To understand a malware better when it is running on a device, I would like to get a view of what is happening in the background. For instance if a malware is loading a page using LoadUrl, I want to see the value of the URL being loaded. I felt dynamic instrumentation tools or debuggers will be useful for this but I am having a hard time to get it to work. Any tips on what tools/techniques will help me achieve this or should I research more on the said methods above? Kindly suggest.

  • Have you tried Frida? If supports hooking of Java/DEX and native methods. As long as the malware does not use anti-debugging techniques you should be able to attach Frida to it. – Robert Feb 22 '19 at 8:25
  • Its a good option but I want something generic that I can use for multiple malware. As per my understanding with Frida you need to specify specific methods that you want to overload, which means you need to create a tailormade script for every malware. Please let me know if I am wrong here, I would like to try otherwise. – skep Feb 22 '19 at 15:58
  • You are only thinking of the app, however a running app always contains the runtime libraries plus it contains the Dalvik native libraries. Those contain hundred of class and methods that never change (assuming you are using the same or identical device). – Robert Feb 22 '19 at 18:25
  • True, I wanted to focus on the malicious content of a malware. True that a malware can use native libraries but my focus is more towards the malicious components. However getting more information via native libraries is also a good thing. What do you suggest ? – skep Feb 24 '19 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.