5

I want to collect all the API calls made by an Android app that runs on a real device (with root permissions, obvs).

With API call I mean the methods invoked on objects like: ConnectivityManager

I thought that I can instrument all methods with the Xposed framework but maybe exists a simpler way... a kind of "high-level strace".

Otherwise it's sufficient to monitor the stacktrace...

What do you suggest?

Improve this question
4
  • 1
    You mean something similar to what running a process through strace gives you on an ordinary Linux system with a reasonably complete terminal userspace?
    – user
    Feb 10, 2017 at 22:42
  • It would be perfect... but I don't know how you can do it with the Android vm
    – Simone Aonzo
    Feb 11, 2017 at 18:16
  • I would expect not (and I'm not really familiar with this kind of development to start with), but it might give people a frame of reference for what you are looking for.
    – user
    Feb 11, 2017 at 19:42
  • If you are into programming, I suggest JPDA, and there MethodEntryRequest to write a small debugger.
    – WSS
    Jan 30, 2018 at 17:38

2 Answers 2

Reset to default
4

You can see Binder methods and other strace functionality with -- http://newandroidbook.com/tools/jtrace.html

However, I think you are looking to intercept API calls with the -- https://github.com/AndroidHooker/hooker -- techniques. There are other hooking techniques such as with IntroSpy -- https://www.sensepost.com/blog/2016/android-hooking-with-introspy -- but they don't look as applicable to your situation.

You could run into situations where anti-hooking techniques are present -- http://d3adend.org/blog/?p=589, so I suggest having a way to replace that code and repackage the APK -- https://github.com/oguzhantopgul/AppManipulator

The book, Hacking Android, covers using both IntroSpy and the XposedFramework for hooking. I think you'll like the output log from the XposedBridgeAPI -- http://blog.attify.com/2015/01/04/xposed-framework-android-hooking/ -- and you can find its development documentation here -- https://github.com/rovo89/XposedBridge/wiki/Development-tutorial

Moreover, the book covers what is more-common practice for Android app reversers and penetration testers, which is use of the Frida tools. In particular, I think the appmon -- http://dpnishant.github.io/appmon/ -- extension is the most-relevant (supporting both root and non-root privileged access), but you also might take a look at the extended version of cycript from NowSecure -- https://www.nowsecure.com/blog/2016/09/02/cycript-on-steroids-pumping-up-portability-and-performance-with-frida/

Improve this answer
5
-1

The best way to achieve global Java call collection is to instrument the ART/DVM of the Androis OS. Here you can find a minimal patching procedure to apply to the AOSP (5.0 Lollipop, working on 6.0 Marshmallow as well) to collect all Java calls of a targeted application : https://stackoverflow.com/questions/33478647/android-app-java-jni-call-hooking-strategies

You could then differentiate API calls from application calls with some regex.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .