├── .github └── workflows │ └── test_droidlysis.yml ├── Dockerfile ├── LICENSE ├── MANIFEST.in ├── README.md ├── conf ├── __init__.py ├── arm.conf ├── exodustrack.py ├── general.conf ├── kit.conf ├── manifest.conf ├── smali.conf ├── sortconf.py └── wide.conf ├── dev.md ├── docker-compose.yml ├── droidconfig.py ├── droidcountry.py ├── droidlysis ├── droidlysis3.py ├── droidproperties.py ├── droidreport.py ├── droidsample.py ├── droidsql.py ├── droidurl.py ├── droidutil.py ├── droidziprar.py ├── external ├── License.txt ├── README.md └── procyon-decompiler-0.5.30.jar ├── images └── example.png ├── requirements.txt ├── script └── DroidlysisSearch.py ├── setup.py └── test ├── __init__.py ├── apk └── ph0wn-musicalear.apk ├── test.md ├── test_droidconfig.py └── test_droidlysis3.py /.github/workflows/test_droidlysis.yml: -------------------------------------------------------------------------------- 1 | name: Test Droidlysis Help works 2 | 3 | on: 4 | push: 5 | branches: 6 | - master 7 | pull_request: 8 | branches: 9 | - master 10 | 11 | jobs: 12 | test: 13 | runs-on: ubuntu-latest 14 | 15 | steps: 16 | - name: Checkout repository 17 | uses: actions/checkout@v3 18 | 19 | - name: Set up Python 3.x 20 | uses: actions/setup-python@v3 21 | with: 22 | python-version: '3.x' 23 | 24 | - name: Install dependencies 25 | run: | 26 | python -m pip install --upgrade pip 27 | pip install -r requirements.txt 28 | 29 | - name: Run Droidlysis command 30 | run: | 31 | ./droidlysis --help 32 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | ARG PYTHON_VERSION=3.9.4-buster 2 | FROM python:${PYTHON_VERSION} as build 3 | 4 | MAINTAINER Axelle Apvrille 5 | ENV REFRESHED_AT 2025-03-24 6 | ENV APKTOOL_VERSION "2.11.1" 7 | ENV SMALI_VERSION "2.5.2" 8 | 9 | WORKDIR /opt 10 | 11 | RUN apt-get update && apt-get install -yqq default-jre libxml2-dev libxslt-dev libmagic-dev git wget cmake 12 | RUN pip3 install -U pip wheel 13 | RUN mkdir -p /share 14 | 15 | # Install Apktool ---------------------------------------------- 16 | RUN cd /opt && wget -q "https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_${APKTOOL_VERSION}.jar" 17 | 18 | # Install Smali / Baksmali ------------------------- 19 | RUN wget -q "https://bitbucket.org/JesusFreke/smali/downloads/baksmali-${SMALI_VERSION}.jar" 20 | 21 | # Install Dex2jar ------------------------------------- 22 | RUN wget -O dex2jar.zip -q https://github.com/pxb1988/dex2jar/releases/download/v2.4/dex-tools-v2.4.zip && unzip dex2jar.zip -d /opt && rm -f dex2jar.zip 23 | 24 | # Install DroidLysis ---------------------------------- 25 | RUN git clone https://github.com/cryptax/droidlysis 26 | ENV PATH $PATH:/root/.local/bin 27 | ENV PYTHONPATH $PYTHONPATH:/opt/droidlysis 28 | RUN cd /opt/droidlysis && pip3 install --user -r requirements.txt 29 | RUN chmod u+x /opt/droidlysis/droidlysis 30 | 31 | # Configure --------------------------------------------- 32 | RUN sed -i 's#~/softs#/opt#g' /opt/droidlysis/conf/general.conf 33 | 34 | CMD [ "/bin/bash" ] 35 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2019 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /MANIFEST.in: -------------------------------------------------------------------------------- 1 | include conf/*.conf 2 | include conf/__init__.py 3 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # DroidLysis 2 | 3 | DroidLysis is a **pre-analysis tool for Android apps**: it performs repetitive and boring tasks we'd typically do at the beginning of any reverse engineering. It disassembles the Android sample, organizes output in directories, and searches for suspicious spots in the code to look at. 4 | The output helps the reverse engineer speed up the first few steps of analysis. 5 | 6 | DroidLysis can be used over Android packages (apk), Dalvik executables (dex), Zip files (zip), Rar files (rar) or directories of files. 7 | 8 | 9 | 10 | ## Installing DroidLysis 11 | 12 | 1. Install required system packages 13 | 14 | ``` 15 | sudo apt-get install default-jre git python3 python3-pip unzip wget libmagic-dev libxml2-dev libxslt-dev 16 | ``` 17 | 18 | 19 | 2. Install Android disassembly tools 20 | 21 | - [Apktool](https://ibotpeaches.github.io/Apktool/) , 22 | - [Baksmali](https://bitbucket.org/JesusFreke/smali/downloads), and optionally 23 | - [Dex2jar](https://github.com/pxb1988/dex2jar) and 24 | 25 | ``` 26 | $ mkdir -p ~/softs 27 | $ cd ~/softs 28 | $ wget https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.9.3.jar 29 | $ wget https://bitbucket.org/JesusFreke/smali/downloads/baksmali-2.5.2.jar 30 | $ wget https://github.com/pxb1988/dex2jar/releases/download/v2.4/dex-tools-v2.4.zip 31 | $ unzip dex-tools-v2.4.zip 32 | $ rm -f dex-tools-v2.4.zip 33 | ``` 34 | 35 | 3. Get DroidLysis from the Git repository (preferred) or from pip 36 | 37 | Install from Git in a Python virtual environment (`python3 -m venv`, or pyenv virtual environments etc). 