1

I want to know how does android antivirus scan packages private files in "/data/data" directory.

I read somewhere that they check the file name with their database and declare it as malware but how do some antiviruses like "drweb" scan ".dex" files or resource files in another app private files without root access?

screenshot for better understanding :

  • Please clarify. Is it /data/data or /data/app? While former isn't accessible to everyone, latter is. – domen Apr 25 at 8:51
  • I made a mistake , question edited/ – omid mirakhorli Apr 25 at 9:03
  • 1
    Question text does not match the screenshot. – domen Apr 25 at 9:04
  • antivirus is functioning the same – omid mirakhorli Apr 25 at 9:10
  • I'm just skeptical of the premise that antivirus is actually reading files in /data/data/ and would like a proof of that. – domen Apr 25 at 9:23
2

Android does not allow access to app private data files under /data/data/<package.name>-<hash>, but the list of files and directories in /data/data is public. Also, the APK files in /data/app directory are readable to everyone, don't require special permissions. The AV scans the contents of APK files (which are signed, but not encrypted ZIP files in disguise), and tries to find signs of malware inside these archives.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.