Google Summer of Code 2012

Hi !

For the first year, Androguard is in the GSOC with Honeynet. The "idea" of the project is to improve Androguard by adding new databases of adware (or classical software) to identify them. And we would like to display the results of similarities and differences between Android Applications, so we need a GUI!

The deadline is April 6th at 19:00 UTC. If you are a student, you can apply on this webpage.

Hurry up !

Fakeinst + Christian Andersen

Hi !

I saw in FakeInst sample an interesting trick :

desnos@t0t0:~/androguard$ ./androlyze.py -s
Androlyze version 1.0
In [1]: a, d, dx = AAnalyzeAPK("./apks/malwares/fakeinst.b/338666398c775c0690e78a632cd861c541d0f1da6c9134506881487526a9786c", decompiler="dex2jad")
In [2]: d.CL
d.CLASS_Ldfjg6_Gtr6H_B66gGh
d.CLASS_Ldfjg6_Gtr6H_HeavendeliverusfromthewildNorthmen
d.CLASS_Ldfjg6_Gtr6H_OnthecoastofFrancetheresoundedacryoffearforthebloodstained
d.CLASS_Ldfjg6_Gtr6H_closebytheEmperorthroneandspreadtheirwingsover
d.CLASS_Ldfjg6_Gtr6H_himasshieldstoprotecthimTheyreceivedthenameofVarangians
d.CLASS_Ldfjg6_Gtr6H_southwardtoByzantiumtheswansestablishedthemselvesthere
d.CLASS_Ldfjg6_Gtr6H_swansthatcamefromtheNorthwithfireundertheirwingsandthepeopleprayed
d.CLASS_Lyhj_hffd_BetaReceiver
d.CLASS_Lyhj_hffd_BetaService
d.CLASS_Lyhj_hffd_BetaWebA
d.CLASS_Lyhj_hffd_BootReceiver
d.CLASS_Lyhj_hffd_HeavendeliverusfromthewildNorthmen
d.CLASS_Lyhj_hffd_HtmlActivity
d.CLASS_Lyhj_hffd_OnthecoastofFrancetheresoundedacryoffearforthebloodstained
d.CLASS_Lyhj_hffd_OnthefreshswardofEnglandstoodtheDanishswan
d.CLASS_Lyhj_hffd_andhestretchedouthisgoldensceptreoverthelandTheheathens
d.CLASS_Lyhj_hffd_bytheopenseashorewiththecrownofhreekingdomsonhishead
d.CLASS_Lyhj_hffd_closebytheEmperorthroneandspreadtheirwingsover
d.CLASS_Lyhj_hffd_himasshieldstoprotecthimTheyreceivedthenameofVarangians
d.CLASS_Lyhj_hffd_nthePomeriancoastbentthekneeandtheDanishswanscamewiththebanneroftheCrossandwiththedrawnsword
d.CLASS_Lyhj_hffd_southwardtoByzantiumtheswansestablishedthemselvesthere
d.CLASS_Lyhj_hffd_swansthatcamefromtheNorthwithfireundertheirwingsandthepeopleprayed
d.CLASS_Lyhj_southwardtoByzantiumtheswansestablishedthemselvesthere_closebytheEmperorthroneandspreadtheirwingsover
d.CLASS_Lyhj_southwardtoByzantiumtheswansestablishedthemselvesthere_southwardtoByzantiumtheswansestablishedthemselvesthere


As you can see, the name of each class (and finaly each method, field) is obfuscated, but few classes are obfuscated with "curious" names :

• OnthecoastofFrancetheresoundedacryoffearforthebloodstaine -> On the coast of France the ...

In fact, all these sentences come from a book "Fairy Tales" of Christian Andersen :)

Now, you can read a book during an analysis of an android malware !

Androguard + Mercury

Hi !

I saw Mercury and I wanted to test it in order to check malware or others things with my tools, so I wrote a small script to do that.

You can follow the quick start in order to install and run mercury in an emulator or in your device. After that, you can download androguard, compile it, and create a symlink from your mercury directory to androguard main directory.

Next, you can view all packages:
desnos@t0t0:~/androguard$ ./andromercury.py -l *

Package name: android
Process name: system
Version: 4.0.3-237985
Data directory: /data/system
APK path: /system/framework/framework-res.apk
UID: 1000
GID: 1015; 3002; 3001; 3003;
SharedUserId: android.uid.system (1000)
Permissions: android.intent.category.MASTER_CLEAR.permission.C2D_MESSAGE; android.permission.CONFIRM_FULL_BACKUP;

[...]