38 | 39 | ``` 40 | $ python3 -m venv venv 41 | $ source ./venv/bin/activate 42 | (venv) $ pip3 install git+https://github.com/cryptax/droidlysis 43 | ``` 44 | 45 | Alternatively, you can install DroidLysis directly from PyPi (`pip3 install droidlysis`). 46 | 47 | 4. Configure `conf/general.conf`. In particular make sure to change `/home/axelle` with your appropriate directories. 48 | 49 | ``` 50 | [tools] 51 | apktool = /home/axelle/softs/apktool_2.9.3.jar 52 | baksmali = /home/axelle/softs/baksmali-2.5.2.jar 53 | dex2jar = /home/axelle/softs/dex-tools-v2.4/d2j-dex2jar.sh 54 | keytool = /usr/bin/keytool 55 | ... 56 | ``` 57 | 58 | 5. Run it: 59 | 60 | ``` 61 | python3 ./droidlysis3.py --help 62 | ``` 63 | 64 | 65 | ## Configuration 66 | 67 | The configuration file is `./conf/general.conf` (you can switch to another file with the `--config` option). 68 | This is where you configure the location of various external tools (e.g. Apktool), the name of pattern files 69 | (by default `./conf/smali.conf`, `./conf/wide.conf`, `./conf/arm.conf`, `./conf/kit.conf`) and the name of 70 | the database file (only used if you specify `--enable-sql`) 71 | 72 | Be sure to specify the correct paths for disassembly tools, or DroidLysis won't find them. 73 | 74 | 75 | ## Usage 76 | 77 | DroidLysis uses **Python 3**. To launch it and get options: 78 | 79 | ``` 80 | droidlysis --help 81 | ``` 82 | 83 | For example, test it on [Signal's APK](https://signal.org/android/apk/): 84 | 85 | ``` 86 | droidlysis --input Signal-website-universal-release-6.26.3.apk --output /tmp --config /PATH/TO/DROIDLYSIS/conf/general.conf 87 | ``` 88 | 89 | ![](./images/example.png) 90 | 91 | DroidLysis outputs: 92 | 93 | - A summary on the console (see image above) 94 | - The unzipped, pre-processed sample in a subdirectory of your output dir. The subdirectory is named using the sample's filename and sha256 sum. For example, if we analyze the Signal application and set `--output /tmp`, the analysis will be written to `/tmp/Signalwebsiteuniversalrelease4.52.4.apk-f3c7d5e38df23925dd0b2fe1f44bfa12bac935a6bc8fe3a485a4436d4487a290`. 95 | - A database (by default, SQLite `droidlysis.db`) containing properties it noticed. 96 | 97 | ## Options 98 | 99 | Get usage with `droidlysis --help` 100 | 101 | - The input can be a file or a directory of files to recursively look into. DroidLysis knows how to process Android packages, DEX, ODEX and ARM executables, ZIP, RAR. DroidLysis won't fail on other type of files (unless there is a bug...) but won't be able to understand the content. 102 | 103 | - When processing directories of files, it is typically quite helpful to move processed samples to another location to know what has been processed. This is handled by option `--movein`. Also, if you are only interested in statistics, you should probably clear the output directory which contains detailed information for each sample: this is option `--clearoutput`. If you want to store all statistics in a SQL database, use `--enable-sql` (see [here](#sqlite_database)) 104 | 105 | - DroidLysis's analysis does not inspect known 3rd party SDK by default, i.e. for instance it won't report any suspicious activity from these. If you want them to be inspected, use option `--no-kit-exception`. This usually creates many more detected properties for the sample, as SDKs (e.g. advertisment) use lots of flagged APIs (get GPS location, get IMEI, get IMSI, HTTP POST...). 106 | 107 | ## Sample output directory (`--output DIR`) 108 | 109 | This directory contains (when applicable): 110 | 111 | - A readable `AndroidManifest.xml` 112 | - Readable resources in `res` 113 | - Libraries `lib`, assets `assets` 114 | - Disassembled Smali code: `smali` (and others) 115 | - Package meta information: `META-INF` 116 | - Package contents when simply unzipped in `./unzipped` 117 | - DEX executable `classes.dex` (and others), and converted to jar: `classes-dex2jar.jar`, and unjarred in `./unjarred` 118 | 119 | The following files are generated by DroidLysis: 120 | 121 | - `autoanalysis.md`: lists each pattern DroidLysis detected and where. 122 | - `report.md`: same as what was printed on the console 123 | 124 | If you do not need the sample output directory to be generated, use the option `--clearoutput`. 125 | 126 | ## Import trackers from Exodus etc (`--import-exodus`) 127 | 128 | ``` 129 | $ python3 ./droidlysis3.py --import-exodus --verbose 130 | Processing file: ./droidurl.pyc ... 