decaf-project / droidscope Goto Github PK

A dynamic analysis platform for Android

Makefile 2.58% CMake 0.51% C 33.17% C++ 58.89% Assembly 0.56% Perl 0.24% M4 0.21% Batchfile 0.03% Shell 2.18% HTML 0.01% Java 0.54% Python 0.32% Roff 0.21% Objective-C 0.19% Objective-C++ 0.01% SAS 0.01% Smalltalk 0.31% WebAssembly 0.01% Module Management System 0.01% Haxe 0.03%

android dynamic-analysis taint-analysis

droidscope's Introduction

README

A docker file to build droidscope environment

Host environment:

Ubuntu 16.04
Android-5.0.0_r2
Goldfish 3.4
Docker
Please find more instructions here:
https://source.android.com/setup/build/downloading
https://github.com/enlighten5/android_build

Dependencies needed by Droidscope

Please download the dependencies at first via:
wget https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/external.tar.gz
wget https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/images.tar.gz
wget https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/prebuilts.tar.gz
wget https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/out.tar.gz
Then use tar -xvf to extract those files, which are needed in step 3

Steps to run Droidscope in docker:

1.Build the docker image

docker build --network=host -t droidscope /path/to/the/dockerfile

2.Search the created image:

sudo docker image ls and copy that IMAGE ID

3.Start the docker image:

sudo docker run -it -e DISPLAY -v /PATH/TO/EXTERNAL:/home/developer/android_source/external -v /PATH/TO/PREBUILTS:/home/developer/android_source/prebuilts -v /PATH/TO/OUT:/home/developer/android_source/out -v /PATH/TO/IMAGE:/home/developer/images -v /tmp/.X11-unix:/tmp/.X11-unix -v $HOME/.Xauthority:/home/developer/.Xauthority --net=host IMAGE_ID

4.Build Droidscope

cp -a /home/developer/Droidscope/droidscope/ /home/developer/android_source/external/
cd /home/developer/android_source/external/droidscope/
sudo ./android-configure.sh
sudo make -j4

5.Start Droidscope in docker container:

./startDroidScope.sh

6.Use `tab` to list the supported commands

eg. command ps to list the running process

Steps to use DroidUnpack

1. Build unpacker

./condigure --decaf-path=/<PATH_TO_DROIDSCOPE>/ --target=android then make

2. Install app

You may need to run install_uninstall.sh to install the app needed.
Or run the following commads before install the app
adb shell setprop dalvik.vm.dex2oat-filter "interpret-only"
adb shell setprop dalvik.vm.image-dex2oat-filter "interpret-only"

3. Load DroidUnpack in Droidscope

load_plugin DECAF_plugin/DroidUnpack/libunpacker.so

4. Run cmd

do_hookapitests procname

droidscope's People

Contributors

Stargazers

Watchers

Forkers

ppflower fengjixuchui freemanzyq 1ce0ear morangeous terry2012 pypy233 shuixi2013 knight-zxw bluepeople1 rahul07bagul

droidscope's Issues

Unable to download dependencies

Hello!

I'm unable to download the dependencies of the project. The request returns a 403:

$ wget https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/images.tar.gz
--2022-02-24 12:58:56--  https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/images.tar.gz
Resolving cluster.hpcc.ucr.edu (cluster.hpcc.ucr.edu)... 138.23.51.28, 138.23.51.126
Connecting to cluster.hpcc.ucr.edu (cluster.hpcc.ucr.edu)|138.23.51.28|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2022-02-24 12:58:57 ERROR 403: Forbidden.

Could this be looked into? Thanks!

raph

how to use droidunpacker?

when I load the plugin of "libunpacker.so". It prompt me loading successfully.
but when I enter strings below.
do_hookapitests com.android.providers.calendar
It shows:
teminate called after throwing an instance of 'std::invalid_argument'
what():pparse error - unexpected end of input
Aborted (core dumped)

could you tell me why it happened?
Furthermore,Is there some document for me to use this droidunpacker plugin to unpack the apk?

Fail to unpack the apk using droidunpack

Sorry to bother you, but I have no idea that what goes wrong.
I successfully load the plugin droidunpack, but in the next step, the whole system crashes down.
my input is:
(qemu) do_hookapitests com.example.hellojni
the output is:
terminate called after throwing an instance of 'std::invalid_argument' what(): parse error - unexpected end of input ./startDroidScope.sh: line 1: 129 Aborted (core dumped) sudo ./objs/emulator -no-audio -partition-size 1000 -sysdir /home/developer/images -kernel /home/developer/images/zImage -memory 4000 -qemu -monitor stdio

By the way, I find the file stats.json in the folder /home/developer/android_source/external/droidscope/DECAF_plugins/DroidUnpack/out

Any help will be appreciate! Forward to your reply!

Failed to dump some hidden DEX

Greetings! I am trying to use DroidUnpack to unpack some applications (installed using the install_uninstall.sh script) packed by Baidu and Qihoo but with no luck. It could be some unexpected misconfiguration introduced by me but it unpacked the "Hello JNI" successfully. Then I dug into the source code and logs and found that the dex file extracted from captured argument of DoCall and Invoke was always system@[email protected] instead of the hidden dex file of interest, hence only the packer dex was dumped. Any ideas on why this is happening and what should I do to fix it? Am I doing something wrong that prevent DroidUnpack from working properly? Thanks!

Download Dependencies needed by Droidscope Error

I am very sorry to trouble you. When i build the environment of DroidScope,there has something wrong! I have no idea to how to sove it. I would appreciate it if you could spare the time to tell me how to do？

when i wget https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/external.tar.gz,
the response is that:
Resolving cluster.hpcc.ucr.edu (cluster.hpcc.ucr.edu)... 138.23.51.126, 138.23.51.28
Connecting to cluster.hpcc.ucr.edu (cluster.hpcc.ucr.edu)|138.23.51.126|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2022-07-13 14:07:24 ERROR 403: Forbidden.

SDL init failure

Hello!
I meet the same problem that SDL init failure after execute the startDropScope.sh, but I can find the .X11-unix under the path /tmp/.X11-unix and .Xauthority under the path $HOME.
The following is the error screencut:

Could you give me a hand? Really appreciate your help!

Dependencies cannot be accessed

Hello! I am really interested in this repo, but I can't download the dependecies successfully via
wget https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/external.tar.gz
wget https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/images.tar.gz
wget https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/prebuilts.tar.gz
wget https://cluster.hpcc.ucr.edu/~zqi020/file_for_unpack/out.tar.gz
so is this link available now?
Any help will be appreciate! Forward to your reply!