honeynet / droidbot Goto Github PK

View Code? Open in Web Editor NEW

749.0 749.0 225.0 87.44 MB

A lightweight test input generator for Android. Similar to Monkey, but with more intelligence and cool features!

License: MIT License

Python 59.56% HTML 0.42% CSS 0.06% JavaScript 39.93% Shell 0.03%

droidbot's People

Contributors

Stargazers

Watchers

Forkers

adepasquale 007durgesh219 futurelighthouse openwarrior thakurakhil hugo-glez melbshark shugaoye tenyee chubbymaggie mingwayzhang nastya sanchitgupta001 yzygitzh lczgywzyy impillar akshayaggarwal99 scandindian samsruti karsai1993 alisakhatipova mellan hao-fu shahrear rainyang0925 naseemakhtar994 matrixy cclauss nathanxuns matrixxun gridl miniminyi mainam msoftware rain0193 jiubadao moonzhh alangeh ivanovskywang soupwaylee allexeye s20101192 ravindra1307 erick2206 nihalpandya ysheldon anant-joshi natanieljr saumopal97 hongpingwei bigboyconcepts ddlucad96 muhzii suadmoh primekun testimx62 ikvillanes chaxiu ebarsallo jsmith716 andyvaikunth yszhao jinxking crackercat ubuntuevangelist secice sqs-jliu maqsoodahmadjan khuangyl xiaobeiying gothicfox toshal-a midoxnet jye924 sayoojbala ricardouw zhizhongpan tingsu roy-tang-hs luozf12345 ningmenglll archer29m genie-park xceptioncode jianjian12138 ttinnguyen perry-contribs test-wsl bellalzohir zhiyufan nantonzane lingling-fan jackliaoall imcowboysibs c05mic nshuba arber1 anjinwoong carol233 ohyeah521

droidbot's Issues

UtgDfsPolicy:exception during sending events: 'NoneType' object is not iterable

Here is my command:
droidbot -a /home/dongfeng/downloads/droidbot_20170807/test1.apk -o /home/dongfeng/downloads/droidbot_20170807/out/ -use_method_profiling full

The following is error log:

[CONNECTION] ProcessMonitor is enabled and connected.
[CONNECTION] ADB is enabled and connected.
[CONNECTION] UserInputMonitor is enabled and connected.
[CONNECTION] ViewClient is not enabled.
[CONNECTION] Logcat is enabled and connected.
[CONNECTION] DroidBotIme is enabled and connected.
[CONNECTION] Minicap is enabled and connected.
[CONNECTION] TelnetConsole is not enabled.
[CONNECTION] DroidBotAppConn is enabled and connected.
Please wait while installing the app...
5428 KB/s (4481015 bytes in 0.806s)
INFO:Device:App installed: com.db.bfzx.zhebian2
INFO:Device:Main activity: com.hijoygames.runningbox.AppActivity
INFO:AppEnvManager:Start deploying environment, policy is none
INFO:InputEventManager:start sending events, policy is dfs
Input: KeyEvent(state=482403af4a87e9dabdd8ac26fd83bc7f, name=HOME)
Input: IntentEvent(intent='am start --start-profiler /data/local/tmp/event.trace com.db.bfzx.zhebian2/com.hijoygames.runningbox.AppActivity')
WARNING:DroidBotAppConn:Unhandled message from droidbot app: rotation
5207 KB/s (8825380 bytes in 1.655s)
INFO:UtgDfsPolicy:Trying a unexplored event.
Input: TouchEvent(view=be820c9a9d8d927032db9f67f3278456)
3254 KB/s (700131 bytes in 0.210s)
INFO:UtgDfsPolicy:Trying a unexplored event.
Input: LongTouchEvent(view=be820c9a9d8d927032db9f67f3278456, duration=2000)
3649 KB/s (1040544 bytes in 0.278s)
INFO:UtgDfsPolicy:Trying a unexplored event.
Input: TouchEvent(view=0034c035217690a422c46d2e3ba9502f)
1663 KB/s (195045 bytes in 0.114s)
INFO:UtgDfsPolicy:Trying a unexplored event.
Input: KeyEvent(state=264582e2eeb3e48261e6dc352a7778d7, name=BACK)
1129 KB/s (113694 bytes in 0.098s)
INFO:UtgDfsPolicy:Cannot find an exploration target. Trying to restart app...
Input: IntentEvent(intent='am force-stop com.db.bfzx.zhebian2')
WARNING:DroidBotAppConn:Unhandled message from droidbot app: rotation
WARNING:UtgDfsPolicy:exception during sending events: 'NoneType' object is not iterable
Traceback (most recent call last):
  File "/home/dongfeng/downloads/droidbot_20170807/droidbot/droidbot/input_policy.py", line 52, in start
    event = self.generate_event()
  File "/home/dongfeng/downloads/droidbot_20170807/droidbot/droidbot/input_policy.py", line 117, in generate_event
    self.__update_utg()
  File "/home/dongfeng/downloads/droidbot_20170807/droidbot/droidbot/input_policy.py", line 146, in __update_utg
    self.utg.add_transition(self.last_event, self.last_state, self.current_state)
  File "/home/dongfeng/downloads/droidbot_20170807/droidbot/droidbot/utg.py", line 59, in add_transition
    self.__output_utg()
  File "/home/dongfeng/downloads/droidbot_20170807/droidbot/droidbot/utg.py", line 127, in __output_utg
    view_images = ["views/view_" + view['view_str'] + ".png" for view in event.get_views()]
**TypeError: 'NoneType' object is not iterable**
WARNING:UtgDfsPolicy:exception during sending events: 'NoneType' object is not iterable
Traceback (most recent call last):
  File "/home/dongfeng/downloads/droidbot_20170807/droidbot/droidbot/input_policy.py", line 52, in start
    event = self.generate_event()
  File "/home/dongfeng/downloads/droidbot_20170807/droidbot/droidbot/input_policy.py", line 117, in generate_event
    self.__update_utg()
  File "/home/dongfeng/downloads/droidbot_20170807/droidbot/droidbot/input_policy.py", line 146, in __update_utg
    self.utg.add_transition(self.last_event, self.last_state, self.current_state)
  File "/home/dongfeng/downloads/droidbot_20170807/droidbot/droidbot/utg.py", line 59, in add_transition
    self.__output_utg()
  File "/home/dongfeng/downloads/droidbot_20170807/droidbot/droidbot/utg.py", line 127, in __output_utg
    view_images = ["views/view_" + view['view_str'] + ".png" for view in event.get_views()]
TypeError: 'NoneType' object is not iterable

Facing error while running with Droidbox

While install the apk with
droidbot -a /home/anuj/Desktop/hawkular-android-client/build/outputs/apk/hawkular-android-client-debug.apk -event dynamic -duration 100 -o droidbot_out

It says

INFO:Device:waiting for device

daemon not running. starting it now on port 5037 *
daemon started successfully *
Connecting to a device with serialno=.* with a timeout of 60 secs...
Connected to device with serialno=.*
/usr/local/lib/python2.7/dist-packages/com/dtmilano/android/viewclient.py:2601: UserWarning: Running on emulator but no serial number was specified then 'emulator-5554' is used
warnings.warn("Running on emulator but no serial number was specified then 'emulator-5554' is used")
Actual device serialno=emulator-5554
adb server is out of date. killing...
daemon started successfully *
Traceback (most recent call last):
File "/usr/local/bin/droidbot", line 9, in
load_entry_point('droidbot==1.0.0a2', 'console_scripts', 'droidbot')()
File "/home/anuj/droidbot/droidbot/start.py", line 76, in main
quiet=opts.quiet)
File "/home/anuj/droidbot/droidbot/droidbot.py", line 46, in init
self.device = Device(device_serial, output_dir=self.output_dir)
File "/home/anuj/droidbot/droidbot/types.py", line 58, in init
self.get_display_info()
File "/home/anuj/droidbot/droidbot/types.py", line 235, in get_display_info
self.display_info = self.get_adb().getDisplayInfo()
File "/usr/loc
al/lib/python2.7/dist-packages/com/dtmilano/android/adb/adbclient.py", line 414, in getDisplayInfo
displayInfo = self.getLogicalDisplayInfo()
File "/usr/local/lib/python2.7/dist-packages/com/dtmilano/android/adb/adbclient.py", line 431, in getLogicalDisplayInfo
for line in self.shell('dumpsys display').splitlines():
File "/usr/local/lib/python2.7/dist-packages/com/dtmilano/android/adb/adbclient.py", line 376, in shell
self.__send('shell:%s' % cmd, checkok=True, reconnect=False)
File "/usr/local/lib/python2.7/dist-packages/com/dtmilano/android/adb/adbclient.py", line 242, in __send
self.__checkOk()
File "/usr/local/lib/python2.7/dist-packages/com/dtmilano/android/adb/adbclient.py", line 285, in __checkOk
raise RuntimeError("ERROR: %s %s" % (repr(recv), error))

RuntimeError: ERROR: ''

errors in test cases

I found few issues with the unittest cases for the droidbot, please correct me if i'm wrong.
issue#1.
In test_types.py (in tests folder) , in the function test_is_foreground ,
in line 42 -> "settings_app = App(package_name="com.android.settings")"
the class App has no keyword as "package_name" in the argument instead there is "path_name" , so if we had to use the path for the settings app then we have to be previliged but phone would not be rooted for this to happen.
in line 43 -> no_app = App()
the class app requires atleast one parameter (i.e. path_name), even if we send None as parameter in the class app we are asserting it to not be None.