131 | DEBUG:droidconfig.py:Reading configuration file: './conf/./smali.conf' 132 | DEBUG:droidconfig.py:Reading configuration file: './conf/./wide.conf' 133 | DEBUG:droidconfig.py:Reading configuration file: './conf/./arm.conf' 134 | DEBUG:droidconfig.py:Reading configuration file: '/home/axelle/.cache/droidlysis/./kit.conf' 135 | DEBUG:droidproperties.py:Importing ETIP Exodus trackers from https://etip.exodus-privacy.eu.org/api/trackers/?format=json 136 | DEBUG:connectionpool.py:Starting new HTTPS connection (1): etip.exodus-privacy.eu.org:443 137 | DEBUG:connectionpool.py:https://etip.exodus-privacy.eu.org:443 "GET /api/trackers/?format=json HTTP/1.1" 200 None 138 | DEBUG:droidproperties.py:Appending imported trackers to /home/axelle/.cache/droidlysis/./kit.conf 139 | ``` 140 | 141 | Trackers from Exodus which are not present in your initial `kit.conf` are appended to `~/.cache/droidlysis/kit.conf`. Diff the 2 files and check what trackers you wish to add. 142 | 143 | 144 | ## SQLite database{#sqlite_database} 145 | 146 | If you want to process a directory of samples, you'll probably like to store the properties DroidLysis found in a database, to easily parse and query the findings. In that case, use the option `--enable-sql`. This will automatically dump all results in a database named `droidlysis.db`, in a table named `samples`. Each entry in the table is relative to a given sample. Each column is properties DroidLysis tracks. 147 | 148 | For example, to retrieve all filename, SHA256 sum and smali properties of the database: 149 | 150 | ``` 151 | sqlite> select sha256, sanitized_basename, smali_properties from samples; 152 | f3c7d5e38df23925dd0b2fe1f44bfa12bac935a6bc8fe3a485a4436d4487a290|Signalwebsiteuniversalrelease4.52.4.apk|{"send_sms": true, "receive_sms": true, "abort_broadcast": true, "call": false, "email": false, "answer_call": false, "end_call": true, "phone_number": false, "intent_chooser": true, "get_accounts": true, "contacts": false, "get_imei": true, "get_external_storage_stage": false, "get_imsi": false, "get_network_operator": false, "get_active_network_info": false, "get_line_number": true, "get_sim_country_iso": true, 153 | ... 154 | ``` 155 | 156 | ## Property patterns 157 | 158 | What DroidLysis detects can be configured and extended in the files of the `./conf` directory. 159 | 160 | A pattern consist of: 161 | 162 | - a **tag** name: example `send_sms`. This is to name the property. Must be unique across the `.conf` file. 163 | - a **pattern**: this is a regexp to be matched. Ex: `;->sendTextMessage|;->sendMultipartTextMessage|SmsManager;->sendDataMessage`. In the `smali.conf` file, this regexp is match on Smali code. In this particular case, there are 3 different ways to send SMS messages from the code: sendTextMessage, sendMultipartTextMessage and sendDataMessage. 164 | - a **description** (optional): explains the importance of the property and what it means. 165 | 166 | ``` 167 | [send_sms] 168 | pattern=;->sendTextMessage|;->sendMultipartTextMessage|SmsManager;->sendDataMessage 169 | description=Sending SMS messages 170 | ``` 171 | 172 | 173 | ## Importing Exodus Privacy Trackers 174 | 175 | Exodus Privacy maintains a list of various SDKs which are interesting to rule out in our analysis via `conf/kit.conf`. 176 | Add option `--import_exodus` to the droidlysis command line: this will parse existing trackers Exodus Privacy knows and which aren't yet in your `kit.conf`. Finally, it will **append** all new trackers to `~/.cache/droidlysis/kit.conf`. 177 | 178 | Afterwards, you may want to sort your `kit.conf` file: 179 | 180 | ```python 181 | import configparser 182 | import collections 183 | import os 184 | 185 | config = configparser.ConfigParser({}, collections.OrderedDict) 186 | config.read(os.path.expanduser('~/.cache/droidlysis/kit.conf')) 187 | # Order all sections alphabetically 188 | config._sections = collections.OrderedDict(sorted(config._sections.items(), key=lambda t: t[0] )) 189 | with open('sorted.conf','w') as f: 190 | config.write(f) 191 | ``` 192 | 193 | ## JEB script for smali properties 194 | 195 | This script helps you search for methods on JEB UI that contain code that matches the smali pattern and easily navigates to those functions. When you load the script and select `details.md` file among the droidlysis analysis files, a search box will appear. Once moved, you can easily bring up the search windows again by using recent script execution shortcut. 