一android学习笔记(静态分析动态分析及一些API)

这里学习apk文件的逆向技术，这是一点笔记

静态分析会通过反编译 apk 文件，分析其中的权限、组件、敏感函数等
信息，这些可以弥补动态分析中因未触发恶意行为而漏掉的行为。动态分析主要通过在模拟
器运行 Android 软件，然后再对软件进行一些操作以触发尽可能多的恶意行为，接着输出到
log 中，再通过脚本对日志进行分析。

一些敏感 API 函数列表

1. my %apis = (
   
2. "IActivityManager\$Stub\$Proxy\;\-\>shutdown" => '关机',
   
3. "ActivityManager\;\-\>killBackgroundProcesses" => '中断进程，可用于关闭杀软',
   
4. 'ActivityManagerNative;->killBackgroundProcesses' => '中断进程，可用于关闭杀软',
   
5. 'ActivityManagerNative;->restartPackage' => ' 中断进程，可用于关闭杀软',
   
6. 'ActivityManager;->restartPackage' => ' 中断进程，可用于关闭杀软',
   
7. #"BluetoothAdapter\;\-\>enable" => '开启蓝牙',
   
8. #"BluetoothSocket\;\-\>connect" => '连接蓝牙',
   
9. #"IBluetoothPbap\$Stub\$Proxy\;\-\>connect" => '连接蓝牙',
   
10. "ContentResolver\;\-\>query" => '读取联系人、短信等数据库',
    
11. "ContentService\;\-\>dump" => '转储联系人、短信等信息',
    
12. "PackageManager\;\-\>installPackage" => '安装apk包',
    
13. "Camera\;\-\>open" => '开启相机',
    
14. "MediaRecorder\;\-\>setAudioSource" => '开启录音功能',
    
15. "MediaRecorder\;\-\>setVideoSource" => '开启视频录制',
    
16. "LocationManager\;\-\>getLastKnownLocation" => '获取地址位置',
    
17. "Downloads\$ByUri\;\-\>startDownloadByUri" => '下载文件',
    
18. "Downloads\$DownloadBase\;\-\>startDownloadByUri" => '下载文件',
    
19. "PowerManager\;\-\>reboot" => '重启手机',
    
20. "Settings\$Bookmarks\;\-\>add" => '添加浏览器书签',
    
21. "TelephonyManager\;\-\>getDeviceId" => '搜集用户手机IMEI码、电话号码、系统版本号等信息',
    
22. "TelephonyManager\;\-\>getSimSerialNumber()" => '获取SIM序列号',
    
23. "Telephony\$Mms\;\-\>query" => '读取短信',
    
24. "TelephonyManager\;\-\>getLine1Number" => '获取手机号',
    
25. "SpeechRecognizer\;\-\>startListening" => '开启麦克风',
    
26. "WifiManager\;\-\>setWifiEnabled" => '开启WIFI',
    
27. "SmsManager\;\-\>getAllMessagesFromSim" => '获取sim卡上的短信',
    
28. "SmsManager\;\-\>sendDataMessage" => '发送二进制消息',
    
29. "SmsManager\;\-\>sendMultipartTextMessage" => '发送彩信',
    
30. "SmsManager\;\-\>sendTextMessage" => '发送普通短信',
    
31. #"http/multipart/FilePart;->sendData" => '发送http请求',
    
32. #"http/multipart/Part\;\-\>send" => '发送http请求',
    
33. #"http/multipart/Part\;\-\>sendParts" => '发送http请求',
    
34. #"http/multipart/StringPart\;\-\>sendData" => '发送http请求',
    
35. "internal/telephony/ISms\$Stub\$Proxy\;\-\>sendData" => '发送短信',
    
36. "internal/telephony/ISms\$Stub\$Proxy\;\-\>sendMultipartText" => '发送短信',
    
37. "internal/telephony/ISms\$Stub\$Proxy\;\-\>sendText" => '发送短信',
    
38. "internal/telephony/ITelephony\$Stub\$Proxy\;\-\>call" => '拔打电话',
    
39. "java/lang/Runtime\;\-\>exec" => '执行字符串命令',
    
40. "java/net/HttpURLConnection\;\-\>connect" => '连接URL',
    
41. #"java/net/URL\;\-\>getContent" => '获取网页内容',
    
42. "java/net/URL\;\-\>openConnection" => '连接URL',
    
43. "java/net/URLConnection\;\-\>connect" => '连接URL',
    
44. "DefaultHttpClient\;\-\>execute" => '发送HTTP请求',
    
45. "HttpClient\;\-\>execute" => '请求远程服务器',
    
46. 'android/app/NotificationManager;->notify' => '信息通知栏',
    
47. "SmsReceiver\;\-\>abortBroadcast" => '拦截短信接收',
    
48. "ContentResolver\;\-\>delete" => '删除短信、联系人',
    
49. "chmod " => '更改文件权限',
    
50. "getRuntime" => '获取命令行环境',
    
51. #'content://telephony/carriers' => '获取所有的APN（网络接入点）配置信息',
    
52. 'content://telephony/carriers/preferapn' => '可能用于篡改APN（网络接入点）以调用应用市场
    
53. M-Market扣费接口并验证',
    
54. 'content://sms' => '获取短信数据库',
    
55. 'content://browser/bookmarks' => '获取浏览器书签',
    
56. 'mount -o remount' => '重新挂载档案系统',
    
57. '/system/bin/sh' => '执行shell',
    
58. '/proc/mounts' => '加载文件系统',
    
59. '/system/bin/cp' => '复制文件',
    
60. '/root/su' => '切换用户',
    
61. '/system/bin/rm ' => '删除文件',
    
62. );

复制代码

支持一下