Skip to content

Latest commit

 

History

History
52 lines (45 loc) · 2.27 KB

README.md

File metadata and controls

52 lines (45 loc) · 2.27 KB
Raw

analyzecrypt.py

Python application used to monitor function calls (C or Java) on Android via Frida.

Setup

  • Get an own env for your python project (run in the repo folder)
$ virtualenv-2.7 --distribute --no-site-packages venv
$ source venv/bin/activate
(venv) $ pip install pwn frida pycparser

Configuration (C calls)

  • Add needed modules to config/modules.json
  • Add functions which you monitor in functions look at given files as examples
    • Or use get_functions.py with C code you wish to analyse.

Configuration (Java method calls)

  • Add classes to trace to config/java.json.
  • The analyse_java.py script will trace all methods of the given classes: methods are automatically discovered

Documentation

The code is enough, it's just some lines.

Using the code

Run analyze.py to trace C function calls using Frida. Run analyze_java.py to trace Java method calls using Frida. Use eval_results.py to get information about the logged calls

TODO:

  • Integration of C and Java tracer into one tool: trace C and Java calls at the same time
  • C: More monitoring options:
    • read content from addresses not only strings
      • support structs like functions
    • interconnections between functions(lengths etc.)
      • support return value of calls (onLeave e.g.)
  • Monitor memory accesses (blocked by Frida: MemoryAccessMonitor is only available on Windows for now)
    • could be done on function calls if same address is given check for content changes
  • Support multiple platforms (should be really easy - Frida supports it)
  • Get information directly from C/Java code (Use pycparser/a java code analyzer for example)
    • done for C headers, see get_functions.py
      • still needs improvement for more complex headers, like socket.h
  • Analyse the results
    • done for really simple analysis, still needs improvement
      • double warning if multiple usages across calls
      • infomation lacks quality
      • should also work over multiple function
  • Automated module search (No need to set them manually in the config, can already be done but is really slow)
  • Fix string representation in results to show hex code instead of unicode
  • Java: allow to select methods to trace using regex instead of hooking all methods by default