issue#2.
In test_droid.py (in tests folder), in the function setUp ,
in line 8 -> "self.droidbot = DroidBot(device_serial="emulator-5554", event_duration=10)" , the Droidbot class in meant to be initialized with an app. below is the init func of Droidbot class. Here the app_path must have to be sent inorder for initialization but it's not sent as argument. Even if we initialize it with None we will be getting error in Line 47 of droidbot.py file.

def init(self, app_path, device_serial=None, output_dir=None,
env_policy=None, event_policy=None, with_droidbox=False,
event_count=None, event_interval=None, event_duration=None, quiet=False):

issue#3.
In test_types.py (in tests folder), in the function test_settings,
in line 97(similar is the case with line 99) -> "self.assertEqual(self.device.get_settings()['system']['volume_system'], '10')" , the get_settings() function for device from types.py would get the data from the db "/data/data/com.android.providers.settings/databases/settings.db" , where as for an newly created emulator this db would be empty and hence would get "no table with name system" error. as a work around for emulator devices we could use the backup db which lies in "/data/data/com.android.providers.settings/databases/settings.db-backup"

Add dummy documents

In order to see behavior of android-crypto-lockers like (simplelocker - bd827e42a9a8e13e2d138ccdfef0d7fa4ab3e67a1dbc39bea8b53d1fb085154f) droitBot should add some dummy pictures, pdfs, docs, ... in the emulator-image before installing the malware.

fix "end of line" bugs

Windows and Unix have different end of line characters (\r\n in Window and \n in Unix).
I saw some methods didn't consider such difference. For example, in view_client.py we had:

def validServerResponse(self, response):
        """
        Checks the response received from the I{ViewServer}.

        @return: C{True} if the response received matches L{PARCEL_TRUE}, C{False} otherwise
        """
        PARCEL_TRUE = "Result: Parcel(00000000 00000001   '........')\r\n"
        ''' The TRUE response parcel '''
        return response == PARCEL_TRUE

It should be something like this:

def validServerResponse(self, response):
        """
        Checks the response received from the I{ViewServer}.

        @return: C{True} if the response received matches L{PARCEL_TRUE}, C{False} otherwise
        """
        PARCEL_TRUE = "Result: Parcel(00000000 00000001   '........')"
        ''' The TRUE response parcel '''
        return response.strip() == PARCEL_TRUE

I think there are more such errors. I'll try to fix them soon.

Port to python 3

Warns 'lxml.etree._Element' object has no attribute 'getElementsByTagName'

WARNING:DroidBot:Something went wrong: 'lxml.etree._Element' object has no attribute 'getElementsByTagName'
Traceback (most recent call last):
File "build/bdist.linux-x86_64/egg/droidbot/droidbot.py", line 87, in init
self.app = App(app_path, output_dir=self.output_dir)
File "build/bdist.linux-x86_64/egg/droidbot/app.py", line 35, in init
self.get_activities()
File "build/bdist.linux-x86_64/egg/droidbot/app.py", line 77, in get_activities
for activity_dom in manifest.getElementsByTagName("activity"):
AttributeError: 'lxml.etree._Element' object has no attribute 'getElementsByTagName'
WARNING:DroidBotIme:Failed to disconnect DroidBotIME!

droidbot.adapter.adb.ADBException

Hello,ylimit
I have install droidbot in my windows PC and all prerequisite are installed.

connect nexus 5 to my PC via adb as follow:

E:\PaperWorkplace\droidbot>adb devices
List of devices attached
03075e3f08d4cc52        device

Then I run the droidbot and got problem as follow:
`E:\PaperWorkplace\droidbot>droidbot -d 03075e3f08d4cc52 -a dae5b93d99fe9d6d80d647a8a6dbbaf1.apk -env none -event utg_dynamic

INFO:Device:waiting for device
Traceback (most recent call last):
File "D:\Program Files\Python2.7\Scripts\droidbot-script.py", line 9, in
load_entry_point('droidbot', 'console_scripts', 'droidbot')()
File "e:\paperworkplace\droidbot\droidbot\droidbot\start.py", line 76, in main
quiet=opts.quiet)
File "e:\paperworkplace\droidbot\droidbot\droidbot\droidbot.py", line 49, in init
self.device = Device(device_serial, output_dir=self.output_dir)
File "e:\paperworkplace\droidbot\droidbot\droidbot\device.py", line 60, in init
self.connect()
File "e:\paperworkplace\droidbot\droidbot\droidbot\device.py", line 148, in connect
self.get_adb()
File "e:\paperworkplace\droidbot\droidbot\droidbot\device.py", line 198, in get_adb
self.adb = ADB(self)
File "e:\paperworkplace\droidbot\droidbot\droidbot\adapter\adb.py", line 54, in init
raise ADBException()
droidbot.adapter.adb.ADBException`

I cannot find the answer.

Availability of the DroidBot app source code

Hello,

Is the DroidBot app source code available to the public? I can only find the compiled APK in this repository.

Thanks!

Is it possible to record performed input event sequence ?

Is it possible with Droidbot to record sequence of interactions performed with the app, so that we can perform similar interaction some time later ? This can be helpful to make UI testcases for app.

Error when use the -o option and it was not installed with developer option

Hello,

When droidbot is installed without the developer option and tries to use the -o action gives the following error:

Traceback (most recent call last):
  File "/usr/bin/droidbot", line 11, in <module>
    load_entry_point('droidbot==1.0.2b3', 'console_scripts', 'droidbot')()
  File "build/bdist.linux-x86_64/egg/droidbot/start.py", line 110, in main
  File "build/bdist.linux-x86_64/egg/droidbot/droidbot.py", line 56, in __init__
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 1226, in resource_filename
    self, resource_name
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 1730, in get_resource_filename
    return self._extract_resource(manager, zip_path)
  File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 1751, in _extract_resource
    timestamp, size = self._get_date_and_size(self.zipinfo[zip_path])
KeyError: 'droidbot/resources/index.html'

That's because the resource directory isn't included in the installation of droidbot. This can be solved using the data_package variable. Adding this code to setup.py should work:

import os

def package_files(directory):
    paths = []
    for (path, directories, filenames) in os.walk(directory):
        for filename in filenames:
            paths.append(os.path.join("..", path, filename))
    return paths


extra_files = package_files("droidbot/resources/minicap") # neccesary for captures"
style_files = package_files("droidbot/resources/stylesheets")
extra_files.append("../droidbot/resources/index.html")
extra_files += style_files
setup(
                       ...
    package_data={'droidbot': extra_files},
                       ...
)

To reproduce, just install droidbot without the -e option in pip or just use:
python2 setup.py install

Cheers,
Joaquin

Error 3: Crashes if started with no option.

Error 3.1 with no options

All options are defined as optional, but it crashes if you start droidbot without any option:

TypeError: coercing to Unicode: need string or buffer, NoneType found

Are there any must have options? Perhaps you can declare them, or give a proper error message.

Can you reproduce this? Or did you need any further information?

Envirement:

Ubuntu 14.04 LTS, 64 bit
GIT: 36978bc
Sample: http://www.h-lemoine.de/ctf.hack.lu_2011/0xA1EA512A.apk - NoMalware

Output

hanno@dockerDroidBox:~/work/PycharmProjects/gsoc_droidbot$ python start.py
Connecting to a device with serialno=.* with a timeout of 60 secs...
Connected to device with serialno=.*
/home/hanno/work/PycharmProjects/gsoc_droidbot/com/dtmilano/android/viewclient.py:2485: UserWarning: Running on emulator but no serial number was specified then 'emulator-5554' is used
  warnings.warn("Running on emulator but no serial number was specified then 'emulator-5554' is used")
Actual device serialno=emulator-5554
INFO:TelnetConsole:telnet successfully initiated, the addr is (localhost:5554)
WARNING:App:no app given, will operate on whole device
INFO:AppEnvManager:start deploying environment, policy is none
INFO:AppEnvManager:finish deploying environment, policy is none
INFO:AppEventManager:start sending events, policy is monkey
Traceback (most recent call last):
  File "start.py", line 59, in <module>
    main()
  File "start.py", line 54, in main
    droidbot.start()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/droidbot.py", line 57, in start
    event_manager.start()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 596, in start
    self.event_factory.start(self)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 622, in start
    event = self.generate_event()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 662, in generate_event
    event = event_type.get_random_instance(self.device, self.app)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 207, in get_random_instance
    if not device.is_foreground(app):
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/types.py", line 172, in is_foreground
    package = app.get_package_name()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/types.py", line 453, in get_package_name
    elif self.get_androguard_analysis() is not None:
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/types.py", line 429, in get_androguard_analysis
    self.androguard = AndroguardAnalysis(self.app_path)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/types.py", line 524, in __init__
    self.a, self.d, self.dx = AnalyzeAPK(app_path)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/androguard/androlyze.py", line 114, in AnalyzeAPK
    a = APK(filename, raw)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/androguard/core/bytecodes/apk.py", line 170, in __init__
    fd = open(filename, "rb")
TypeError: coercing to Unicode: need string or buffer, NoneType found

Question about Android 6.0 Support

Hi,

I am glad to see this project is still active. Could you let me know if the project supports marshmallow or not? Thanks a lot!

