2 |
3 |
Backup App Data with ADB
4 |
android:allowBackup the default value of this attribute is true
5 |
6 |
7 | adb backup -f backup.ab app.package.name
9 |
10 |
Use Android backup extractor (abe) to extract and repack android backups.
11 |
12 |
13 | abe unpack backup.ab backup.tar
15 |
16 |
17 |
18 |
19 |
20 |
APK Decompile
21 |
Download the .apk through the Inspeckage.Download -> APK
22 |
23 |
Use Google Enjarify tool for translating Dalvik bytecode to equivalent Java bytecode.
24 |
25 | enjarify yourapp.apk -o yourapp.jar
27 |
Use JD-GUI to decompile and analyze Java bytecode.
28 |
29 |
30 | java -jar jd-gui.jar
32 |
33 |
34 |
35 |
36 |
monkeyrunner
37 |
38 |
With monkeyrunner, you can write a Python program that run an automated start-to-finish test of an Android application. You provide input values with keystrokes or touch events, and view the results as screenshots.
39 |
40 |
Exemplo: Go to android-sdk-path/tools/ where the monkeyrunner program there is and save in a file startfox.py :
41 |
42 | from com.android.monkeyrunner import MonkeyRunner, MonkeyDevice
60 |
61 |
Now, run: monkeyrunner startfox.py and the firefox is launched.
62 |
63 |
64 |
HTTP Proxy
65 |
66 |
1 - Connect both your device and your computer to the same wireless network;
67 |
2 - Choose your favorite http proxy tool and set up a new proxy listenner -- eg. listener address: 192.168.25.22 (computer ip) and port: 8001 (port number that is not currently in use);
68 |
3 - Go to Inspeckage (Settings -> Add Proxy) and set up the same address (192.168.25.22) and port (8001) of your proxy tool;
69 |
4 - Now, open the app (in a feature that makes http request) and the request should be intercepted in your proxy tool.
70 |
71 |
72 |
73 |
74 |
75 |
HTTPS
76 |
77 |
If the app use HTTPS, you need install the proxy tool certificate in your device.
78 |
79 |
80 |
81 |
82 |
SSL Pinning
83 |
84 |
If the app use HTTPS and certificate pinning, you need install the proxy tool certificate in your device and bypass the pinning.
85 |
The Inspeckage can disable pinning for some libraries. Settings->SSL uncheck [ON]
86 |
87 |
Inspeckage - Android Package Inspector
2 |
3 | Inspeckage is a tool developed to offer dynamic analysis of Android applications. By applying hooks to functions of the Android API, Inspeckage will help you understand what an Android application is doing at runtime.
4 |
5 | * http://ac-pm.github.io/Inspeckage
6 | * https://twitter.com/inspeckage
7 | * https://play.google.com/store/apps/details?id=mobi.acpm.inspeckage
8 | * http://repo.xposed.info/module/mobi.acpm.inspeckage
9 |
10 | Features
11 | ---------------
12 |
13 | With Inspeckage, we can get a good amount of information about the application's behavior:
14 |
15 | #### Information gathering
16 |
17 | * Requested Permissions;
18 | * App Permissions;
19 | * Shared Libraries;
20 | * Exported and Non-exported Activities, Content Providers,Broadcast Receivers and Services;
21 | * Check if the app is debuggable or not;
22 | * Version, UID and GIDs;
23 | * etc.
24 |
25 | #### Hooks (so far)
26 |
27 | With the hooks, we can see what the application is doing in real time:
28 |
29 | * Shared Preferences (log and file);
30 | * Serialization;
31 | * Crypto;
32 | * Hashes;
33 | * SQLite;
34 | * HTTP (an HTTP proxy tool is still the best alternative);
35 | * File System;
36 | * Miscellaneous (Clipboard, URL.Parse());
37 | * WebView;
38 | * IPC;
39 | * + Hooks (add new hooks dynamically)
40 |
41 | #### Actions
42 |
43 | With Xposed it's possible to perform actions such as start a unexported activity and much else:
44 |
45 | * Start any activity (exported and unexported);
46 | * Call any provider (exported and unexported);
47 | * Disable FLAG_SECURE;
48 | * SSL uncheck (bypass certificate pinning - JSSE, Apache and okhttp3);
49 | * Start, stop and restart the application;
50 | * Replace params and return value (+Hooks tab).
51 |
52 | #### Fingerprint
53 |
54 | * Device fingerprint - advertising id, MAC address, IMEI, release, brand, build mode...
55 |
56 | #### Location
57 |
58 | * Change GPS location (without use "Mock location" functionality)
59 |
60 | #### Extras
61 |
62 | * APK Download;
63 | * View the app's directory tree;
64 | * Download the app's files;
65 | * Download the output generated by hooks in text file format;
66 | * Take a screen capture;
67 | * Send text to android clipboard.
