idanr1986 / droidmon

Dalvik Monitoring Framework for CuckooDroid
Other
91 stars 49 forks source link

Wrong implementation for Http(s)URLConnection parser. #5

Open melonaerial opened 8 years ago

melonaerial commented 8 years ago

So, lines 154 and 155 of ParseGenerator.java code calls methods getResponse() and getResponseMessage() https://github.com/idanr1986/droidmon/blob/master/src/com/cuckoodroid/droidmon/utils/ParseGenerator.java#L154 https://github.com/idanr1986/droidmon/blob/master/src/com/cuckoodroid/droidmon/utils/ParseGenerator.java#L155 After calling that methods this class object establishes a network connection to the given in constructor url and receives data from it. But this is wrong behavior for logging functionality, because if we will go to the Android Developer's site we will see typical usage of it this class( http://developer.android.com/intl/ru/reference/java/net/HttpURLConnection.html ):

HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection();
   try {
     urlConnection.setDoOutput(true);
     urlConnection.setChunkedStreamingMode(0);

     OutputStream out = new BufferedOutputStream(urlConnection.getOutputStream());
     writeStream(out);

     InputStream in = new BufferedInputStream(urlConnection.getInputStream());
     readStream(in);
    finally {
     urlConnection.disconnect();
   }
 }

So on the same page of documentation you can see that methods setDoOutput() and setChunkedStreamingMode() can cause IllegalAccessError and IllegalStateException respectively, when connection is already established and its called. Also you can check working of such trace functionality with apps using Android Volley library which are used in most of apps right now. And you will see that apps don't received any data from servers with such wrong logging implementation. They just cause IllegalStateException, nothing more. Also I think that API monitor that change program behavior and state of program objects is not good as well. So please delete this lines and if you want to log this methods and think better add special hooks in hooks.json file.