WARNING:Device:push_file file does not exist

I followed steps to setup droidbot but when testing any app i get this error:

WARNING:Device:push_file file does not exist: /home/nimish/droidbot/droidbot/resources/minicap/jni/libs/android-27/arm64-v8a/minicap.so
cannot stat '/home/nimish/droidbot/droidbot/resources/minicap/jni/libs/android-27/arm64-v8a/minicap.so': No such file or directory
Traceback (most recent call last):
File "/home/nimish/droidbot/droidbot/droidbot.py", line 139, in start
self.device.set_up()
File "/home/nimish/droidbot/droidbot/device.py", line 143, in set_up
adapter.set_up()
File "/home/nimish/droidbot/droidbot/adapter/minicap.py", line 82, in set_up
remote_dir=self.remote_minicap_path)
File "/home/nimish/droidbot/droidbot/device.py", line 756, in push_file
self.adb.run_cmd(["push", local_file, remote_dir])
File "/home/nimish/droidbot/droidbot/adapter/adb.py", line 64, in run_cmd
r = subprocess.check_output(args).strip()
File "/home/nimish/anaconda3/lib/python3.6/subprocess.py", line 336, in check_output
**kwargs).stdout
File "/home/nimish/anaconda3/lib/python3.6/subprocess.py", line 418, in run
output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['adb', '-s', '47012d02', 'push', '/home/nimish/droidbot/droidbot/resources/minicap/jni/libs/android-27/arm64-v8a/minicap.so', '/data/local/tmp/minicap-devel']' returned non-zero exit status 1.
[CONNECTION] ADB is disconnected
WARNING:DroidBotIme:Failed to disconnect DroidBotIME!
Please wait while uninstalling the app...

AttributeError: 'NoneType' object has no attribute 'getElementsByTagName'

I am still facing the same issue. I had done all. You can refer below and please recommand what to do next to resolve issue;

WARNING:DroidBot:Something went wrong: 'NoneType' object has no attribute 'getElementsByTagName'
Traceback (most recent call last):
File "/home/amity/Downloads/droidbot/droidbot/droidbot.py", line 87, in init
self.app = App(app_path, output_dir=self.output_dir)
File "/home/amity/Downloads/droidbot/droidbot/app.py", line 35, in init
self.get_activities()
File "/home/amity/Downloads/droidbot/droidbot/app.py", line 77, in get_activities
for activity_dom in manifest.getElementsByTagName("activity"):
AttributeError: 'NoneType' object has no attribute 'getElementsByTagName'
[CONNECTION] ADB is disconnected
Error: Unknown id: com.google.android.inputmethod.latin/com.android.inputmethod.latin.LatinIME
WARNING:DroidBotIme:Failed to disconnect DroidBotIME!
root@amity:/home/amity/Downloads/droidbot/droidbot# pip install androguard==3.0.1
Requirement already satisfied: androguard==3.0.1 in /usr/local/lib/python2.7/dist-packages

Please help

Event types in input script

Hi,

I am writing the input script right now and I want to know what event types does DroidBot support right now. Is there any reference I can look into?

Thank you so much!

base docker image on DroidBox

Like discussed with Ali, Lynn and me, we should refactor the Dockerfile, so it is based on the DroidBox-Dockerfile. The big advantage would be, that Ali would handle all Android-SDK Updates and we does not have any problem with this.

input script not able to fill textboxes

I created my script to fill textfields in login form of the app. The cursor in the app moves from one textfield to another one by one, but the problem is it does not fill values in any of the textfields.

The script that I created is
{ "views": { "first_name": { "resource_id": ".*editText5", "class": ".*EditText" }, "last_name": { "resource_id": ".*editText6", "class": ".*EditText" }, "login_mobile": { "resource_id": ".*editText3", "class": ".*EditText" }, "login_email": { "resource_id": ".*editText4", "class": ".*EditText" }, "login_age": { "resource_id": ".*editText2", "class": ".*EditText" }, "login_button": { "resource_id": ".*button9", "class": ".*Button" } }, "states": { "login_state": { "views": ["first_name", "last_name", "login_mobile", "login_email", "login_age", "login_button"] } }, "operations": { "login_operation": [ { "event_type": "set_text", "target_view": "first_name", "text": "Allen" }, { "event_type": "set_text", "target_view": "last_name", "text": "Peter" }, { "event_type": "set_text", "target_view": "login_mobile", "text": "8989898989" }, { "event_type": "set_text", "target_view": "login_email", "text": "[email protected]" }, { "event_type": "set_text", "target_view": "login_age", "text": "20" }, { "event_type": "touch", "target_view": "login_button" } ] }, "main": { "login_state": ["login_operation"] } }

The generated log contain following lines
INFO:AppEnvManager:Start deploying environment, policy is none INFO:InputEventManager:start sending events, policy is dfs_greedy Input: KeyEvent(state=061191e12a9a8c41fe7ea8e6619f7d68, name=HOME) Input: IntentEvent(intent='am start INFO:DroidBotScript:matched state: login_state, taking operation: login_operation Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=c1478b7d52bf484296a9990a6d7700bb, text=Allen) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=1da679f2bfe7911e4675a2399c1b04fe, text=Peter) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=41a654a4d3ee82054229980f4f7e8727, text=8989898989) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=0ab6494a1ae52a314512b916d40dfa55, [email protected]) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=e96a0859d0842b691003fcb389383179, text=20) Input: TouchEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=f243b21ac8c5d0aee474db642b8993d9) INFO:DroidBotScript:matched state: login_state, taking operation: login_operation Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=c1478b7d52bf484296a9990a6d7700bb, text=Allen) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=1da679f2bfe7911e4675a2399c1b04fe, text=Peter) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=41a654a4d3ee82054229980f4f7e8727, text=8989898989) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=0ab6494a1ae52a314512b916d40dfa55, [email protected]) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=e96a0859d0842b691003fcb389383179, text=20) Input: TouchEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=f243b21ac8c5d0aee474db642b8993d9) INFO:DroidBotScript:matched state: login_state, taking operation: login_operation Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=c1478b7d52bf484296a9990a6d7700bb, text=Allen) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=1da679f2bfe7911e4675a2399c1b04fe, text=Peter) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=41a654a4d3ee82054229980f4f7e8727, text=8989898989) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=0ab6494a1ae52a314512b916d40dfa55, [email protected]) Input: SetTextEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=e96a0859d0842b691003fcb389383179, text=20) Input: TouchEvent(state=6c26177c7e7ea6ae7dcd190550b2eda6, view=f243b21ac8c5d0aee474db642b8993d9) ^CINFO:InputEventManager:Finish sending events

droidbot stuck at "Please wait while installing the app..."

Following exception occurred in terminal

Exception in thread Thread-7:
Traceback (most recent call last):
File "c:\users\shiva\appdata\local\programs\python\python35\lib\threading.py", line 923, in _bootstrap_inner
self.run()
File "c:\users\shiva\appdata\local\programs\python\python35\lib\threading.py", line 871, in run
self._target(*self._args, **self._kwargs)
File "c:\users\shiva\desktop\major\droidbot-master\droidbot-master\droidbot\adapter\logcat.py", line 61, in handle_output
f.write(line)
File "c:\users\shiva\appdata\local\programs\python\python35\lib\encodings\cp1252.py", line 19, in encode
return codecs.charmap_encode(input,self.errors,encoding_table)[0]
UnicodeEncodeError: 'charmap' codec can't encode character '\uff0c' in position 63: character maps to

Android sandbox detection and countermeasure

Many Android apps (especially malware) are using sandbox-detection techniques. An app may try to hide some behaviors if it is running in a test environment. Sandbox-detection techniques make it difficult (even impossible) for existing anti-malware systems to perform malware analysis.

Detailed steps may include:

Implement a sandbox detector (an app that makes use of many sandbox-detecting techniques);
A detection-aware system (a system that can detect sandbox-detecting behaviors);
An undetectable system (a instrumented system that can return mock values to deceive sandbox-detecting techniques).

FYI Common sandbox-detecting techniques:
https://github.com/strazzere/anti-emulator
https://users.ece.cmu.edu/~tvidas/papers/ASIACCS14.pdf

Dockerizing droidbot

@ylimit Would it be a good idea to dockerize the application? It would add a virtualized environment that would remain consistent over all systems but do you think that the overhead would be greater than the benefits?

Docker build error (licences)

When trying to build droidbot with docker using:

git clone https://github.com/lynnlyc/droidbot.git
docker build -t honeynet/droidbot droidbot

Gives the folowing licence issues:

...
November 20, 2015
Do you accept the license 'android-sdk-license-c81a61d9' [y/n]: n
...
June 2014.
Do you accept the license 'android-sdk-preview-license-d099d938' [y/n]: n
...
Do you accept the license 'mips-android-sysimage-license-acdab23e' [y/n]: n
...
Error: Target id is not valid. Use 'android list targets' to get the target ids.
The command '/bin/sh -c expect /build/accept-licenses "android update sdk --no-ui --all --filter platform-tool,system-image,android-16" "android-sdk-license-5be876d5" && echo "\n"| android create avd -n droidbox -t 1 -d 2' returned a non-zero code: 1

If i alter /droidbot/docker/accept-licences to accept all licences i get the folowing error (set line 20 to y):

