search

idanr1986 / cuckoo-droid

CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox.
580 stars 134 forks source link

Is there any CuckooAgent.apk and Analyzer.jar source code? #85

Closed Felixho19 closed 3 years ago

Felixho19 commented 5 years ago

Hello @idanr1986:

Currently, I am trying to implement Frida in cuckoodroid. In my observation, Frida can perform early instrumentation using Java.performNow() instead of Java.perform() in the hook javascript. This shows some possible implementation similar to the function of EmulatorAntiDetect.apk, with higher flexibility.

However, in order to inject the js code safely, I need to do something like this. So the app cannot be launched directly by server.execute() in guest.py. I wonder if I need to do some minor changes in these 2 Java codes. So it would be nice to have the source code to have a look.

Thank you so much.

P.S.: Testing with Frida 12.2.27, with Android x86 5.1-rc1.

wickywaka commented 5 years ago

Did you try reversing them? That would the quickest way to get some source code.

I worked with integrating cuckoo and frida, basically replacing xposed with frida. Sadly, I don't have the source code. How are you trying to use frida?

Waqar

Felixho19 commented 5 years ago

Ya, I forgot the jadx decompiler. Thanks.

For the original idea, I only planned to replace EmulatorAntiDetect with Frida and try to integrate some further improvement (i.e. allow manual setting / dynamic js generator). Anyway, I have to try them out first.

wickywaka commented 5 years ago

I did reversed it little bit. Have a look at my internship report on my profile here on github. There are lots of other techniques and an example app that can be used to check emulator anti detect.