Let me start this question with the specific use case. I have Cerberus installed for one purpose - in order to disallow pulling down the notification bar when the phone is locked. If my phone is stolen, I don't want the thief to be able to enable airplane mode (I use Xposed APM+ to provide a fake Power Off button on the lock screen). But I'd like to know how Cerberus does this - what file(s) is it changing, what system changes are being made?
So my question is this - is there a tool that will let me do an OS snapshot before and after and let me compare the deltas, or monitor the actions that a particular application is doing so that I can write a simple app to do that one thing? I've used tools on Windows in the past that do this, so I can't imagine it's that difficult - I just don't know where to look. I have root, so root-only tools are ok.