196 | 197 | - JEB > File > Scripts > Script selector > `script/DroidlysisSearch.py` 198 | - JEB > File > Scripts > Run last Script 199 | 200 | ## Updates 201 | 202 | - v3.4.7 - Removed Procyon, integrated several PR #24 and #25, added more detailed accessibility abuse detection 203 | - v3.4.6 - Detecting manifest feature that automatically loads APK at install 204 | - v3.4.5 - Creating a writable user kit.conf file 205 | - v3.4.4 - Bug fix #14 206 | - v3.4.3 - Using configuration files 207 | - v3.4.2 - Adding import of Exodus Privacy Trackers 208 | - v3.4.1 - Removed dependency to Androguard 209 | - v3.4.0 - Multidex support 210 | - v3.3.1 - Improving detection of Base64 strings 211 | - v3.3.0 - Dumping data to JSON 212 | - v3.2.1 - IP address detection 213 | - v3.2.0 - Dex2jar is optional 214 | - v3.1.0 - Detection of Base64 strings 215 | 216 | 217 | -------------------------------------------------------------------------------- /conf/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cryptax/droidlysis/ce37151642c53791fb267190bbe29668ede06346/conf/__init__.py -------------------------------------------------------------------------------- /conf/arm.conf: -------------------------------------------------------------------------------- 1 | [ch***] 2 | pattern=chmod|chown|chgrp|chcon|chattr 3 | 4 | [exec] 5 | pattern=\w*(?getPassword 15 | description=Tries to get the password of the phone account 16 | 17 | [airplane] 18 | pattern=android.intent.action.AIRPLANE_MODE 19 | description=Detects phone airplane mode 20 | 21 | [android_id] 22 | pattern=const-string v[0-9]*, "android_id" 23 | description=Retrieves the Android ID 24 | 25 | [andy] 26 | pattern=fstab.andy|ueventd.andy.rc|/system/bin/andy-prop|/system/etc/init.andy.sh|/system/lib/egl/libEGL_andy.so 27 | description=Andy emulator detection 28 | 29 | [answer_call] 30 | pattern=;->answerRingingCall 31 | description=Answer a ringing call 32 | 33 | [apkprotect] 34 | pattern=APKProtect 35 | description=Obfuscation with APKProtect 36 | 37 | [base64] 38 | pattern=Landroid/util/Base64;-> 39 | description=Uses Base64 encoder/decoder 40 | 41 | [battery] 42 | pattern=android.intent.action.BATTERY_CHANGED 43 | description=Gets battery info (e.g. how charged, temperature) 44 | 45 | [bluetooth] 46 | description=Uses Bluetooth 47 | pattern=BluetoothGatt|[0-9A-F]*-[0-9A-F]*-[0-9A-F]*-[0-9A-F]*-[0-9A-F]* 48 | 49 | [bluestacks] 50 | pattern=com.bluestacks|/sys/devices/virtual/misc/bst_gps|/sys/devices/virtual/misc/bst_ime|/sys/devices/virtual/misc/bstpgaipc|/sys/devices/platform/hd_power|/mnt/windows/BstSharedFolder|/system/bin/bstfolderd|/system/bin/bstsyncfs|/data/.bluestacks.prop|/system/lib/egl/libGLES_bst.so 51 | description=Bluestacks emulator detection 52 | 53 | [board] 54 | pattern=Build;->BOARD 55 | description=Retrieves hardware board information 56 | 57 | [bookmarks] 58 | pattern=BOOKMARKS_URI|Landroid/provider/Browser;->getAllBookmarks 59 | description=Adds or reads bookmarks to the phone browser 60 | 61 | [bootloader] 62 | pattern=Build;->BOOTLOADER 63 | description=Retrieves version of bootloader 64 | 65 | [brand] 66 | pattern=Build;->BRAND 67 | description=Retrieves phone brand name 68 | 69 | [busybox] 70 | pattern=busybox 71 | description=Uses busybox, probably to issue native shell commands or run other processes 72 | 73 | [calendar] 74 | description=Read calendar events or reminders 75 | pattern=content://calendar|content://com.android/calendar/ 76 | 77 | [call] 78 | pattern=ACTION_CALL|ACTION_DIAL|android.intent.action.CALL 79 | description=Can place calls 80 | 81 | [call_log] 82 | pattern=android/provider/CallLog 83 | description=Reads the call log 84 | 85 | [camera] 86 | pattern=Landroid/hardware/Camera;->open 87 | description=Uses the phone camera 88 | 89 | [check_permission] 90 | pattern=Landroid/content/pm/PackageManager;->checkPermission|Landroid/content/Context;->checkPermission 91 | description=Checks for given permissions 92 | 93 | [class_loader] 94 | pattern=Class;->getClassLoader 95 | description=Get class loader. Can be used for reflexion or dynamic class loading 96 | 97 | [contacts] 98 | pattern=android/provider/ContactsContract 99 | description=Reads or lists phone contacts 100 | 101 | [cookie_manager] 102 | pattern=android/webkit/CookieManager;-> 103 | description=Looks into cookies 104 | 105 | [cpu_abi] 106 | pattern=Build;->CPU_ABI 107 | description=Retreives CPU ABI 108 | 109 | [crc32] 110 | pattern=java/util/zip/CRC32;->init 111 | description=Computes CRC32 112 | 113 | [c2dm] 114 | pattern=intent.REGISTER|intent.UNREGISTER|Lcom/google/android/gcm/GCMRegistrar;->getRegistrationId 115 | description=Registers or unregisters C2DM (Cloud to Device Messaging) 116 | 117 | [debugger] 118 | pattern=Debug;->isDebuggerConnected 119 | description=Detects connected debugger 120 | 121 | [device_admin] 122 | pattern=DeviceAdminReceiver|isAdminActive 123 | description=Creates or uses a device administrator app 124 | 125 | [dex_class_loader] 126 | pattern=DexClassLoader|PathClassLoader|InMemoryDexClassLoader 127 | description=Potentially trying to silently run another DEX executable 128 | 129 | [dex_file] 130 | pattern=Ldalvik/system/DexFile;-> 131 | description=Manipulates DEX files 132 | 133 | [dhcp_server] 134 | pattern=Landroid/net/DhcpInfo;->serverAddress 135 | description=Queries the address of a DHCP server 136 | 137 | [dns] 138 | pattern=Landroid/net/DhcpInfo;->dns 139 | description=Queries the address of a DNS server 140 | 141 | [doze_mode] 142 | pattern=;->isIgnoringBatteryOptimizations|REQUEST_IGNORE_BATTERY_OPTIMIZATIONSREQUEST_IGNORE_BATTERY_OPTIMIZATIONS 143 | description=Ignore battery optimizations (used to avoid running as foreground service) 144 | 145 | [email] 146 | pattern=EXTRA_EMAIL|EXTRA_SUBJECT|EXTRA_BCC|EXTRA_CC|extra\.SUBJECT|android/net/MailTo 147 | description=Reading/writing or sending an email 148 | 149 | [emulator] 150 | pattern=15555215554|310260000000000|e21833235b6eef10|com.framgia.android.emulator 151 | description=Emulator detection techniques 152 | 153 | [encryption] 154 | pattern=KeySpec|SecretKey|Cipher 155 | description=Uses encryption 156 | 157 | [end_call] 158 | pattern=;->endCall 159 | description=End a phone call 160 | 161 | [execute_native] 162 | pattern=Runtime;->exec|createSubprocess|Ljava/lang/ProcessBuilder;->start|android.os.Exec 163 | description=Executes shell or native executables 164 | 165 | [fingerprint] 166 | pattern=Build;->FINGERPRINT 167 | description=Retrieves hardware Build fingerprint 168 | 169 | [genymotion] 170 | pattern=/dev/socket/baseband_genyd|/dev/socket/genyd|genymotion 171 | description=Detect GenyMotion emulator 172 | 173 | [gesture] 174 | pattern=android/accessibilityservice/GestureDescription|android/accessibilityservice/AccessibilityService;->dispatchGesture 175 | description=Creating gestures on behalf of end-user 176 | 177 | [get_accounts] 178 | pattern=AccountManager;->getAccounts|ContactsContract\$CommonDataKinds\$Email|Patterns\$EMAIL_ADDRESS 179 | description=Possibly trying to retrieve the phone operational email address 180 | 181 | [get_active_network_info] 182 | pattern=getActivateNetworkInfo 183 | description=Returns details about the currently active default data network 184 | 185 | [get_external_storage_stage] 186 | pattern=Landroid/os/Environment;->getExternalStorageState 187 | description=Reads storage state, possibly to tell if SD card mounted read-only or read-write 188 | 189 | [get_imei] 190 | pattern=getDeviceId 191 | description=Retrieves phone IMEI 192 | 193 | [get_imsi] 194 | pattern=getSubscriberId 195 | description=Retrieves user IMSI 196 | 197 | [get_installed_packages] 198 | pattern=PackageManager;->getInstalledPackages|PackageManager;->getInstalledApplications 199 | description=Lists installed packages 200 | 201 | [get_installer_package_name] 202 | pattern=PackageManager;->getInstallerPackageName 203 | description=Gives the name of the app which installed a given package 204 | 205 | [get_line_number] 206 | pattern=getLine1Number 207 | description=Retrieves end user Phone number (line number) 208 | 209 | [get_mac] 210 | pattern=getMacAddress 211 | description=Retrieves MAC address 212 | 213 | [get_network_operator] 214 | # this will also match NetworkOperatorName 215 | pattern=getNetworkOperator 216 | description=Retrieves Network operator 217 | 218 | [get_package_info] 219 | pattern=PackageManager;->getPackageInfo 220 | description=Gets information on package 221 | 222 | [get_sim_country_iso] 223 | pattern=getSimCountryIso 224 | description=Retrieves SIM country 225 | 226 | [get_sim_operator] 227 | pattern=getSimOperator 228 | description=Retrieves SIM operator 229 | 230 | [get_sim_serial_number] 231 | pattern=getSimSerialNumber 232 | description=Retrieves SIM serial number 233 | 234 | [get_sim_slot_index] 235 | pattern=SubscriptionInfo;->getSimSlotIndex 236 | description=Get SIM slot index 237 | 238 | [get_top_activity_component] 239 | pattern=Landroid/app/ActivityManager\$RunningTaskInfo;->topActivity 240 | description=Get the component of the top activity 241 | 242 | [gps] 243 | pattern=Location;->getLatitude|Location;->getLongitude|;->getCid|;->getLac|LocationManager;->getLastKnownLocation|TelephonyManager;->getCellLocation|LocationManager;->requestLocationUpdates|TelephonyManager;->getNeighboringCellInfo 244 | description=Uses GPS location 245 | 246 | [gzip] 247 | pattern=java/util/zip/GZipOutputStream|java/util/zip/GZipInputStream 248 | description=Reads or writes GZipped data 249 | 250 | [hardware] 251 | pattern=Build;->HARDWARE 252 | description=Retrieves phone hardware information 253 | 254 | [hide_softkeyboard] 255 | pattern=hideSoftInputFromWindow 256 | description=Hides software keyboard 257 | 258 | [http] 259 | pattern=HttpGet|HttpMessage|HttpRequest|URLConnection;->openConnection 260 | description=Performs HTTP GET 261 | 262 | 263 | [intent_chooser] 264 | pattern=Intent;->createChooser 265 | description=Uses intent chooses to ask end-user what application to use when a given event occurs (e.g which email app to use to send an email) 266 | 267 | [ip_address] 268 | pattern=Landroid/net/DhcpInfo;->ipAddress|getIpAddress|net/InetAddress;->getHostAddress 269 | description=Retrieves the device IP address 270 | 271 | [ip_properties] 272 | pattern=Landroid/net/DhcpInfo;->netmask|Landroid/net/DhcpInfo;->gateway 273 | description=Gets the netmask or gateway used by the device 274 | 275 | [javascript] 276 | pattern=Landroid/webkit/WebSettings;->setJavaScriptEnabled|Landroid/webkit/WebView;->addJavascriptInterface 277 | description=Loads JavaScript in WebView 278 | 279 | [jni] 280 | pattern=JNIEnv| native |jclass|jmethodID|jfieldID|FindClass 281 | description=Uses Java JNI 282 | 283 | [json] 284 | pattern=org/json/JSONObject 285 | description=Uses JSON objects 286 | 287 | [keyguard] 288 | pattern=KeyguardManager\$KeyguardLock;->|FLAG_DISMISS_KEYGUARD|android/app/admin/DevicePolicyManager;->lockNow 289 | description=Probably tries to unlock the phone 290 | 291 | [kill_proc] 292 | pattern=android/app/ActivityManager;->killBackgroundProcesses 293 | description=Kills background process 294 | 295 | [link_speed] 296 | pattern=android/net/wifi/WifiInfo;->getLinkSpeed 297 | description=Gets link speed for Wifi 298 | 299 | [load_dex] 300 | pattern=openDexFile|loadDex 301 | description=Loads a DEX executable 302 | 303 | [load_library] 304 | pattern=System;->loadLibrary 305 | description=Loads a native library 306 | 307 | [logcat] 308 | pattern=logcat 309 | description=Inspects or manipulates system logs 310 | 311 | [manufacturer] 312 | pattern=Build;->MANUFACTURER 313 | description=Retrieves hardware manufacturer name 314 | 315 | [methodchannel] 316 | pattern=io/flutter/plugin/common/MethodChannel;-> 317 | description=Communicates with Flutter layer 318 | 319 | [microphone] 320 | pattern=android/media/AudioManager;->setMicrophoneMute 321 | description=Mutes the microphone 322 | 323 | [misecurity] 324 | pattern=com.miui.securitycenter 325 | description=Checks presence, navigates to Mi Security Center or tries to disable security settings 326 | 327 | [model] 328 | pattern=Build;->MODEL 329 | description=Retrieves hardware build model 330 | 331 | [nop] 332 | pattern= nop 333 | description=DEX bytecode contains NOP instructions. 334 | 335 | [nox] 336 | pattern=fstab.nox|init.nox.rc|ueventd.nox.rc|com.bignox.app|nox-prop|nox-vbox-sf|noxspeedup|libnoxspeedup.so|libnoxd.so 337 | description=NOX emulator detection 338 | 339 | [obfuscation] 340 | pattern=/a/a;->a|AESObfuscator-1 341 | description=Obvious traces of code obfuscation 342 | 343 | [open_non_asset] 344 | pattern=openNonAsset 345 | description=Opens a non asset file 346 | 347 | [package_delete] 348 | pattern=android.intent.action.DELETE 349 | description=Uninstalls a package 350 | 351 | [package_session] 352 | pattern=PackageInstaller;->createSession|PackageInstaller;->openSession 353 | description=Session-based package installer, potentially to bypass Restricted Settings 354 | 355 | [package_sig] 356 | pattern=PackageInfo;->signatures|GET_SIGNATURES 357 | description=Reads signatures of packages 358 | 359 | [pangxie] 360 | pattern=PangXie 361 | description=Uses PangXie obfuscation 362 | 363 | [password] 364 | pattern=android/app/admin/DevicePolicyManager;->resetPassword|android/app/admin/DevicePolicyManager;->clearResetPasswordToken|android/app/admin/DevicePolicyManager;->clearUserRestriction 365 | description=Reset smartphone password 366 | 367 | [perform_action] 368 | pattern=android/view/accessibility/AccessibilityNodeInfo;->performAction|android/accessibilityservice/AccessibilityService;->performGlobalAction 369 | description=Perform action (click, scroll etc) on behalf of end user 370 | 371 | [phone_number] 372 | pattern=android.intent.extra.PHONE_NUMBER 373 | description=Retrieves an Incoming or outgoing phone number 374 | 375 | [play_protect] 376 | pattern=.security.settings.VerifyAppsSettingsActivity 377 | description=Tries to launch or disable Google Play Protect 378 | 379 | [post] 380 | pattern=POST |HttpPost|"POST"|POST 381 | description=Tries to perform an HTTP POST. There might be False Positives... 