trace all binder-funcion calls on android-platform

Overview

BinderHackDemo

trace all binder-funcion calls on android-platform

该demo展示了如何使用libbinderhack.so模块,trace-app自身进程binder调用情况

您可以通过该次提交,查看如何使用libbinderhack.so

libbinderhack.so用途:

1.可以作为一个逆向工具,分析app行为

2.可以作为一款性能分析工具,查看进程是否有非必要的、频繁跨进程调用binder

3.可以作为一款安全工具,分析本app是否有不合规的api调用(可以参考工信部移动互联网安全)

缺点:

1.目前只支持安卓5.0以上平台(art)

2.由于hook的仅仅是BinderProxy.transactNative函数,所以仅能trace到proxy调用

输出的demo样例:

com.example.myapplication D/WHULZZ: android.content.pm.IPackageManager getInstalledApplications
com.example.myapplication D/WHULZZ: android.view.accessibility.IAccessibilityManager getEnabledAccessibilityServiceList
com.example.myapplication D/WHULZZ: android.app.IActivityTaskManager activityTopResumedStateLost
com.example.myapplication D/WHULZZ: com.android.internal.view.IInputMethodManager removeImeSurfaceFromWindow
com.example.myapplication D/WHULZZ: android.view.IWindowSession relayout
com.example.myapplication D/WHULZZ: com.android.internal.view.IInputMethodManager removeImeSurfaceFromWindow
com.example.myapplication D/WHULZZ: android.app.IActivityTaskManager activityStopped
com.example.myapplication D/WHULZZ: com.android.internal.view.IInputMethodManager removeImeSurfaceFromWindow
com.example.myapplication D/WHULZZ: android.view.accessibility.IAccessibilityManager getEnabledAccessibilityServiceList
com.example.myapplication D/WHULZZ: android.view.IWindowSession relayout
com.example.myapplication D/WHULZZ: com.android.internal.view.IInputMethodManager removeImeSurfaceFromWindow
com.example.myapplication D/WHULZZ: android.app.IActivityTaskManager getActivityOptions
com.example.myapplication D/WHULZZ: miui.security.ISecurityManager activityResume
com.example.myapplication D/WHULZZ: android.app.IActivityTaskManager activityResumed
com.example.myapplication D/WHULZZ: android.view.IWindowSession relayout
com.example.myapplication D/WHULZZ: com.android.internal.view.IInputMethodManager removeImeSurfaceFromWindow
com.example.myapplication D/WHULZZ: android.view.IWindowSession finishDrawing
com.example.myapplication D/WHULZZ: com.android.internal.view.IInputMethodManager removeImeSurfaceFromWindow
com.example.myapplication D/WHULZZ: android.app.IActivityTaskManager activityIdle
com.example.myapplication D/WHULZZ: com.android.internal.view.IInputMethodManager startInputOrWindowGainedFocus
com.example.myapplication D/WHULZZ: com.android.internal.view.IInputMethodManager reportPerceptible
com.example.myapplication D/WHULZZ: com.android.internal.view.IInputMethodManager removeImeSurfaceFromWindow

使用方式

1.必须在您的apk资源目录中提供bm.properties文件,并定义BinderCareEntry

image-bm-properties

该文件中定义了BinderCareEntry="java class name"

便于后文叙述,此java class name简称为ENTRY

BinderHackDemo中将此ENTRY定义为com.example.myapplication.MainActivity

该ENTRY会被libbinderhack.so加载时使用,如未定义,将导致link失败

2.必须在ENTRY class中定义这两个native-jni函数

正确声明这两个native函数:

必须将这两个函数放一起声明

    /**
     * start binder monitor
     */
    private static native void start();

    /**
     * end binder monitor
     */
    private static native void end();

错误声明方式如下:

private static native void start();

public void xx();//不能在start/end函数之间存放其他声明

private static native void end();