68 | * Tips - some howto/guide
69 |
70 | #### Configuration
71 |
72 | Even though our tool has some hooks to the HTTP libraries, using an external proxy tool is still the best option to analyze the app's traffic. With Inspeckage, you can:
73 |
74 | * Add a proxy to the target app;
75 | * Enable and disable proxy;
76 | * Add entries in the arp table.
77 |
78 | #### Logcat
79 |
80 | Logcat.html page. A experimental page with websocket to show some information from the logcat.
81 |
82 | Installation
83 | ---------------
84 | Requirements:
85 | Xposed Framework
86 |
87 | ##### Xposed Installer
88 |
89 | 1. Go to Xposed Installer, select "Download"
90 | 2. Refresh and search for "Inspeckage"
91 | 3. Download the latest version and install
92 | 4. Enable it in Xposed
93 | 5. Reboot and enjoy!
94 |
95 | ##### Xposed Repository
96 |
97 | Get it from Xposed repo: http://repo.xposed.info/module/mobi.acpm.inspeckage
98 |
99 | adb install mobi.acpm.inspeckage.apk
100 | 1. Enable it in Xposed
101 | 2. Reboot and enjoy!
102 |
103 | ##### From Source
104 |
105 | Feel free to download the source!
106 |
107 | ### How to uninstall
108 |
109 | adb uninstall mobi.acpm.inspeckage
110 | And reboot!
111 |
112 | ## Genymotion
113 |
114 | [](https://vimeo.com/156745941)
115 |
116 | ### Screenshots
117 |
118 | 
119 |
120 | 
121 |
122 | 
123 |
124 | 
125 |
126 | 
127 |
128 | 
129 |
130 | 
131 |
132 | 
133 |
134 | 
135 |
136 | 
137 |
138 | 
139 |
140 | 
141 |
142 |
143 |
144 |
145 | License
146 | -------
147 |
148 | Copyright 2016 ac-pm
149 |
150 | Licensed under the Apache License, Version 2.0 (the "License");
151 | you may not use this file except in compliance with the License.
152 | You may obtain a copy of the License at
153 |
154 | http://www.apache.org/licenses/LICENSE-2.0
155 |
156 | Unless required by applicable law or agreed to in writing, software
157 | distributed under the License is distributed on an "AS IS" BASIS,
158 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
159 | See the License for the specific language governing permissions and
160 | limitations under the License.
161 |
--------------------------------------------------------------------------------
/app/.gitignore:
--------------------------------------------------------------------------------
1 | /build
2 |
--------------------------------------------------------------------------------
/app/build.gradle:
--------------------------------------------------------------------------------
1 | apply plugin: 'com.android.application'
2 |
3 | android {
4 | compileSdkVersion 26
5 | buildToolsVersion '28.0.2'
6 | defaultConfig {
7 | applicationId "mobi.acpm.inspeckage"
8 | minSdkVersion 21
9 | targetSdkVersion 26
10 | versionCode 10
11 | versionName "2.4"
12 | }
13 |
14 | buildTypes {
15 | release {
16 | minifyEnabled false
17 | proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
18 | }
19 | }
20 |
21 | useLibrary 'org.apache.http.legacy'
22 | }
23 |
24 |
25 | dependencies {
26 | implementation fileTree(dir: 'libs', include: ['*.jar'])
27 | compileOnly 'de.robv.android.xposed:api:5+'
28 | implementation 'com.google.code.gson:gson:2+'
29 | implementation group: 'org.nanohttpd', name: 'nanohttpd', version: '2.3.1'
30 | implementation 'com.android.support:appcompat-v7:26.1.0'
31 | implementation 'com.android.support:design:26.1.0'
32 | implementation 'com.android.support:support-v4:26.1.0'
33 | implementation 'org.java-websocket:Java-WebSocket:1.3.0'
34 | implementation 'com.google.android.gms:play-services:12.0.1'
35 | }
36 |
--------------------------------------------------------------------------------
/app/proguard-rules.pro:
--------------------------------------------------------------------------------
1 | # Add project specific ProGuard rules here.
2 | # By default, the flags in this file are appended to flags specified
3 | # in /home/acpm/android/sdk/android-sdk-linux/tools/proguard/proguard-android.txt
4 | # You can edit the include path and order by changing the proguardFiles
5 | # directive in build.gradle.
6 | #
7 | # For more details, see
8 | # http://developer.android.com/guide/developing/tools/proguard.html
9 |
10 | # Add any project specific keep options here:
11 |
12 | # If your project uses WebView with JS, uncomment the following
13 | # and specify the fully qualified class name to the JavaScript interface
14 | # class:
15 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview {
16 | # public *;
17 | #}
18 |
--------------------------------------------------------------------------------
/app/src/androidTest/java/mobi/acpm/inspeckage/ApplicationTest.java:
--------------------------------------------------------------------------------
1 | package mobi.acpm.inspeckage;
2 |
3 | import android.app.Application;
4 | import android.test.ApplicationTestCase;
5 |
6 | /**
7 | * Testing Fundamentals
8 | */
9 | public class ApplicationTest extends ApplicationTestCase