OS Basics • Modified Linux kernel • Virtual machine that runs Java-like apps • Dalvik Virtual Machine
- 13. User Accounts • On Linux, every app a user launches runs with the same user ID (UID) • This is the same as Windows
- 15. Android UIDs • Each app runs under a different UID • Unless a developer chooses to set several apps with the same signature share a UID
- 16. Android UIDs • adb shell • ps -A • Each app has an account starting u0_ • There are also special accounts like system and root
- 17. /data/data • Home directory for apps
- 18. Android Packages • APK file • Zipped archive • Contains code, resources, and metadata
- 19. APK Packaging Process • aapt converts XML resource files to binary form • aidl converts .aidl files to .java • All source code and output from aapt and aidl compiled into .class files by Java compiler • dx converts .class files to a single classes.dex file
- 20. APK Packaging Process • apkbuilder combines all compiles resources, images, and DEX file into an APK file • jarsigner signs the APK
- 21. Structure of an APK • /assets • /res • /lib • /META-INF • AndroidManifest.xml • classes.dex • resources.rsrc
- 22. Structure of an APK • /assets • Files developer wants to include • /res • Layouts, images, etc, in raw subdirectory • /lib • Libraries, in subdirectories x86, ARM, MIPS
- 23. Structure of an APK • /META-INF • Certificate of application, file inventory with hashes • AndroidManifest.xml • Configuration of application and security parameters
- 25. Structure of an APK • classes.dex • Executable file containing Dalvik bytecode • resources.rsrc • Application strings • Resources the developer chose to place here instead of /res
- 26. Installing Packages • GTalkService • Maintains a connection to Google via pinned SSL • Fetches apps from Google Play • Alternative apps stores are available • Amazon, Samsung, GetJar, etc. • Often even less safe
- 27. adb Commands • adb install -- installs an app • adb shell -- opens command shell • adb push -- pushes file onto device • adb pull -- pulls file from device • adb forward -- forwards a TCP port • adb logcat -- shows the syslog
- 28. Busybox • A single binary with many useful Linux tools, including: • chmod, cp, echo, grep, ifconfig, mv, nc, netstat, pwd, rm
- 29. Standard Android Tools • pm -- Package Manager • pm list packages -- show all packages • pm path -- find stored APK for an app • pm install • pm uninstall
- 30. Standard Android Tools • logcat -- view system logs • getprop -- show system properties • dumpsys -- status of system services
- 31. Drozer • Security assessment tool • Finds vulnerabilities • Develops exploits • Community edition is free • Pro version costs money
- 32. How Drozer Works • Agent • App on device, a Remote Administration Tool • Console • Command-line tool on your computer • Interacts with the Agent • Server • Routes sessions between Agent and Console
- 34. Binder • Kernel module for Inter-Process Communication (IPC) • A character device at /dev /binder
- 35. Application Components • Activities • Visual screens of an app • Services • Components with no GUI • Broadcast receivers • Can detect events like an incoming SMS • Content providers • Data storehouses, often SQLite
- 36. Running Services • On Genymotion • Settings • System • Advanced • Developer Options • Running services
- 37. AndroidManifest.xml • Lists all components usable in application • Except broadcast receivers • Lists permissions
- 38. Intents • An object used for messaging between apps • Works by calling binder • This intent opens google.com in a browser
- 39. Implicit Intent • The code on the last slide does not specify the target app • Any app that can respond to a VIEW action on a URL is eligible to receive the intent • If only one app can handle it, it goes there • Otherwise an application picker appears
- 40. Intent Filters • An app with this filter can diplay Web pages
- 41. Explicit Intent • Sends URL specifically to the Android browser
- 42. Running an App • When OS boots, a single VM starts • A zygote process listens for app launch requests • Each app that launches causes a fork() • Core libraries are shared between VMs
- 44. Demonstrations