...
Installing Archives:
Preparing to install archives
Downloading Android SDK Platform-tools, revision 23.1
Installing Android SDK Platform-tools, revision 23.1
Stopping ADB server failed (code -1).
Installed Android SDK Platform-tools, revision 23.199%)
Downloading Android SDK Platform-tools, revision 24 rc2
Installing Android SDK Platform-tools, revision 24 rc2
Stopping ADB server succeeded.
Installed Android SDK Platform-tools, revision 24 rc299%)
Downloading SDK Platform Android 4.1.2, API 16, revision 5
Installing SDK Platform Android 4.1.2, API 16, revision 5
Installed SDK Platform Android 4.1.2, API 16, revision 596%)
Skipping 'Android TV ARM EABI v7a System Image, Android API 23, revision 3'; it depends on 'SDK Platform Android 6.0, API 23, revision 3' which was not installed.
Skipping 'Android TV Intel x86 Atom System Image, Android API 23, revision 3'; it depends on 'SDK Platform Android 6.0, API 23, revision 3' which was not installed.
Skipping 'Android Wear ARM EABI v7a System Image, Android API 23, revision 3'; it depends on 'SDK Platform Android 6.0, API 23, revision 3' which was not installed.
Skipping 'Android Wear Intel x86 Atom System Image, Android API 23, revision 3'; it depends on 'SDK Platform Android 6.0, API 23, revision 3' which was not installed.
Skipping 'ARM EABI v7a System Image, Android API 23, revision 3'; it depends on 'SDK Platform Android 6.0, API 23, revision 3' which was not installed.
Skipping 'Intel x86 Atom_64 System Image, Android API 23, revision 8'; it depends on 'SDK Platform Android 6.0, API 23, revision 3' which was not installed.
Skipping 'Intel x86 Atom System Image, Android API 23, revision 8'; it depends on 'SDK Platform Android 6.0, API 23, revision 3' which was not installed.
Skipping 'Google APIs ARM EABI v7a System Image, Android API 23, revision 7'; it depends on 'SDK Platform Android 6.0, API 23, revision 3' which was not installed.
Skipping 'Google APIs Intel x86 Atom_64 System Image, Android API 23, revision 12'; it depends on 'SDK Platform Android 6.0, API 23, revision 3' which was not installed.
Skipping 'Google APIs Intel x86 Atom System Image, Android API 23, revision 12'; it depends on 'SDK Platform Android 6.0, API 23, revision 3' which was not installed.
Skipping 'Android TV Intel x86 Atom System Image, Android API N, revision 2'; it depends on 'SDK Platform Android N Preview, revision 2' which was not installed.
Skipping 'Intel x86 Atom_64 System Image, Android API N, revision 2'; it depends on 'SDK Platform Android N Preview, revision 2' which was not installed.
Skipping 'Intel x86 Atom System Image, Android API N, revision 2'; it depends on 'SDK Platform Android N Preview, revision 2' which was not installed.
Skipping 'Android TV ARM EABI v7a System Image, Android API 22, revision 1'; it depends on 'SDK Platform Android 5.1.1, API 22, revision 2' which was not installed.
Skipping 'Android TV Intel x86 Atom System Image, Android API 22, revision 1'; it depends on 'SDK Platform Android 5.1.1, API 22, revision 2' which was not installed.
Skipping 'Android Wear ARM EABI v7a System Image, Android API 22, revision 7'; it depends on 'SDK Platform Android 5.1.1, API 22, revision 2' which was not installed.
Skipping 'Android Wear Intel x86 Atom System Image, Android API 22, revision 7'; it depends on 'SDK Platform Android 5.1.1, API 22, revision 2' which was not installed.
Skipping 'ARM EABI v7a System Image, Android API 22, revision 1'; it depends on 'SDK Platform Android 5.1.1, API 22, revision 2' which was not installed.
Skipping 'Intel x86 Atom_64 System Image, Android API 22, revision 4'; it depends on 'SDK Platform Android 5.1.1, API 22, revision 2' which was not installed.
Skipping 'Intel x86 Atom System Image, Android API 22, revision 4'; it depends on 'SDK Platform Android 5.1.1, API 22, revision 2' which was not installed.
Skipping 'Google APIs ARM EABI v7a System Image, Android API 22, revision 1'; it depends on 'SDK Platform Android 5.1.1, API 22, revision 2' which was not installed.
Skipping 'Google APIs Intel x86 Atom_64 System Image, Android API 22, revision 4'; it depends on 'SDK Platform Android 5.1.1, API 22, revision 2' which was not installed.
Skipping 'Google APIs Intel x86 Atom System Image, Android API 22, revision 4'; it depends on 'SDK Platform Android 5.1.1, API 22, revision 2' which was not installed.
Skipping 'Android TV ARM EABI v7a System Image, Android API 21, revision 3'; it depends on 'SDK Platform Android 5.0.1, API 21, revision 2' which was not installed.
Skipping 'Android TV Intel x86 Atom System Image, Android API 21, revision 3'; it depends on 'SDK Platform Android 5.0.1, API 21, revision 2' which was not installed.
Skipping 'Android Wear ARM EABI v7a System Image, Android API 21, revision 3'; it depends on 'SDK Platform Android 5.0.1, API 21, revision 2' which was not installed.
Skipping 'Android Wear Intel x86 Atom System Image, Android API 21, revision 3'; it depends on 'SDK Platform Android 5.0.1, API 21, revision 2' which was not installed.
Skipping 'ARM EABI v7a System Image, Android API 21, revision 3'; it depends on 'SDK Platform Android 5.0.1, API 21, revision 2' which was not installed.
Skipping 'Intel x86 Atom_64 System Image, Android API 21, revision 3'; it depends on 'SDK Platform Android 5.0.1, API 21, revision 2' which was not installed.
Skipping 'Intel x86 Atom System Image, Android API 21, revision 3'; it depends on 'SDK Platform Android 5.0.1, API 21, revision 2' which was not installed.
Skipping 'Google APIs ARM EABI v7a System Image, Android API 21, revision 10'; it depends on 'SDK Platform Android 5.0.1, API 21, revision 2' which was not installed.
Skipping 'Google APIs Intel x86 Atom_64 System Image, Android API 21, revision 10'; it depends on 'SDK Platform Android 5.0.1, API 21, revision 2' which was not installed.
Skipping 'Google APIs Intel x86 Atom System Image, Android API 21, revision 10'; it depends on 'SDK Platform Android 5.0.1, API 21, revision 2' which was not installed.
Skipping 'Android Wear ARM EABI v7a System Image, Android API 20, revision 4'; it depends on 'SDK Platform Android 4.4W.2, API 20, revision 2' which was not installed.
Skipping 'Android Wear Intel x86 Atom System Image, Android API 20, revision 4'; it depends on 'SDK Platform Android 4.4W.2, API 20, revision 2' which was not installed.
Skipping 'ARM EABI v7a System Image, Android API 19, revision 3'; it depends on 'SDK Platform Android 4.4.2, API 19, revision 4' which was not installed.
Skipping 'Intel x86 Atom System Image, Android API 19, revision 3'; it depends on 'SDK Platform Android 4.4.2, API 19, revision 4' which was not installed.
Skipping 'ARM EABI v7a System Image, Android API 18, revision 3'; it depends on 'SDK Platform Android 4.3.1, API 18, revision 3' which was not installed.
Skipping 'Intel x86 Atom System Image, Android API 18, revision 2'; it depends on 'SDK Platform Android 4.3.1, API 18, revision 3' which was not installed.
Skipping 'ARM EABI v7a System Image, Android API 17, revision 3'; it depends on 'SDK Platform Android 4.2.2, API 17, revision 3' which was not installed.
Skipping 'Intel x86 Atom System Image, Android API 17, revision 2'; it depends on 'SDK Platform Android 4.2.2, API 17, revision 3' which was not installed.
Skipping 'MIPS System Image, Android API 17, revision 1'; it depends on 'SDK Platform Android 4.2.2, API 17, revision 3' which was not installed.
Downloading ARM EABI v7a System Image, Android API 16, revision 4
Installing ARM EABI v7a System Image, Android API 16, revision 4
Installed ARM EABI v7a System Image, Android API 16, revision 499%)
Downloading Intel x86 Atom System Image, Android API 16, revision 2
Installing Intel x86 Atom System Image, Android API 16, revision 2
Installed Intel x86 Atom System Image, Android API 16, revision 299%)
Downloading MIPS System Image, Android API 16, revision 1
Installing MIPS System Image, Android API 16, revision 1
Installed MIPS System Image, Android API 16, revision 199%)
Skipping 'ARM EABI v7a System Image, Android API 15, revision 3'; it depends on 'SDK Platform Android 4.0.3, API 15, revision 5' which was not installed.
Skipping 'Intel x86 Atom System Image, Android API 15, revision 2'; it depends on 'SDK Platform Android 4.0.3, API 15, revision 5' which was not installed.
Skipping 'MIPS System Image, Android API 15, revision 1'; it depends on 'SDK Platform Android 4.0.3, API 15, revision 5' which was not installed.
Skipping 'ARM EABI v7a System Image, Android API 14, revision 2'; it depends on 'SDK Platform Android 4.0, API 14, revision 4' which was not installed.
Skipping 'Intel x86 Atom System Image, Android API 10, revision 3'; it depends on 'SDK Platform Android 2.3.3, API 10, revision 2' which was not installed.
Stopping ADB server succeeded.
Starting ADB server succeeded.
Done. 6 packages installed.
Valid ABIs: default/armeabi-v7a, default/mips, default/x86
Error: This platform has more than one ABI. Please specify one using --abi.
The command '/bin/sh -c expect /build/accept-licenses "android update sdk --no-ui --all --filter platform-tool,system-image,android-16" "android-sdk-license-5be876d5" && echo "\n"| android create avd -n droidbox -t 1 -d 2' returned a non-zero code: 1

I'm using Linux (4.5.1)
I opted to build it myself because i want to get the logcat file together with the output of droidbox when examining a apk (and this was not possible otherwise).

help

Thanks for your amazing project it is what I search for but I use it in windows7 is there any video or tutorial to explain run and test in windows 7 ?
I have some qusitions
1- Is it make static and dynamic analysis for android applications and send report for me (Permissions and APIs used in app)?
2- I installed :
Python version 2.7
Android SDK,and add platform_tools and tools to PATH
androidviewclient
then install droidbot :
git clone https://github.com/lynnlyc/droidbot.git
pip install -e droidbot
and start it : droidbot -h
but when write this command :
droidbot-script.py -d 5554 -a C:\Python27\Scripts\droidbot\app-debug.apk
this message appear:

INFO:Device:waiting for device
Connecting to a device with serialno=5554 with a timeout of 60 secs...
Traceback (most recent call last):
File "C:\Python27\Scripts\droidbot-script.py", line 9, in
load_entry_point('droidbot', 'console_scripts', 'droidbot')()
File "c:\users\hp\droidbot\droidbot\start.py", line 79, in main
quiet=opts.quiet)
File "c:\users\hp\droidbot\droidbot\droidbot.py", line 47, in init
self.device = Device(device_serial, output_dir=self.output_dir)
File "c:\users\hp\droidbot\droidbot\droidbot_types.py", line 57, in init
self.connect()
File "c:\users\hp\droidbot\droidbot\droidbot_types.py", line 138, in connect
self.get_adb()
File "c:\users\hp\droidbot\droidbot\droidbot_types.py", line 186, in get_adb
self.adb, self.serial = ViewClient.connectToDeviceOrExit(verbose=True,serial
no=self.serial)
File "C:\Python27\lib\site-packages\androidviewclient-11.5.1-py2.7.egg\com\dtm
ilano\android\viewclient.py", line 2669, in connectToDeviceOrExit
device = adbclient.AdbClient(serialno, ignoreversioncheck=ignoreversioncheck
, timeout=timeout)
File "C:\Python27\lib\site-packages\androidviewclient-11.5.1-py2.7.egg\com\dtm
ilano\android\adb\adbclient.py", line 171, in init
self.__setTransport()
File "C:\Python27\lib\site-packages\androidviewclient-11.5.1-py2.7.egg\com\dtm
ilano\android\adb\adbclient.py", line 333, in __setTransport
raise RuntimeError("ERROR: couldn't find device that matches '%s' in %s" % (
self.serialno, devices))
RuntimeError: ERROR: couldn't find device that matches '5554' in [<com.dtmilano.
android.adb.adbclient.Device instance at 0x0000000003326748>]

Note that the emulator is run and 5554 is the serial no of it , what is the problem ?
and if it run where the result report will appear ?
3- Is it necessary to setup docker and droidbox? what is benefits from that I setup docker in windows but it doesn't work there is aproblem in connection and I can't run droidbox emulator in windows .
Thanks for your help and I'm sorry for waste your time

Restoring to a safe state a real device

Using an emulator is "very easy" to restore it to a safe state. How can we help people using real devices to restore it to a safe state ?

ImportError: No module named _markerlib

I am getting below error. Can u please help me in resolving these issues:

pavans-MacBook-Pro:mobile_auto pavan$ pip install -e droidbot
Obtaining file:///Users/pavan/mydata/office/mobile_auto/droidbot
Collecting androguard (from droidbot==1.0.0a2)
Downloading androguard-3.0.tar.gz (3.5MB)
100% |████████████████████████████████| 3.5MB 180kB/s
Collecting pillow (from droidbot==1.0.0a2)
Downloading Pillow-3.3.0-cp27-cp27m-macosx_10_6_intel.macosx_10_9_intel.macosx_10_9_x86_64.macosx_10_10_intel.macosx_10_10_x86_64.whl (3.2MB)
100% |████████████████████████████████| 3.2MB 234kB/s
Collecting distribute (from androguard->droidbot==1.0.0a2)
Downloading distribute-0.7.3.zip (145kB)
100% |████████████████████████████████| 153kB 931kB/s
Complete output from command python setup.py egg_info:
running egg_info
creating pip-egg-info/distribute.egg-info
writing requirements to pip-egg-info/distribute.egg-info/requires.txt
writing pip-egg-info/distribute.egg-info/PKG-INFO
writing top-level names to pip-egg-info/distribute.egg-info/top_level.txt
writing dependency_links to pip-egg-info/distribute.egg-info/dependency_links.txt
Traceback (most recent call last):
File "", line 1, in
File "/private/var/folders/hk/wbq0s2sn1sl87ycbpvt3v3580000gn/T/pip-build-l7Px9C/distribute/setup.py", line 58, in
setuptools.setup(**setup_params)
File "/usr/local/Cellar/python/2.7.10_2/Frameworks/Python.framework/Versions/2.7/lib/python2.7/distutils/core.py", line 151, in setup
dist.run_commands()
File "/usr/local/Cellar/python/2.7.10_2/Frameworks/Python.framework/Versions/2.7/lib/python2.7/distutils/dist.py", line 953, in run_commands
self.run_command(cmd)
File "/usr/local/Cellar/python/2.7.10_2/Frameworks/Python.framework/Versions/2.7/lib/python2.7/distutils/dist.py", line 972, in run_command
cmd_obj.run()
File "setuptools/command/egg_info.py", line 177, in run
writer = ep.load(installer=installer)
File "pkg_resources.py", line 2241, in load
if require: self.require(env, installer)
File "pkg_resources.py", line 2254, in require
working_set.resolve(self.dist.requires(self.extras),env,installer)))
File "pkg_resources.py", line 2471, in requires
dm = self._dep_map
File "pkg_resources.py", line 2682, in _dep_map
self.__dep_map = self._compute_dependencies()
File "pkg_resources.py", line 2699, in _compute_dependencies
from _markerlib import compile as compile_marker
ImportError: No module named _markerlib

----------------------------------------

Command "python setup.py egg_info" failed with error code 1 in /private/var/folders/hk/wbq0s2sn1sl87ycbpvt3v3580000gn/T/pip-build-l7Px9C/distribute/

Error on running droidbot

When I am running droidbot I get following error
WARNING:DroidBot:Something went wrong: 'APK' object has no attribute 'get_AndroidManifest' Traceback (most recent call last): File "/home/******/droidbot/droidbot/droidbot.py", line 87, in __init__ self.app = App(app_path, output_dir=self.output_dir) File "/home/******/droidbot/droidbot/app.py", line 35, in __init__ self.get_activities() File "/home/*****/droidbot/droidbot/app.py", line 76, in get_activities manifest = self.get_androguard_analysis().a.get_AndroidManifest() AttributeError: 'APK' object has no attribute 'get_AndroidManifest' Error: Unknown id: com.android.inputmethod.latin/.LatinIME WARNING:DroidBotIme:Failed to disconnect DroidBotIME! [CONNECTION] ADB is disconnected

Warning message while starting droidbot

we installed the tool successfully but when we start the tool it shows error that Please enable accessibility for DroidBot app manually.
I am attaching the screenshot also.
Please suggest how to enable accessibility.

Regards
Jyoti

Emulator segfaults when using DroidBox-patched Android in droidbot exploration

There is a problem running droidbot analysis on Android emulator with Android4.1 and DroidBox system and ramdisk images.
The emulator receives SIGSEGV at some moment while exploring the application under analysis and then reboots breaking this way the droidbot traversal. The number of events sent to the emulator before the fail vary (usually it is 30-60 events). The error received also varies but typically it looks like that in adb logs:

F/libc    (  149): Fatal signal 11 (SIGSEGV) at 0x0b07bda4 (code=1), thread 615 (Binder_B)
I/DEBUG   (   34): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG   (   34): Build fingerprint: 'Android/full/generic:4.1.1/JRO03R/eng.mspreitz.20131102.190624:eng/test-keys'
I/DEBUG   (   34): pid: 149, tid: 615, name: UNKNOWN  >>> system_server <<<
I/DEBUG   (   34): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0b07bda4
I/DEBUG   (   34):     r0 0b07bcd8  r1 583de6c2  r2 0b07bda0  r3 00000000
I/DEBUG   (   34):     r4 583de6c2  r5 5c88fb44  r6 2a24ed28  r7 5f044864
I/DEBUG   (   34):     r8 00000000  r9 5f044865  sl 40bf1360  fp 00000000
I/DEBUG   (   34):     ip 00000000  sp 5fc38ba0  lr 00000000  pc 5f044c9e  cpsr 00000030
I/DEBUG   (   34):     d0  0000000000000000  d1  3ddb7cdfd9d7bdbb
I/DEBUG   (   34):     d2  4005ac95baaff9a2  d3  4024000000000000
I/DEBUG   (   34):     d4  0000000000000000  d5  3d909a0000000000
I/DEBUG   (   34):     d6  7e37e43c8800759c  d7  4008000000000000
I/DEBUG   (   34):     d8  4008000000000000  d9  4020000000000003
I/DEBUG   (   34):     d10 40034413509c0a62  d11 3fd34413509f79fe
I/DEBUG   (   34):     d12 3ddb7cdfd9d7bdbb  d13 0000000000000000
I/DEBUG   (   34):     d14 0000000000000000  d15 0000000000000000
I/DEBUG   (   34):     scr 60000010
I/DEBUG   (   34): 
I/DEBUG   (   34): backtrace:
I/DEBUG   (   34):     #00  pc 0000cc9e  /dev/ashmem/dalvik-jit-code-cache (deleted)
I/DEBUG   (   34): 
I/DEBUG   (   34): stack:
I/DEBUG   (   34):          5fc38b60  00000028  
I/DEBUG   (   34):          5fc38b64  2a24ed28  [heap]
I/DEBUG   (   34):          5fc38b68  4079f95c  /system/lib/libdvm.so
I/DEBUG   (   34):          5fc38b6c  407a3748  /system/lib/libdvm.so
I/DEBUG   (   34):          5fc38b70  5f044864  /dev/ashmem/dalvik-jit-code-cache (deleted)
I/DEBUG   (   34):          5fc38b74  5f044c91  /dev/ashmem/dalvik-jit-code-cache (deleted)
I/DEBUG   (   34):          5fc38b78  407a3748  /system/lib/libdvm.so
I/DEBUG   (   34):          5fc38b7c  407773db  /system/lib/libdvm.so (dvmJitChain+142)
I/DEBUG   (   34):          5fc38b80  583de6c2  /system/framework/framework.odex
I/DEBUG   (   34):          5fc38b84  5c88fb44  
I/DEBUG   (   34):          5fc38b88  2a24ed28  [heap]
I/DEBUG   (   34):          5fc38b8c  5f044864  /dev/ashmem/dalvik-jit-code-cache (deleted)
I/DEBUG   (   34):          5fc38b90  00000000  
I/DEBUG   (   34):          5fc38b94  5f044865  /dev/ashmem/dalvik-jit-code-cache (deleted)
I/DEBUG   (   34):          5fc38b98  df0027ad  
I/DEBUG   (   34):          5fc38b9c  00000000  
I/DEBUG   (   34):     #00  5fc38ba0  4079ec88  /system/lib/libdvm.so
I/DEBUG   (   34):          5fc38ba4  2a24ed28  [heap]
I/DEBUG   (   34):          5fc38ba8  4079ec88  /system/lib/libdvm.so
I/DEBUG   (   34):          5fc38bac  569bc558  /dev/ashmem/dalvik-LinearAlloc (deleted)
I/DEBUG   (   34):          5fc38bb0  00000000  
I/DEBUG   (   34):          5fc38bb4  5fc38bd0  
I/DEBUG   (   34):          5fc38bb8  5fc38cb0  
I/DEBUG   (   34):          5fc38bbc  00000000  
I/DEBUG   (   34):          5fc38bc0  5fc38c6c  
I/DEBUG   (   34):          5fc38bc4  407201e8  /system/lib/libdvm.so (dvmInterpret(Thread*, Method const*, JValue*, unsigned int*)+192)
I/DEBUG   (   34):          5fc38bc8  4166c3c8  /dev/ashmem/dalvik-heap (deleted)
I/DEBUG   (   34):          5fc38bcc  4072f10d  /system/lib/libdvm.so
I/DEBUG   (   34):          5fc38bd0  00000000  
I/DEBUG   (   34):          5fc38bd4  5c88ff50  
I/DEBUG   (   34):          5fc38bd8  00000000  
I/DEBUG   (   34):          5fc38bdc  00000000  
I/DEBUG   (   34): 
I/DEBUG   (   34): memory near r0:
I/DEBUG   (   34):     0b07bcb8 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     0b07bcc8 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     0b07bcd8 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     0b07bce8 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     0b07bcf8 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34): 
I/DEBUG   (   34): memory near r1:
I/DEBUG   (   34):     583de6a0 003b20f8 61f20010 107100a8 0001f785  . ;....a..q.....
I/DEBUG   (   34):     583de6b0 20f8010c 0010003b 06c2011a 003b20f8  ... ;........ ;.
I/DEBUG   (   34):     583de6c0 61f20010 20f800c8 00100036 034b011a  ...a... 6.....K.
I/DEBUG   (   34):     583de6d0 003b20f8 61f20010 10710070 0001f785  . ;....ap.q.....
I/DEBUG   (   34):     583de6e0 20f8010c 0010003b 009061f2 00110138  ... ;....a..8...
I/DEBUG   (   34): 
I/DEBUG   (   34): memory near r2:
I/DEBUG   (   34):     0b07bd80 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     0b07bd90 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     0b07bda0 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     0b07bdb0 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     0b07bdc0 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34): 
I/DEBUG   (   34): memory near r4:
I/DEBUG   (   34):     583de6a0 003b20f8 61f20010 107100a8 0001f785  . ;....a..q.....
I/DEBUG   (   34):     583de6b0 20f8010c 0010003b 06c2011a 003b20f8  ... ;........ ;.
I/DEBUG   (   34):     583de6c0 61f20010 20f800c8 00100036 034b011a  ...a... 6.....K.
I/DEBUG   (   34):     583de6d0 003b20f8 61f20010 10710070 0001f785  . ;....ap.q.....
I/DEBUG   (   34):     583de6e0 20f8010c 0010003b 009061f2 00110138  ... ;....a..8...
I/DEBUG   (   34): 
I/DEBUG   (   34): memory near r5:
I/DEBUG   (   34):     5c88fb24 00000000 00000000 5c88fb98 57a17830  ...........\0x.W
I/DEBUG   (   34):     5c88fb34 56b16648 00000002 583de6bc 00000000  Hf.V......=X....
I/DEBUG   (   34):     5c88fb44 41714928 00000000 419988d0 00000000  (IqA.......A....
I/DEBUG   (   34):     5c88fb54 00000000 00000000 ffffffff 00000000  ................
I/DEBUG   (   34):     5c88fb64 bf800000 00000000 fffffffe 00000000  ................
I/DEBUG   (   34): 
I/DEBUG   (   34): memory near r6:
I/DEBUG   (   34):     2a24ed08 00000001 2a2b4568 00000038 00000012  ....hE+*8.......
I/DEBUG   (   34):     2a24ed18 2a190688 2a193398 2a193398 0000045b  ...*.3.*.3.*[...
I/DEBUG   (   34):     2a24ed28 579f877c 5c88fb44 56b16648 58a7b000  |..WD..\Hf.V...X
I/DEBUG   (   34):     2a24ed38 41714928 73057821 00000000 5fc38ba0  (IqA!x.s......._
I/DEBUG   (   34):     2a24ed48 00000000 5fc38bd0 00000043 00000000  ......._C.......
I/DEBUG   (   34): 
I/DEBUG   (   34): memory near r7:
I/DEBUG   (   34):     5f044844 290000ec f8dfdc03 1c31706c a10447b8  ...)....lp1..G..
I/DEBUG   (   34):     5f044854 ec20f7f3 de00e000 005cf8df 47886f71  .. .......\.qo.G
I/DEBUG   (   34):     5f044864 4300e214 47806ff0 583de6c2 ffb4f7fc  ...C.o.G..=X....
I/DEBUG   (   34):     5f044874 40a25c28 569adf60 00000000 01000100  (\.@`..V........
I/DEBUG   (   34):     5f044884 2a1c0000 56b16648 008a0002 00000001  ...*Hf.V........
I/DEBUG   (   34): 
I/DEBUG   (   34): memory near r9:
I/DEBUG   (   34):     5f044844 290000ec f8dfdc03 1c31706c a10447b8  ...)....lp1..G..
I/DEBUG   (   34):     5f044854 ec20f7f3 de00e000 005cf8df 47886f71  .. .......\.qo.G
I/DEBUG   (   34):     5f044864 4300e214 47806ff0 583de6c2 ffb4f7fc  ...C.o.G..=X....
I/DEBUG   (   34):     5f044874 40a25c28 569adf60 00000000 01000100  (\.@`..V........
I/DEBUG   (   34):     5f044884 2a1c0000 56b16648 008a0002 00000001  ...*Hf.V........
I/DEBUG   (   34): 
I/DEBUG   (   34): memory near sl:
I/DEBUG   (   34):     40bf1340 00000000 00000000 00730069 00000013  ........i.s.....
I/DEBUG   (   34):     40bf1350 40bf2f78 00000000 00000010 00000edb  x/.@............
I/DEBUG   (   34):     40bf1360 40a0c1e8 00000000 00000000 00000000  ...@............
I/DEBUG   (   34):     40bf1370 00000000 00000000 00000000 00000000  ................
I/DEBUG   (   34):     40bf1380 00000000 00000000 58628c60 00000000  ........`.bX....
I/DEBUG   (   34): 
I/DEBUG   (   34): memory near sp:
I/DEBUG   (   34):     5fc38b80 583de6c2 5c88fb44 2a24ed28 5f044864  ..=XD..\(.$*dH._
I/DEBUG   (   34):     5fc38b90 00000000 5f044865 df0027ad 00000000  ....eH._.'......
I/DEBUG   (   34):     5fc38ba0 4079ec88 2a24ed28 4079ec88 569bc558  ..y@(.$*[email protected]
I/DEBUG   (   34):     5fc38bb0 00000000 5fc38bd0 5fc38cb0 00000000  ......._..._....
I/DEBUG   (   34):     5fc38bc0 5fc38c6c 407201e8 4166c3c8 4072f10d  [email protected]@
I/DEBUG   (   34): 
I/DEBUG   (   34): code around pc:
I/DEBUG   (   34):     5f044c7c 00000000 2a1cf2b4 f85f00a8 68010008  .......*.._....h
I/DEBUG   (   34):     5f044c8c 60013101 6b6b6b28 f8d0b3a8 f20010c8  .1.`(kkk........
I/DEBUG   (   34):     5f044c9c 685202c8 ea436828 f2a50202 f04f0718  ..Rh(hC.......O.
I/DEBUG   (   34):     5f044cac f8c70902 f2a5900c f04f071c f8c70900  ..........O.....
I/DEBUG   (   34):     5f044cbc f2a59000 60ea072c 686a60a9 b1e86829  ....,..`.`jh)h..
I/DEBUG   (   34): 
I/DEBUG   (   34): code around lr:
I/DEBUG   (   34):     00000000 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     00000010 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     00000020 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     00000030 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34):     00000040 ffffffff ffffffff ffffffff ffffffff  ................
I/DEBUG   (   34): 
I/DEBUG   (   34): memory map around fault addr 0b07bda4:
I/DEBUG   (   34):     (no map below)
I/DEBUG   (   34):     (no map for address)
I/DEBUG   (   34):     2a000000-2a002000 /system/bin/app_process

For more information see the adb logs and droidbot command line output in test cases (issue.zip).

Most probably this error is not connected with droidbot exploration. The error is not seen when using emulator with original (not DroidBox-patched) system images and the same AVD.

In order to reproduce the error, get the old droidbot version working with DroidBox on https://github.com/nastya/droidbot/tree/droidbox

Here are the test cases. I used two applications downloaded from Google Play to get the logs describing the error: zok.android.letters.apk and com.alexcruz.papuhwalls_10.apk. Actually the choise of the applications does not matter, such emulator failures are seen every time.

Before running droidbot I started emulator with DroidBox-patched Android and after its boot finished I ran adb logcat > *_logcat*.txt and the droidbot analysis.

droidbot -d emulator-5554 -a test_apps/zok.android.letters.apk -o zok_out1 -use_with_droidbox -policy dfs -count 100 &> zok_log1.txt

droidbot -d emulator-5554 -a test_apps/zok.android.letters.apk -o zok_out2 -use_with_droidbox -policy dfs -count 100 &> zok_log2.txt

When rerunning the analysis with -no_shuffle option the SIGSEGV happens almoast at the same time (see papuh* logs).

droidbot -d emulator-5554 -a test_apps/com.alexcruz.papuhwalls_10.apk -o papuh_out1 -use_with_droidbox -no_shuffle -policy dfs -count 100 &> papuh_log1.txt

droidbot -d emulator-5554 -a test_apps/com.alexcruz.papuhwalls_10.apk -o papuh_out2 -use_with_droidbox -no_shuffle -policy dfs -count 100 &> papuh_log2.txt

The same behavior is seen without using -use_with_droidbox option.

droidbot -d emulator-5554 -a test_apps/zok.android.letters.apk -o zok_out_no_dbox -policy dfs -count 100 &> zok_log_no_dbox.txt

Storing device states in droidbot

I have a problem obtaining device states.

I run droidbot with this command:
droidbot -d emulator-5554 -a filename.apk -event state_recorder -duration 100 -o droidbot_out
It works fine but after finishing the analysis there is no subdirectory device_states in droidbot_out.

I've spent some time trying to understand why the states are not stored and revealed that it is caused by exception in function get_view_str of DeviceState (droidbot_types.py#L632-L640). Map returned by a viewclient does not contain fields 'package', 'resource-id' and 'text' so referring to them causes exception.

I substituted this function by

  def get_view_str(view_dict):
        """
        get the unique string which can represent the view
        @param view_dict: dict, element of list device.get_current_state().views
        @return:
        """
        view_str = "package:%s,class:%s,resource-id:%s,text:%s" %\
                   (view_dict['package'] if 'package' in view_dict else 'nopackage',\
                    view_dict['class'] if 'class' in view_dict else 'noclass',\
                    view_dict['resource-id'] if 'resource-id' in view_dict else 'noresource-id',\
                    view_dict['text'] if 'text' in view_dict else 'notext')
        return view_str

This way I obtained some devices states .json and .png files. Here is an example:

device_state_2016-07-07_155937.json.txt

We can see in returned maps keys "uniqueId" instead of "resource-id" and "text:mText" instead of "text" for TextViews. I think they can be used to obtain unique view_str for a view.

Is it a bug in droidbot or my androidviewclient does not work properly?

`types` is an undefined name on line 477 of ./droidbox_scripts/utils.py

flake8 testing of https://github.com/honeynet/droidbot on Python 2.7.13

$ flake8 . --count --select=E901,E999,F821,F822,F823 --show-source --statistics

./droidbox_scripts/utils.py:477:24: F821 undefined name 'types'
    if type(l) not in (types.IntType, types.LongType):
                       ^

./droidbox_scripts/utils.py:477:39: F821 undefined name 'types'
    if type(l) not in (types.IntType, types.LongType):
                                      ^

DroidbotEvaluator.py script error: not able to inject events policy

No events are generated when env_policy="static" and event_policy="static" is set in the DroidbotEvaluator.py script. It just gives following message:

INFO:AppEventManager:start sending events, policy is static
INFO:Device:sending event: {'intent': u'am broadcast -a android.provider.Telephony.SMS_RECEIVED', 'event_type': 'intent'}
WARNING:Device:ERROR: ''

Code modification:


  def droidbot_static(self):
        """
        try droidbot "static" mode
        :return:
        """
        self.start_droidbot(env_policy="static", event_policy="static")

Complete Error Log:

/usr/bin/python2.7 /home/gauree/Documents/droidbot/DroidboxEvaluator.py -a /home/gauree/Documents/droidbot/resources/DroidBoxTests.apk -count 2
INFO:DroidboxEvaluator:Evaluator initialized
INFO:DroidboxEvaluator:apk_path:/home/gauree/Documents/droidbot/resources/DroidBoxTests.apk
duration:200
count:2
inteval:2
report title:Evaluation_Report_2016-02-06_2100
INFO:DroidboxEvaluator:evaluating [4.static] mode
INFO:DroidboxEvaluator:starting droidbot
INFO:Device:waiting for device
Connecting to a device with serialno=.* with a timeout of 60 secs...
Connected to device with serialno=.*
/usr/local/lib/python2.7/dist-packages/androidviewclient-11.4.0-py2.7.egg/com/dtmilano/android/viewclient.py:2556: UserWarning: Running on emulator but no serial number was specified then 'emulator-5554' is used
  warnings.warn("Running on emulator but no serial number was specified then 'emulator-5554' is used")
Actual device serialno=emulator-5554
INFO:DroidBot:Starting DroidBot
INFO:AppEnvManager:start deploying environment, policy is static
INFO:Device:deploying env: {'env_type': 'contact', 'phone': '1234567890', 'name': 'Lynn', 'email': '[email protected]'}
INFO:Device:deploying env: {'content': 'Hello world', 'phone': '1234567890', 'sms_in': True, 'env_type': 'smslog'}
INFO:Device:deploying env: {'content': 'Hello world', 'phone': '1234567890', 'sms_in': False, 'env_type': 'smslog'}
Waiting for the device...
Installing the application /home/gauree/Documents/droidbot/resources/DroidBoxTests.apk...
Running the component droidbox.tests/droidbox.tests.DroidBoxTests...
09:01:26 E/DeviceMonitor: Adb connection Error:EOF
09:01:26 E/DeviceMonitor: Connection attempts: 1
09:01:27 E/DeviceMonitor: Connection attempts: 2
Starting the activity .DroidBoxTests...
INFO:AppEventManager:start sending events, policy is static
INFO:Device:sending event: {'intent': u'am broadcast -a android.provider.Telephony.SMS_RECEIVED', 'event_type': 'intent'}
WARNING:Device:ERROR: '' 
INFO:AppEventManager:finish sending events, saved to droidbot_event.json
Application started
 ____                        __  ____
/\  _`\               __    /\ \/\  _`\
\ \ \/\ \  _ __  ___ /\_\   \_\ \ \ \L\ \   ___   __  _
 \ \ \ \ \/\`'__\ __`\/\ \  /'_` \ \  _ <' / __`\/\ \/'\
  \ \ \_\ \ \ \/\ \L\ \ \ \/\ \L\ \ \ \L\ \ \L\ \/>  </
   \ \____/\ \_\ \____/\ \_\ \___,_\ \____/ \____//\_/\_\
    \/___/  \/_/\/___/  \/_/\/__,_ /\/___/ \/___/ \//\/_/
{"apkName": "/home/gauree/Documents/droidbot/resources/DroidBoxTests.apk", "enfperm": [], "recvnet": {}, "servicestart": {}, "sendsms": {}, "cryptousage": {}, "sendnet": {}, "accessedfiles": {}, "fdaccess": {}, "dataleaks": {}, "opennet": {}, "recvsaction": {".SMSReceiver": "android.provider.Telephony.SMS_RECEIVED"}, "dexclass": {}, "hashes": ["aabdfae011e3e9cfc3519520350b0641", "8c189ee0fe385769dab515a20d9eec63c608ee8c", "ee093aa086a1638edd22823ec3c806828caf40ee41f1f48367c172b516c9e070"], "closenet": {}, "phonecalls": {}}
INFO:DroidBot:DroidBot Stopped

Process finished with exit code 0
`

Commands only available on emulator

There are some commands via Telnet only available on emulator, how can we do something related on a real device ?

Improve AppModel

Refer Issue #33

Is droidbotApp.apk source code available?

Hi, I'm doing some tests with droidbot and I would like to study how it works. Since droidbotApp.apk has to be installed on the device for droidbot to work, I would like to know if the source code of this app is available. Thank you in advance.

Failed to run with new androguard 3.1 dependency

Hello there,
The program throw exceptions and stop working with the new androguard 3.1 package.

Static and Dynamic App Environments

In file env_manager.py , classes StaticAppEnv and DynamicAppEnv have not yet been implemented and I would like to work on them. Can anyone guide me on this?

Feature: Start application, if not running

Error 6.1 - can't start activity

If the app is not started yet, droidbot can't start the application.
It looks like droidbot try to open it with:

INFO:Device:sending event: {'intent': u'am start com.ctf.hack_lu', 'type': 'intent'}

But nothing happen. I think it would be good to start the app automatically if not running. Or is that a Bug?

Can you reproduce this? Or did you need any further information?