And you can also get specific packages and save them directly in a directory :

desnos@t0t0:~/androguard$ ./andromercury.py -i com.mwr.mercury -o outputmercury/

Package name: com.mwr.mercury

Process name: com.mwr.mercury

Version: 1.0

Data directory: /data/data/com.mwr.mercury

APK path: /data/app/com.mwr.mercury-1.apk

UID: 10040

GID: 3003; 

Permissions: android.permission.INTERNET;

/data/app/com.mwr.mercury-1.apk 6f9fadea2f620445e159f3818553b5aa 

But for now, it is exactly the same things as the mercury shell, but are you interesting to scan offline your apps from your mobile phone ? :) 

If yes, you must specify a database (in my case it will be my opensource database of malware) and a config :

desnos@t0t0:~/androguard$ ./andromercury.py -i com.mwr.mercury -o outputmercury/ -b signatures/dbandroguard -c signatures/dbconfig 

Package name: com.mwr.mercury

Process name: com.mwr.mercury

Version: 1.0

Data directory: /data/data/com.mwr.mercury

APK path: /data/app/com.mwr.mercury-1.apk

UID: 10040

GID: 3003; 

Permissions: android.permission.INTERNET;

/data/app/com.mwr.mercury-1.apk 6f9fadea2f620445e159f3818553b5aa  ----> None

And in a case of a malware :

desnos@t0t0:~/androguard$ ./andromercury.py -i org.eapp -o outputmercury/ -b signatures/dbandroguard -c signatures/dbconfig

Package name: org.eapp

Process name: org.eapp

Version: 2.9.2

Data directory: /data/data/org.eapp

APK path: /data/app/org.eapp-1.apk

UID: 10041

GID: 1015; 3003; 1007;

Permissions: android.permission.SEND_SMS; android.permission.RECEIVE_SMS; android.permission.WRITE_EXTERNAL_STORAGE; android.permission.ACCESS_COARSE_LOCATION; android.permission.ACCESS_COARSE_UPDATES; android.permission.ACCESS_FINE_LOCATION; android.permission.ACCESS_NETWORK_STATE; android.permission.ACCESS_WIFI_STATE; android.permission.CHANGE_WIFI_STATE; android.permission.DISABLE_KEYGUARD; android.permission.GET_ACCOUNTS; android.permission.GET_TASKS; android.permission.INTERNET; android.permission.KILL_BACKGROUND_PROCESSES; android.permission.MANAGE_ACCOUNTS; android.permission.MOUNT_FORMAT_FILESYSTEMS; android.permission.MOUNT_UNMOUNT_FILESYSTEMS; android.permission.READ_CONTACTS; android.permission.READ_LOGS; android.permission.READ_PHONE_STATE; android.permission.READ_SMS; android.permission.READ_SYNC_SETTINGS; android.permission.RECEIVE_BOOT_COMPLETED; android.permission.RESTART_PACKAGES; android.permission.WRITE_CALENDAR; android.permission.WRITE_CONTACTS; android.permission.WRITE_OWNER_DATA; android.permission.WRITE_SETTINGS; android.permission.WRITE_SMS; android.permission.WRITE_SYNC_SETTINGS; android.permission.WRITE_USER_DICTIONARY; com.android.browser.permission.READ_HISTORY_BOOKMARKS; com.android.browser.permission.WRITE_HISTORY_BOOKMARKS; com.android.launcher.permission.INSTALL_SHORTCUT; com.android.launcher.permission.UNINSTALL_SHORTCUT; com.android.launcher.permission.WRITE_SETTINGS; com.htc.launcher.permission.WRITE_SETTINGS; com.sonyericsson.homescreen.permission.READ_SETTINGS; com.sonyericsson.homescreen.permission.WRITE_SETTINGS; org.antivirus.permission.C2D_MESSAGE; com.google.android.c2dm.permission.RECEIVE; com.android.vending.CHECK_LICENSE; android.permission.SUBSCRIBED_FEEDS_WRITE; android.permission.VIBRATE;

/data/app/org.eapp-1.apk a2e328813532f00b31c90f56560dce2e  ----> Foncy.B

I will update this script to support new things in future with my framework.

Thx to MWR Labs for this framework ! You guys rock !

Faketoken or Opfake ?

Faketoken is a trojan banker on Android platform. You can find few analysis links on this malware on my open source database of android malware.

