I want to know how does android antivirus scan packages private files in "/data/data" directory.

I read somewhere that they check the file name with their database and declare it as malware but how do some antiviruses like "drweb" scan ".dex" files or resource files in another app private files without root access?

screenshot for better understanding :

  • Please clarify. Is it /data/data or /data/app? While former isn't accessible to everyone, latter is.
    – domen
    Apr 25 '19 at 8:51
  • I made a mistake , question edited/ Apr 25 '19 at 9:03
  • 1
    Question text does not match the screenshot.
    – domen
    Apr 25 '19 at 9:04
  • antivirus is functioning the same Apr 25 '19 at 9:10
  • I'm just skeptical of the premise that antivirus is actually reading files in /data/data/ and would like a proof of that.
    – domen
    Apr 25 '19 at 9:23

Android does not allow access to app private data files under /data/data/<package.name>-<hash>, but the list of files and directories in /data/data is public. Also, the APK files in /data/app directory are readable to everyone, don't require special permissions. The AV scans the contents of APK files (which are signed, but not encrypted ZIP files in disguise), and tries to find signs of malware inside these archives.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.