3.如果您只关注部分binder调用,可在ENTRY中提供getInterestBinders函数

您可以仿照BinderHackDemo中的样例:

    /**
     * This function is not necessary!
     * If not provided, binderhack will print all the binder calls.
     * This function will be called by native-c code.
     *
     * @return HashMap<String, Set<String>>. see demo below for detail
     */
    @Keep
    private static HashMap getInterestBinders() {
        //关注IActivityManager->activityPaused
        HashMap<String, Set<String>> monitorBinderMap = new HashMap<>();
        HashSet<String> amFuncs = new HashSet<>();
        amFuncs.add("activityPaused");
        monitorBinderMap.put("android.app.IActivityManager", amFuncs);

        //关注IPackageManager->getInstalledApplications
        HashSet<String> pmFuncs = new HashSet<>();
        pmFuncs.add("getInstalledApplications");
        monitorBinderMap.put("android.content.pm.IPackageManager", pmFuncs);
        return monitorBinderMap;
    }

4.如果您要拦截binder调用,您可以在ENTRY中提供transactStart/transactEnd函数

同样可以在样例中找到demo

transactStart

    /**
     *
     * @param interfaceName likely as android.content.pm.IPackageManager
     * @param funcName likely as getInstalledApplications
     * @param data see {@link android.os.IBinder}->transact(...)
     * @param reply see {@link android.os.IBinder}->transact(...)
     * @return TRUE represents you've decided to intercept the origin call.
     */
    @Keep
    private static boolean transactStart(Object interfaceName, Object funcName, Parcel data, Parcel reply) {
        Log.d("WHULZZ", String.format("transactStart %s %s", interfaceName, funcName));
        return false;
    }

transactEnd

    /**
     *
     * @param interfaceName likely as android.content.pm.IPackageManager
     * @param funcName likely as getInstalledApplications
     * @param data see {@link android.os.IBinder}->transact(...)
     * @param reply reply see {@link android.os.IBinder}->transact(...)
     * @param originRet this is the origin result
     * @return I advice you to use {@param originRet}
     */
    @Keep
    private static boolean transactEnd(Object interfaceName, Object funcName, Parcel data, Parcel reply, boolean originRet) {
        Log.d("WHULZZ", String.format("transactEnd %s %s", interfaceName, funcName));
        return originRet;
    }

libbinderhack.so模块后续也会开源,请耐心等候

欢迎脑暴...

contact with [email protected]

You might also like...

tuya-spring-boot-starter helps you efficiently create cloud development projects regarding the OpenAPI or message subscription capabilities. You can put all the focus on business logic without taking care of server-side programming nor relational databases.

English | 中文版 tuya-spring-boot-starter helps you efficiently create cloud development projects regarding the OpenAPI or message subscription capabilit

Dec 26, 2022

📊It includes all the work done during the Java-React Bootcamp.

📊It includes all the work done during the Java-React Bootcamp.

💻 Java + React Bootcamp 💻 Part 1 - Java Part 2 - React 💻 Lecture Class: Youtube 👤 Instructor: Engin Demirog 📚 Course Materials: Kodlama.io Bootca

Jun 21, 2022

All development related with the ONLYONE token.

onlyone All development related with the Onlyone Finance. ONLYONE Token Total Supply: 1 Contract creation: https://bscscan.com/tx/0x1becbd78297f267dec

Jan 1, 2023

Jornada Big Tech: I will have 3 months to study and prepare myself for the Big Tech interviews. Repository containing all my study material.

Jornada Big Tech: I will have 3 months to study and prepare myself for the Big Tech interviews. Repository containing all my study material.

Jornada Big Tech (Big Tech Journey) Jornada Big Tech: I will have 3 months to study and prepare myself for the Big Tech interviews. Repository contain

Dec 8, 2022

All I know about Spring as a Spring Boot app

All about Spring This repository contains all the knowledge I have and all the things I can do with Spring You can download v1.0.0 java-doc here In th

Jul 16, 2022

Mint 0.1.1 public release, HWID System removed. Feel free to use. (Note: for all of u thinking its ratted; its not.)

Mint By: zPrestige_ | ! zPrestige_#1514 | git Kambing | dragonhacker32_#3091 | git FB | FB#7334 | git ZenovJB | Zenov#0603 | git Support no support No

Dec 2, 2022

APIKit:Discovery, Scan and Audit APIs Toolkit All In One.

APIKit:Discovery, Scan and Audit APIs Toolkit All In One.

APIKit:Discovery, Scan and Audit APIs Toolkit All In One.

Jan 9, 2023

The all-in-one cosmetics solution created by HibiscusMC Staff, for HibiscusMC.

HMCCosmetics Table of Contents Description Installation Download Description HMCCosmetics is a free, open source cosmetics plugin which allows you to

Dec 12, 2022

A Velocity proxy plugin for Minecraft server discovery in k8s. All discovered servers are automatically added to the Velocity proxy.

kryo-server-discovery This plugin connects minecraft servers to a velocity proxy within Kubernetes. The service account in the namespace which the pro

Sep 13, 2022
Owner
null
The project is an example of using the http web client to promote synchronous and asynchronous https calls.

Web Client Consumer Java Sample The project is an example of using the http web client to promote synchronous and asynchronous https calls. Requiremen

null 2 Jan 12, 2022
LaetLang is an interpreted C style language. It has file reading/writting, TCP network calls and awaitable promises.

LaetLang ?? LaetLang is an interpreted C style language built by following along Robert Nystrom's book Crafting Interpreters. This is a toy language t

Alexander Shevchenko 6 Mar 14, 2022
Android Auto Apps Downloader (AAAD) is an app for Android Phones that downloads popular Android Auto 3rd party apps and installs them in the correct way to have them in Android Auto.

Android Auto Apps Downloader (AAAD) is an app for Android Phones that downloads popular Android Auto 3rd party apps and installs them in the correct way to have them in Android Auto.

Gabriele Rizzo 865 Jan 2, 2023
This repo contains all the materials for placement as well as Practical lab codes for all subjects and notes. For students graduating in 2023

UEMK_PLACEMENT_2023 This repo contains all the materials for placement as well as Practical lab codes for all subjects and notes. For students graduat

Shambashib Majumdar 8 Mar 5, 2022
All the Android-Java Projects in Single Repository

Android Java Projects List of Projects Factorial Calculator Multiplication Table Web App Steps to Run the Applications Clone this Repository Create a

Rajan Gautam 2 Oct 10, 2022
This sample shows how to implement two-way text chat over Bluetooth between two Android devices, using all the fundamental Bluetooth API capabilities.

Zenitsu-Bluetooth Chat Application This sample shows how to implement two-way text chat over Bluetooth between two Android devices, using all the fund

Gururaj Koni 1 Jan 16, 2022
Business Application Platform - no-code/low-code platform to build business applications

Orienteer What is Orienteer Orienteer is Business Application Platform: Easy creation of business applications Extendable to fit your needs Dynamic da

Orienteer 189 Dec 6, 2022
This app brings Privacy dashboard features from Android 12 to older android devices.

PrivacyDashboard This app brings Privacy dashboard features from Android 12 to older android devices. Have you ever thought which apps are accessing y

Rushikesh Kamewar 234 Jan 7, 2023
Share food-Android- - Food donation coded in native android with firebase, google maps api and php server xampp

share_food-Android- Instructions: 1. Create a firebase account and link it with the project via google-services.json. 2. This project also uses a XAMP

Abubakar 3 Dec 28, 2021
Simple Android app during a coding night. Just Learning Firebase and Android

KUI-App Simple Android app during a coding night. Just Learning Firebase and Android What we learned: Some basics of Android Basic setup of Firebase:

Kibabii University Informatics Club (KUI) 7 Aug 28, 2022