382 | 383 | [product] 384 | pattern=Build;->PRODUCT 385 | description=Retrieves hardware build product 386 | 387 | [receive_sms] 388 | pattern=SmsReceiver|;->createFromPdu|SmsObserver|;->getOriginatingAddress|content://sms|SmsMessage|SMS_RECEIVED 389 | description=Receiving SMS 390 | 391 | [record] 392 | pattern=android/media/AudioRecord;->startRecording 393 | description=Records audio on the phone 394 | 395 | [record_screen] 396 | pattern=Landroid/media/projection/MediaProjection;->createVirtualDisplay 397 | description=Records screen 398 | 399 | [reflection] 400 | pattern=Class;->forName|Method;->invoke|Class;->getDeclaredMethods|Method;->setAccessible|java/lang/ClassLoader;->loadClass|Class;->getMethod|java/lang/reflect/Constructor;->newInstance 401 | description=Uses Java Reflection 402 | 403 | [ringer] 404 | pattern=android/media/AudioManager;->setRingerMode|android/media/AudioManager;->getRingerMode 405 | description=Gets or sets ringer mode 406 | 407 | [rooting] 408 | pattern=com.amphoras.hidemyroot|com.amphoras.hidemyrootadfree|com.chelpus.lackypatch|com.cyanogenmod|com.devadvance.rootcloak|com.dimonvideo.luckypatcher|com.formyhm.hideroot|com.koushikdutta.rommanager|com.koushikdutta.superuser|com.noshufou.android.su|com.ramdroid.appquarantine|com.saurik.substrate|com.thirdparty.superuser|com.topjohnwu.magisk|com.yellowes.su|com.zachspong.temprootremovejb|de.robv.android.xposed.installer|eu.chainfire.supersu|io.github.huskydg.magisk|me.phh.superuser|me.weishu.kernelsu|org.lsposed.daemon|org.lsposed.manager|Superuser.apk 409 | description=Searches for or uses applications typically installed on rooted phones. 410 | 411 | [rssi] 412 | pattern=android/net/wifi/WifiInfo;->getRssi 413 | description=Gets Wifi RSSI 414 | 415 | [scp] 416 | pattern=const-string v[0-9]*, ".*scp.*" 417 | description=Sends or retrieves files via SCP 418 | 419 | [search_url] 420 | pattern=Landroid/provider/Browser;->addSearchUrl 421 | description=Adds a new search URL to the browser 422 | 423 | 424 | [send_sms] 425 | pattern=;->sendTextMessage|;->sendMultipartTextMessage|SmsManager;->sendDataMessage 426 | description=Sending SMS messages 427 | 428 | [sensor] 429 | pattern=android/hardware/SensorManager;->getSensorList|onSensorChanged 430 | description=Lists hardware sensors or receives sensor events. Sometimes abused to check the phone is running in a sandbox. 431 | 432 | [set_component] 433 | pattern=PackageManager;->setComponentEnabledSetting 434 | description=Might be trying to hide the application icon 435 | 436 | [shortcut] 437 | pattern=INSTALL_SHORTCUT 438 | description=Adds a new app shortcut to the phone 439 | 440 | [socket] 441 | pattern=Ljava/net/Socket;->|java/net/ServerSocket;->accept 442 | description=Creates a socket. Used to communicate... 443 | 444 | [ssh] 445 | pattern= const-string v[0-9]*, ".*ssh.*" 446 | description=Application uses SSH 447 | 448 | [ssl_pinning] 449 | pattern= javax/net/ssl/X509TrustManager;->checkClientTrusted | javax/net/ssl/X509TrustManager;->checkServerTrusted | javax/net/ssl/X509TrustManager;->getAcceptedIssuers | javax/net/ssl/HostnameVerifier;->verify | okhttp/CertificatePinner;->check | okhttp3/CertificatePinner;->check | javax/net/ssl/HttpsURLConnection;->setDefaultHostnameVerifier | javax/net/ssl/HttpsURLConnection;->setSSLSocketFactory | javax/net/ssl/HttpsURLConnection;->setHostnameVerifier | android/webkit/WebViewClient;->onReceivedSslError | org/apache/cordova/CordovaWebViewClient;->onReceivedSslError 450 | description=Application uses SSL Pinning to secure connection 451 | 452 | [ssid] 453 | pattern=android/net/wifi/WifiInfo;->getSSID 454 | description=Retrieves SSID used by Wifi 455 | 456 | [stacktrace] 457 | pattern=Throwable;->getStackTrace 458 | description=Get stack traces. Can be used as Anti Frida technique. 459 | 460 | [su] 461 | pattern="su"|/system/xbin/daemonsu|/system/xbin/sugote|/vendor/bin/su|/odm/bin/su|/product/bin/su|/system/bin/.su|/system/xbin/.su|/system/app/Superuser.apk|/sbin/su|/system/bin/su|/system/xbin/su|/data/local/su|/su/bin/su|/data/local/bin/su|/data/local/xbin/su|/system/bin/.ext/su|/system/bin/failsafe/su|/system/sd/xbin/su|/system/usr/we-need-root/su|/cache/su|/data/su|/dev/su 462 | description=Uses Su. Perhaps to test if device is rooted. 463 | 464 | [substrate] 465 | pattern=com/saurik/substrate/MS 466 | description=Uses or refers to Saurik substrate 467 | 468 | [system_app] 469 | pattern=android/app/admin/DevicePolicyManager;->enableSystemApp 470 | description=System apps cannot be deleted, a feature which interests some malware... 