But I was working on my Android similarities tool in order to improve it and I found an interesting thing on the Faketoken sample (10/43) and the opfake.d/fakeinst sample (16/41) :

desnos@t0t0:~/androguard$ ./androsim.py -i apks/plagiarism/opfake/santander.apk apks/plagiarism/opfake/61da462a03d8651a6088958b438b44527973601e604e3ca18cb7aa0b3952d2ac -s 100 -d -e "Lorg/simpleframework/"

Elements:
         IDENTICAL:     9
         SIMILAR:       3
         NEW:           14
         DELETED:       11
         SKIPPED:       5260
        --> methods: 44.998713% of similarities
SIMILAR methods:
        Ltoken/bot/MainApplication; loadStartSettings (Ljava/lang/String;)Ltoken/bot/StartSettings; 230
                --> Lcom/load/wap/MainApplication; loadStartSettings (Ljava/lang/String;)Lcom/load/wap/StartSettings; 190 0.375
        Ltoken/bot/MainService; threadOperationRun (I Ljava/lang/Object;)V 197
                --> Lcom/load/wap/MainService; threadOperationRun (I Ljava/lang/Object;)V 122 0.319999992847
        Ltoken/bot/ServerResponse; <init> ()V 133
                --> Lcom/load/wap/ServerResponse; <init> ()V 125 0.214285716414
IDENTICAL methods:
        Ltoken/bot/MainApplication; DownloadApk (Ljava/lang/String; Ljava/lang/String;)Z 106
                --> Lcom/load/wap/MainApplication; DownloadApk (Ljava/lang/String; Ljava/lang/String;)Z 106
        Ltoken/bot/Settings; isCatchMessage (Ljava/lang/String; Ljava/lang/String;)Ltoken/bot/CatchResult; 165
                --> Lcom/load/wap/Settings; isCatchMessage (Ljava/lang/String; Ljava/lang/String;)Lcom/load/wap/CatchResult; 165
        Ltoken/bot/MainApplication; getContacts (Landroid/content/Context;)Ljava/util/Vector; 230
                --> Lcom/load/wap/MainApplication; getContacts (Landroid/content/Context;)Ljava/util/Vector; 230
        Ltoken/bot/MainApplication; dateFromString (Ljava/lang/String;)Ljava/util/Date; 103
                --> Lcom/load/wap/MainApplication; dateFromString (Ljava/lang/String;)Ljava/util/Date; 103
        Ltoken/bot/Settings; isDeleteMessage (Ljava/lang/String; Ljava/lang/String;)Z 132
                --> Lcom/load/wap/Settings; isDeleteMessage (Ljava/lang/String; Ljava/lang/String;)Z 132
        Ltoken/bot/UpdateActivity; setMainScreen ()V 107
                --> Lcom/load/wap/UpdateActivity; setMainScreen ()V 107
        Ltoken/bot/MainApplication; sendGetRequest (Ljava/lang/String; Ljava/util/List;)V 132
                --> Lcom/load/wap/MainApplication; sendGetRequest (Ljava/lang/String; Ljava/util/List;)V 132
        Ltoken/bot/MainService; onStart (Landroid/content/Intent; I)V 106
                --> Lcom/load/wap/MainService; onStart (Landroid/content/Intent; I)V 106
        Ltoken/bot/MainApplication; sendPostRequest (Ljava/lang/String; Ljava/util/List;)V 197
                --> Lcom/load/wap/MainApplication; sendPostRequest (Ljava/lang/String; Ljava/util/List;)V 197

As you can see, there is a lot of similarities between this two samples, and only DrWeb has the same signature (Android.SmsSend.350.origin).

Do you think that is the same author for both malwares ?

Androguard + Gephi (part 2)

Hi,

it's not very easy to use the export of gexf file in androguard.
After the export of the gexf file :

desnos@t0t0:~/androguard$ ./androgexf.py -i apks/malwares/BaseBridge/com.keji.sendere.apk -o sendere.gexf
desnos@t0t0:~/androguard$ 

Most of the times you will have something like that :

which is not very usable. You must apply a layout in gephi to have something better :

and you will have a classical (but huge) graph :

You must activate :

1. the node labels
2. color node associated with the object
3. the size of the label

as in this picture :

After that you must search color node in the graph in order to find interestings methods as :

And you can create filter to isolate all particular class name :

and you will find more quickly where are the interesting things (related to the permissions) :

Moreover, in the data laboratory you can search and select particular nodes in the overview :

This feature will not replace a classical analyze with androlyze.py or smali/baksmali. It's just one tool :) but we are trying to search better tools to visualize an android application (and you can help).

Moreover, with gephi, you can apply classical community algorithm (Statistics/Modularity) :

All nodes will have a color which corresponds to the community :

In fact, each community can be a specific library (as the previous picture), or simply high depencies between methods :

Cya !

Virtual Machine for Android Reverse Engineering

Hi !!

Now, it's possible to download a virtual machine (for VirtualBox) with all interesting tools around android RE. So you can test directly Androguard, DroixBox, ....

See ya !

Androguard + Gephi

Hi !!

In one of the latest commit in the androguard repository (development version), I added the support of methods calls graph with Gephi.

It's a really cool feature because it's allow you to find directly all interesting information (activities, services, receivers, permissions risks (internet, privacy, sms, money), dynamic code loading ...), only by looking the graph :)

It's a beta version, and you will find more information on this wiki page.

see you !