Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Malware Analysis and Exploits 2 > Week 5 - Analysing Android Apps > Flashcards

Week 5 - Analysing Android Apps Flashcards

1
Q

adb - SDK tool

A

Most commonly used to interact with devices and emulators (install new apps, gain a shell on the system, read system logs, forward network ports, or do a multitude of other useful tasks).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Monitor - SDK Tool

A

Useful for viewing processes running on a device and taking screenshots of the device’s screen (useful for pen testers who need to gain evidence of an action for reporting purposes).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

android - SDK Tool

A

Used to manage and create new Android emulators.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

aapt - SDK Tool

A

Converts code into binary form to be packaged with apps.

Also useful for reverse-engineering APKs by converting app binaries to readable text.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Physical Devices vs Emulators

A

Emulators provide root access by default, physical devices do not.

Emulators do not operate correctly for certain apps (eg: USB, headphones, Wi-Fi, Bluetooth, etc) that require physical hardware.

Emulators do not allow making/receiving real phone calls (this can, however, be emulated to a degree using an interface).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Android Apps and the Common User

A

Users may or may not pay attention to permission requirements when installing.

Users experience apps through app UI.

As analysts, we are more interested in what happened behind the scenes when the app installed.

How did this app reach your device?

How did it go from a packaged download to an installed app that can be used securely?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Android OS

A

Consists of a stripped-down and modified Linux kernel, with some differences.

It includes an application virtual machine for running Java-like apps.

Each app is usually assigned its own unique user ID (UID) (10000 to 99999) and group ID (GID).

Special accounts like “system” and “root” exist.

Developers must assign unique package names to their apps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Dalvik VM

A

A Google-customized Java Virtual Machine (JVM) bundled with core libraries.

It was designed to replace the JVM on resource-constrained hardware.

Multiple can run simultaneously.

They run Dalvik bytecode, converted from Java code into Dalvik Executable (DEX) files using the dx SDK utility.

Use Just In Time (JIT) compilation, which dynamically compiles bytecode into machine code during each app run.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Android Runtime (ART)

A

Each Android app runs in its own process with its own instance of ART.

Uses Ahead Of Time (AOT) compilation, translating the entire bytecode into machine code during app installation.

AOT compilation is a one-time event during installation, and it doesn’t require compilation at runtime.

Uses more storage space but offers faster execution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Android Package (APK)

A

Android apps are usually distributed in the form of zipped archives with file extension .apk (Android Package)

APKs contain code, resources, and metadata.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

aapt - APK Packaging Process

A

Converts XML resource files to binary form.

Source code and output from aapt are compiled into .class files by Java compiler.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

aidl - APK Packaging Process

A

Converts .aidl files to .java.

Source code and output from aidl are compiled into .class files by Java compiler.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

dx utility - APK Packaging Process

A

Converts .class files to a single classes.dex file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

apkbuilder tool - APK Packaging Process

A

Combines all resources, both compiled and non-compiled, and the DEX file into an APK.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

jarsigner tool - APK Packaging Process

A

Signs the APK.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

zipalign tool - APK Packaging Process

A

Aligns app resources for optimal loading into memory, reducing RAM usage.

17
Q

/assets - APK Folder Structure

A

Contains files to bundle with the app.

18
Q

/res - APK Folder Structure

A

Contains activity layouts, images, etc., for code access.

19
Q

/lib - APK Folder Structure

A

Contains native libraries bundled with the application, split by CPU architecture.

20
Q

/META-INF - APK Folder Structure

A

Contains the app’s certificate, inventory list of files in the zip archive, and their hashes.

21
Q

classes.dex - APK Folder Structure

A

Executable file containing the app’s Dalvik bytecode.

22
Q

AndroidManifest.xml - APK Folder Structure

A

Contains app configuration information, including security parameters.

23
Q

resources.asrc - APK Folder Structure

A

Contains strings and resources that can be compiled into this file instead of being placed in the res folder.

24
Q

Installing Packages

A

Google Play could have required users to visit a website (through Google Play app) and select their desired app.

GTalkService is invoked when the user clicks “Install.”

GTalkService maintains a connection to Google via a pinned SSL connection.

Users can also install APKs from other stores, including Samsung Apps, Amazon Appstore, GetJar, SlideMe, F-Droid, and others.

Users may install any APK of their choice through an Android SDK tool called Android Debug Bridge (ADB).

25
Q

List connected devices

A

adb devices

26
Q

Get a shell on a device

A

adb shell

27
Q

Perform a shell command and return

A

db shell <command></command>

28
Q

Push a file to a device

A

adb push /path/to/local/file /path/on/android/device

29
Q

Retrieve a file from a device

A

adb pull /path/on/android/device /path/to/local/file

30
Q

Forward a TCP port on the local host to a port on the device

A

adb forward tcp:<local_port> tcp:<device_port></device_port></local_port>

31
Q

View the device logs

A

adb logcat

32
Q

BusyBox

A

A single binary with many useful Linux utilities that do not come as part of the Android image. Includes utilities like ifconfig, ping, traceroute, cp, grep, chmod, echo, mv, nc, netstat, pwd, rm, and many others.

33
Q

Services

A

Allow long-running tasks to run in the background.

Continue to work even when the user has opened another application.

Main purposes: perform long-running operations, supply functionality for other applications.

Each service class must have a corresponding <service> declaration in AndroidManifest.xml.</service>

Correct permissions are required to call these components.

34
Q

Broadcast Receivers

A

Listen for and respond to events that occur in the Android system and other apps.

Events are represented by the Intent class.

Applications can register for system or application events and get notified when they happen.

Example: The SMS app uses Broadcast Receivers.

35
Q

Content Providers

A

Used to store and share data between applications.

Allow access to the internally-stored data of different apps.

Act as interfaces connecting data in one process with code running in another process.

Examples include the Calendar provider, Contacts provider, and Browser bookmarks.

36
Q

Intents

A

Mechanisms for asynchronous Inter-Process Communication (IPC) in Android.

Allow one application to send messages directly to a specific component to control tasks or transport data.

Activate components like activities, broadcast receivers, and services.

Intents contain information necessary for the receiver to take action and are parsed by the OS.

37
Q

AndroidManifest.xml

A

Lists all components usable by an app, except for Broadcast Receivers.

38
Q

Installing an Application

A

Involves tasks performed by the Package Manager Service and installed to ensure the OS recognizes the app.

Steps include determining installation location, handling updates, storing APK, determining UID, creating app data directory, extracting libraries, and more.

39
Q

Running an Application

A

A single app VM starts when Android OS boots.

The zygote process listens for requests to launch new apps.

It forks itself with new app parameters and code when it receives a request.

Malware Analysis and Exploits 2 (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions