Droidbox Malicious software dynamic Analysis environment construction

@author: dlive 0x01 droidbox Introduction

Droidbox is a piece that can get the following information

1.APK Package Hash value

2. Network communication Data

3. File read and write operations

4. Network communication, file read and write, Information disclosure in SMS

5. Permissions Vulnerability

6. Call the Android API for cryptographic operations

7.Broadcast Receiver Component Information

8.SMS SMS and phone information

9.DexClassLoader Loading information 0x02 Droidbox installation Run

Native Existing environment:

1. Ubuntu 14.04 AMD64

Installation Environment:

1. Oracle JDK 1.7 (apktools requires a jdk1.7 environment)

2. Android SDK

3. Apktool

4. Droidbox 0x03 JDK Installation

Download the JDK installation package from Oracle website jdk-7u79-linux-x64.tar.gz

Http://www.oracle.com/technetwork/java/javase/downloads/java-archive-downloads-javase7-521261.html

Unzip the installation package into the/home/android/java directory

Configure the environment variables in/etc/profile as follows

Run. /etc/profile make environment variable effective 0x04 Android SDK installation

Download Android SDK Compression pack android-sdk_r22.6.2-linux.tgz

Unzip the tarball into the/HOME/ANDROID/SDK directory

However, this SDK package is not a complete SDK, which does not contain common tools platform-tools

Run the . Tools/android SDK command, select the API version and platform-tools you want to install

Set up the agent can download: (not set the words will be very slow in the country ...) You know that)

Configure the environment variables in/etc/profile as follows

0x04 Apktool Installation

Follow the official website instructions to download the installation, this is not much to say

http://ibotpeaches.github.io/Apktool/install/

Configure Environment variables

0x05 Droidbox Installation

Download a whole bunch of dependent packages

Apt-get Install Python-dev python-numpy python-scipy python-matplotlib ipython ipython-notebook Python-pandas Python-sympy Python-nose

Download the latest version of Droidbox https://github.com/pjlantz/droidbox/releases

Here i download the latest version:DroidBox411RC.tar.gz (for Android 4.1.1)

To create an Android virtual machine:

Android List Target #查看可获取的安卓虚拟机

Android List AvD #查看已创建的安卓虚拟机

Android Create avd-n <avd name>-t <android id> #创建一个虚拟机, custom name

(Command to start the virtual machine: Emulator @droidbox_android4.1.2)

Here I am creating a virtual machine with API16 Android 4.1.2 (ARM core –abi armabi-v7a)

Start virtual machine:./startemu.sh droidbox_android4.1.2

Install to analyze apk:adb install 1.apk

Start analysis:./droidbox.sh 1.apk

Profiling time can be set:./droidbox.sh 1.apk 10 (10 = 10s) 0x00 reference

1. Droidbox-android app Dynamic Analysis tool &apimonitor--carbon matrix

http://danqingdani.blog.163.com/blog/static/18609419520121125104952911

2. Droidbox Environment Construction

http://blog.csdn.net/ccc7560673/article/details/8004039

3. Create an Android emulator on Linux

http://blog.csdn.net/ruanjianxiong/article/details/7620570

4. Flappy Bird Malicious program detailed analysis – Cloud knowledge

http://drops.wooyun.org/tips/1314

Droidbox Malicious software dynamic Analysis environment construction