1

I want to know how does android antivirus scan packages private files in "/data/data" directory.

I read somewhere that they check the file name with their database and declare it as malware but how do some antiviruses like "drweb" scan ".dex" files or resource files in another app private files without root access?

screenshot for better understanding :

Improve this question
5
  • Please clarify. Is it /data/data or /data/app? While former isn't accessible to everyone, latter is.
    – domen
    Apr 25, 2019 at 8:51
  • I made a mistake , question edited/
    – omid mirakhorli
    Apr 25, 2019 at 9:03
  • 1
    Question text does not match the screenshot.
    – domen
    Apr 25, 2019 at 9:04
  • antivirus is functioning the same
    – omid mirakhorli
    Apr 25, 2019 at 9:10
  • I'm just skeptical of the premise that antivirus is actually reading files in /data/data/ and would like a proof of that.
    – domen
    Apr 25, 2019 at 9:23

1 Answer 1

Reset to default
3

Android does not allow access to app private data files under /data/data/<package.name>-<hash>, but the list of files and directories in /data/data is public. Also, the APK files in /data/app directory are readable to everyone, don't require special permissions. The AV scans the contents of APK files (which are signed, but not encrypted ZIP files in disguise), and tries to find signs of malware inside these archives.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .