I am working on an Android project whose goal is to identify which Java or native functions should be hooked and monitored at runtime to check if the application contains malicious behaviour or weak programming practices.

For example, hooking the connect() allow to access the port information and detect connections that use http (80) instead of https (443), which is definitely a weak programming practice.

I have identified many other potentially malicious behaviours and weak programming practices, and prepared similar hooking structures. I wanted to ask you which functions would you hook to check if the app tries to:

1. access the SD card,

2. detect GPS,

3. access camera or microphone,

4. call premium numbers.

Also, using deprecated methods is potentially dangerous for security reasons. Therefore, I want to check if the app is using any. What I'm thinking is to use a blacklist of all known deprecated methods and then scan the app code to search for methods of that list. Would you agree with this? (consider a scenario in which there is no code obfuscation). Same thing for weak encryption API (e.g. MD5?): how to spot them?