ZSShen / Probedroid
Licence: mit
A SDK for the creation of analysis tools without obtaining app source code in order to profile runtime performance, examine code coverage, and track high-risk behaviors of a given app on Android 5.0 and above.
Stars: ✭ 182
Projects that are alternatives of or similar to Probedroid
Sojobo
A binary analysis framework
Stars: ✭ 116 (-36.26%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Malwarelab vm Setup
Setup scripts for my Malware Analysis VMs
Stars: ✭ 126 (-30.77%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Drsemu
DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior
Stars: ✭ 237 (+30.22%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Malwaresearch
A command line tool to find malwares on http://openmalware.org
Stars: ✭ 190 (+4.4%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Pev
The PE file analysis toolkit
Stars: ✭ 422 (+131.87%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Xapkdetector
APK/DEX detector for Windows, Linux and MacOS.
Stars: ✭ 208 (+14.29%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Polichombr
Collaborative malware analysis framework
Stars: ✭ 307 (+68.68%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Freki
🐺 Malware analysis platform
Stars: ✭ 285 (+56.59%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Dex Oracle
A pattern based Dalvik deobfuscator which uses limited execution to improve semantic analysis
Stars: ✭ 398 (+118.68%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Drakvuf Sandbox
DRAKVUF Sandbox - automated hypervisor-level malware analysis system
Stars: ✭ 384 (+110.99%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Apkfile
Android app analysis and feature extraction library
Stars: ✭ 190 (+4.4%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Nauz File Detector
Linker/Compiler/Tool detector for Windows, Linux and MacOS.
Stars: ✭ 146 (-19.78%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Detect It Easy
Program for determining types of files for Windows, Linux and MacOS.
Stars: ✭ 2,982 (+1538.46%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Antidebugging
A collection of c++ programs that demonstrate common ways to detect the presence of an attached debugger.
Stars: ✭ 161 (-11.54%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Simplify
Android virtual machine and deobfuscator
Stars: ✭ 3,865 (+2023.63%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Malware Analysis Scripts
Collection of scripts for different malware analysis tasks
Stars: ✭ 61 (-66.48%)
Mutual labels: malware-analysis, malware-research, reverse-engineering
Pafish
Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do
Stars: ✭ 2,026 (+1013.19%)
Mutual labels: reverse-engineering, malware-analysis, malware-research
Fileintel
A modular Python application to pull intelligence about malicious files
Stars: ✭ 97 (-46.7%)
Mutual labels: malware-analysis, malware-research
Fundamentos Engenharia Reversa
Livro: Fundamentos de Engenharia Reversa
Stars: ✭ 93 (-48.9%)
Mutual labels: malware-analysis, reverse-engineering
Awesome Yara
A curated list of awesome YARA rules, tools, and people.
Stars: ✭ 1,394 (+665.93%)
Mutual labels: malware-analysis, malware-research
ProbeDroid
ProbeDroid is a dynamic Java code instrumentation kit for Android application, which provides APIs for users to craft their own instrumentation tools. As a result, users can trace, profile, or change the runtime behavior of an interested application. Essentially, Java method is the basic instrumentation unit. To manipulate the interested methods, users should override the template instrumentation gadgets and register them to hook the interested methods. When the hooked methods are invoked during the runtime, the control flow is diverted to the gadgets. At that moment, users can manipulate the boxed method input arguments and the return value. In the current stage, ProbeDroid targets on Android 5.0 and above. To build ProbeDroid kit, users just pull the package from GitHub and follow the build commands. Android source tree is not required.
Feature
- Programmable instrumentation
- Code your own instrument tools with Java practice
- Flexible APIs for you to
- Hook interested library or app defined methods
- Customize instrument gadgets for different analysis purposes
- Modify method in/output to hack app during the runtime
- Succinct deployment
- Only ProbeDroid engine and instrument tools are required
- No need to customize Android framework
Design Memo
Limitation
- Cannot instrument native methods now (under development)
- Currently only supporting Android 5.0 and the devices based on Intel x86 and ARM eabi v7a
ProbeDroid is still under construction. More features will be presented in the near feature.
Installation
Please refer to Source Building Wiki
Usage
Please refer to Play and Hack Wiki
Demo
Instrument GoogleMaps
Click the picture to view the demo vedio
 |
|---|
| A simple instrumentation tool which tracks the strings converted from StringBuilder and StringBuffer object. By taking some forensics towards the converted strings, we can notice that GoogleMaps applies Java reflection for some network authentication. Also, It will dynamically generate some C/C++ code and compile it for map rendering. |
Instrument KKTix
Click the picture to view the demo vedio
 |
|---|
| A simple instrumentation tool which tracks the started Activities and Services. By taking some forensics towards the tracked components, we can notice that KKTix applies several kinds of Activies to render the ticket booking pages. Also, it starts a Service for background computation. |
License
Except for the following source code:
-
android/art/runtime/,common/log.*,common/stringprintf.*,common/utf.*, andcommon/macros.hsubtrees belong to [AOSP], which are licensed under Apache v2.0. -
common/libffi/subtree belongs to [libffi], which is licensed under MIT.
All the source code are licensed under MIT. See COPYING for details.
Contact
Please contact me via the mail [email protected].
Note that the kit is still under construction. Contribution and bug report is desired.
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].