471 | 472 | [tasks] 473 | pattern=android/app/ActivityManager;->getRunningTasks 474 | description=Lists running tasks 475 | 476 | [teamviewer] 477 | pattern=com.teamviewer.quicksupport.market 478 | description=Checks presence, navigates to or uses Team Viewer remote control app 479 | 480 | [uri] 481 | pattern=Landroid/net/Uri;->parse 482 | description=Parses a URL. Will usually just display the URL, but not post info. 483 | 484 | [url_history] 485 | pattern=Landroid/provider/Browser;->getAllVisitedUrls 486 | description=Gets all URLs the phone browser visited 487 | 488 | [user_agent] 489 | pattern=User-Agent 490 | description=Specifies a HTTP User Agent 491 | 492 | [uuid] 493 | pattern=UUID;->randomUUID 494 | description=Creates a random identifier. Used to identify the user. 495 | 496 | [version] 497 | pattern=Build\$VERSION;->RELEASE|Build\$VERSION;->CODENAME 498 | description=Build version 499 | 500 | [vibrate] 501 | pattern=android/os/Vibrator;->vibrate 502 | description=Uses phone vibrations 503 | 504 | [vnd_package] 505 | pattern=application/vnd.android.package_archive 506 | description=Probably tries to load an app 507 | 508 | [wakelock] 509 | pattern=android/os/PowerManager\$WakeLock;->acquire() 510 | description=Get PowerManager WakeLock (typically used to conceal a running malware while keeping screen blank) 511 | 512 | [wallpaper] 513 | pattern=android/app/WallpaperManager;->getDrawable|android/app/WallpaperManager;->setBitmap 514 | description=Gets or sets the current wallpaper 515 | 516 | [webview] 517 | pattern=Landroid/webkit/WebView;->loadUrl|;->setWebChromeClient 518 | description=Displays a URL in the WebView. Very much used to display custom pages with JavaScript, sometimes malicious... 519 | 520 | [wifi] 521 | pattern=android/net/wifi/WifiManager;->setWifiEnabled|android/net/wifi/WifiManager;->isWifiEnabled|android/net/wifi/WifiManager;->startScan 522 | description=Tests or scans for WiFi 523 | 524 | [zip] 525 | pattern=java/util/zip/ZipOutputStream|java/util/zip/ZipInputStream|java/util/zip/ZipEntry 526 | description=Zips or unzips files 527 | 528 | [2fa] 529 | pattern=com.google.android.apps.authenticator2 530 | description=Checks presence of 2FA app, or navigates to it, or steals PIN 531 | -------------------------------------------------------------------------------- /conf/sortconf.py: -------------------------------------------------------------------------------- 1 | import argparse 2 | import configparser 3 | 4 | DEFAULTSECT = 'default' 5 | 6 | def get_arguments(): 7 | parser = argparse.ArgumentParser(description="Sort conf files by alphabetic order of sections", prog='sortconf') 8 | parser.add_argument('-i', '--input', help='Input conf file', action='store', default='./kit.conf') 9 | parser.add_argument('-o', '--output', help='Output file', action='store', default='./sorted.conf') 10 | parser.add_argument('-v', '--verbose', help='get more detailed messages', action='store_true') 11 | args = parser.parse_args() 12 | return args 13 | 14 | 15 | class OrderedRawConfigParser( configparser.RawConfigParser ): 16 | """ 17 | Overload standart Class ConfigParser.RawConfigParser 18 | """ 19 | def __init__( self, defaults = None, dict_type = dict ): 20 | configparser.RawConfigParser.__init__( self, defaults = None, dict_type = dict ) 21 | 22 | def write(self, fp): 23 | """Write an .ini-format representation of the configuration state.""" 24 | if self._defaults: 25 | fp.write("[%s]\n" % DEFAULTSECT) 26 | for key in sorted( self._defaults ): 27 | fp.write( "%s = %s\n" % (key, str( self._defaults[ key ] ).replace('\n', '\n\t')) ) 28 | fp.write("\n") 29 | for section in self._sections: 30 | fp.write("[%s]\n" % section) 31 | for key in sorted( self._sections[section] ): 32 | if key != "__name__": 33 | fp.write("%s = %s\n" % 34 | (key, str( self._sections[section][ key ] ).replace('\n', '\n\t'))) 35 | fp.write("\n") 36 | 37 | def main(): 38 | args = get_arguments() 39 | parser = OrderedRawConfigParser() 40 | parser.read(args.input) 41 | output = open(args.output,'w') 42 | parser.write(output) 43 | output.close() 44 | 45 | 46 | if __name__ == "__main__": 47 | main() 48 | -------------------------------------------------------------------------------- /conf/wide.conf: -------------------------------------------------------------------------------- 1 | [am_start] 2 | pattern=am start 3 | description=Start an activity via shell command 4 | 5 | [android_wear] 6 | pattern=Android\ Wear|android_wear 7 | description=Uses or references Android Wear 8 | 9 | [china_mobile] 10 | pattern=cmwap|cmnet 11 | description=Detects China Mobile network 12 | 13 | [china_unicom] 14 | pattern=uniwap|uninet 15 | description=Detects China Unicom network 16 | 17 | [china_telecom] 18 | pattern=ctwap|ctnet 19 | description=Detects China Telecom network 20 | 21 | [coinhive] 22 | pattern=CoinHive 23 | description=CoinHive JavaScript SDK for mining Monero 24 | 25 | [cryptocurrency] 26 | pattern=CoinHive|crypta\.js|crypto-loot|ethereum|dogecoin|litecoin|bitcoin|ledger|blockchain|trezor 27 | description=Uses cryptocurrencies 28 | 29 | [cryptoloot] 30 | pattern=crypta\.js|crypto-loot 31 | 32 | [c2_anon] 33 | pattern=portmap\.io|ngrok\.io 34 | description=Port forwarding or secure tunneling service - often used to anonymize C2 35 | 36 | [gps] 37 | pattern=LocationManager 38 | description=Use of GPS noticed in assets, libraries or other unusual directories 39 | 40 | [javascript] 41 | pattern=