Envirement:

Ubuntu 14.04 LTS, 64 bit
GIT: 36978bc
Sample: http://www.h-lemoine.de/ctf.hack.lu_2011/0xA1EA512A.apk - NoMalware

Output

hanno@dockerDroidBox:~/work/PycharmProjects/gsoc_droidbot$ python start.py -d emulator-5554 -a ~/mobileSamples/myApkTresor/0xA1EA512A.apk
Connecting to a device with serialno=emulator-5554 with a timeout of 60 secs...
Connected to device with serialno=emulator-5554
Actual device serialno=emulator-5554
INFO:TelnetConsole:telnet successfully initiated, the addr is (localhost:5554)
INFO:AppEnvManager:start deploying environment, policy is none
INFO:AppEnvManager:finish deploying environment, policy is none
INFO:AppEventManager:start sending events, policy is monkey
INFO:Device:sending event: {'intent': u'am start com.ctf.hack_lu', 'type': 'intent'}
INFO:Device:sending event: {'intent': 'am broadcast -a android.intent.action.BATTERY_CHANGED', 'type': 'intent'}
INFO:Device:sending event: {'event_type': 'key', 'name': 'MENU'}
INFO:Device:sending event: {'intent': u'am start com.ctf.hack_lu', 'type': 'intent'}
INFO:Device:sending event: {'intent': u'am start com.ctf.hack_lu', 'type': 'intent'}
INFO:Device:sending event: {'intent': 'am broadcast -a android.intent.action.PICK_ACTIVITY', 'type': 'intent'}
INFO:Device:sending event: {'intent': u'am start com.ctf.hack_lu', 'type': 'intent'}
INFO:Device:sending event: {'intent': 'am broadcast -a android.intent.action.BOOT_COMPLETED', 'type': 'intent'}
INFO:Device:sending event: {'intent': u'am start com.ctf.hack_lu', 'type': 'intent'}
INFO:Device:sending event: {'intent': u'am start com.ctf.hack_lu', 'type': 'intent'}
INFO:Device:sending event: {'intent': 'am broadcast -a android.intent.action.POWER_USAGE_SUMMARY', 'type': 'intent'}
INFO:Device:sending event: {'intent': u'am start com.ctf.hack_lu', 'type': 'intent'}
INFO:Device:sending event: {'intent': 'am broadcast -a android.intent.action.PACKAGE_ADDED', 'type': 'intent'}
^CTraceback (most recent call last):
  File "start.py", line 59, in <module>
    main()
  File "start.py", line 54, in main
    droidbot.start()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/droidbot.py", line 57, in start
    event_manager.start()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 596, in start
    self.event_factory.start(self)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 624, in start
    time.sleep(event_manager.duration)
KeyboardInterrupt

Support Semi-automated UI testing in DroidBot

We want to extend DroidBot to support semi-automated testing. That is, DroidBot learns from the human about how to interact with apps. For example, a user interacts with an app for the first time (eg. swiping windows, drawing PIN code, etc.), we record the user’s input and send to DroidBot, and based on the user’s input, DroidBot will be able to pass the difficult UI states.

The detailed steps may include:

Improve the app model that DroidBot used to test an app (see UtgDynamicFactory and AppModel classes in app_event.py);
Implement an Android app that can monitor UI (using UIAutomator, etc), record user interaction (using getevent, etc.), and construct the AppModel based on the UI and user interactions;
Extend DroidBot to read the AppModel as input and generate events based on the model.

GSoC 2016

As discussed with @hannoL and @hugo-glez, the timetable in GSoC'2016:

Before GSOC starts:

0. Testing up to 10 Apps: [1 Week]

We should try to use DroidBot with Apps we also have reversed. So we want to see, how good DroidBox and DroidBot can log the malicious behaviour of the sample. Which log-messages are good, which are missing, which are unrelated?
(Potential Samples: DroidBench, DroidBox Testing App, gatech.edu - AndroTest, Genome, )

During GSoC:

1. Remove False LogMessages [1 Week]

Try to distinguish between LogMessages produced by the analysed application and false logFiles, caused by DroidBot directly.

2. Measure the Coverage of Dyn.Analysis [2 Weeks]

With instrumentation of an APK the coverage should be calculated. The instrumentation should be only a module, that is not normally running in droidBot.

3. having a scripting language / Make analysis reproducible [4 Weeks]

It would be nice to have a scripting language, which can do everything which droidBot is automatically doing. For Example Clicking, swiping, ... Moreover it would be good, if we can insert text (like mails, usernames) into TextFields. (This should not be done automatically or by any MaschineLearning stuff, only the user should have the possibility to define some default inputs.) See f.e.

In the second part of this Task, it would be cool, if after an automated droidBot run, droidBot could return a scripting File, which would try to reproduce the dynAnalysis as best as possible. (Not look into network, or other complicated stuff. Really basically reproduce, clicks, textinputs, ...)

4. Improving DroidBot [3 Weeks]

4.1 Dynmic Analyse UI and identify Buttons, TextFields, Inputs
(Together with the scripting language this should solve the Stuck Problem in 80%)
4.2 Add some static Documents (JPGs, PNGs, DOC, PDFs) (for RansomeWare)
4.3 Identify ScrollViews and try to swipe up and down.
4.4 Add Simple Context (like Wifi on/off if Permission is requested, send SMS, ...)

5. Docu, Refactoring, Buffer [2 Weeks]

Other:

6. Improve Scripting language by:

6.1 Adding Contacts (with Mail-Adress, Telephone, ...)
6.2 Install other Applications (like Facebook, twitter, ...) bevor analysis starts.
6.3 Add Documents into special folders
6.4 Add/load SD-Card

Not in GSOC:

7. Anti-Sandbox-Detection Techniques

8. Paper: AppContext (ICSE15)

Webview Support

Hi,

I have a quick question about webview support.
Does your tool currently support webview or just view?
If not, is there any way we can integrate the webview?

Thank you!

customize input discuss

Hi,

Can you show me more details about how to use the customize input?
In your pass_login_script.jason example:

    "views": {
        "login_email": {
            "resource_id": ".*email",
            "class": ".*EditText"
        },

how can I link this view to the actual login view at runtime, so that droidbot will know which view it should insert these inputs? What is the meaning of the label such as "login_email"?
And what are the states and operations?

Thank you!

error: unpack requires a string argument of length 4

We have been getting this error when testing with some apps. Droidbot works fine with most apps, but gives the following error with few apps. Any suggestions on how to fix this error?

RUN APP: com.contextlogic.wish.apk
droidbot -d 024a07b4e14fa992 -a /home/privacyproxy/testbed/apps/top_free_13032018/com.contextlogic.wish.apk -policy dfs_greedy -timeout 150 -count 10000 -grant_perm -keep_env -keep_app -interval 15 -o 024a07b4e14fa992/com.contextlogic.wish.apk -script /home/privacyproxy/PPEval/droidbot_scripts/facebook_loggin.json
WARNING:DroidBot:Something went wrong: unpack requires a string argument of length 4
Traceback (most recent call last):
File "/home/privacyproxy/droidbot/droidbot/droidbot.py", line 83, in init
self.app = App(app_path, output_dir=self.output_dir)
File "/home/privacyproxy/droidbot/droidbot/app.py", line 28, in init
self.androguard = AndroguardAnalysis(self.app_path)
File "/home/privacyproxy/droidbot/droidbot/app.py", line 202, in init
self.a = APK(app_path)
File "/usr/local/lib/python2.7/dist-packages/androguard/core/bytecodes/apk.py", line 186, in init
self.zip = zipfile.ZipFile(StringIO.StringIO(self.__raw), mode=mode)
File "/usr/lib/python2.7/zipfile.py", line 770, in init
self._RealGetContents()
File "/usr/lib/python2.7/zipfile.py", line 857, in _RealGetContents
x._decodeExtra()
File "/usr/lib/python2.7/zipfile.py", line 388, in _decodeExtra
tp, ln = unpack('<HH', extra[:4])
error: unpack requires a string argument of length 4
WARNING:DroidBotIme:Failed to disconnect DroidBotIME!

Error 8: TypeError: 'set' object does not support indexing

I got following error, if I try -env static and -event static.

Can you reproduce this? Or did you need any further information?

Environment:

Ubuntu 14.04.LTS 64bit
GIT: 36978bc
Sample: http://www.h-lemoine.de/ctf.hack.lu_2011/0xA1EA512A.apk - NoMalware

Error Message run 1

hanno@dockerDroidBox:~/work/PycharmProjects/gsoc_droidbot$ python start.py -d emulator-5554 -a ~/mobileSamples/myApkTresor/0xA1EA512A.apk -env static -event static -o ~/mobileSamples/out/
Connecting to a device with serialno=emulator-5554 with a timeout of 60 secs...
Connected to device with serialno=emulator-5554
Actual device serialno=emulator-5554
INFO:TelnetConsole:telnet successfully initiated, the addr is (localhost:5554)
INFO:AppEnvManager:start deploying environment, policy is static
INFO:AppEnvManager:finish deploying environment, policy is static
INFO:AppEventManager:start sending events, policy is static
Traceback (most recent call last):
  File "start.py", line 59, in <module>
    main()
  File "start.py", line 54, in main
    droidbot.start()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/droidbot.py", line 57, in start
    event_manager.start()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 596, in start
    self.event_factory.start(self)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 622, in start
    event = self.generate_event()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 687, in generate_event
    event = IntentEvent(random.choice(self.possible_broadcasts))
  File "/usr/lib/python2.7/random.py", line 273, in choice
    return seq[int(self.random() * len(seq))]  # raises IndexError if seq is empty
TypeError: 'set' object does not support indexing

Error Message Run 2

Directly start again, with same options

hanno@dockerDroidBox:~/work/PycharmProjects/gsoc_droidbot$ python start.py -d emulator-5554 -a ~/mobileSamples/myApkTresor/0xA1EA512A.apk -env static -event static -o ~/mobileSamples/out/
Connecting to a device with serialno=emulator-5554 with a timeout of 60 secs...
Connected to device with serialno=emulator-5554
Actual device serialno=emulator-5554
INFO:TelnetConsole:telnet successfully initiated, the addr is (localhost:5554)
INFO:AppEnvManager:start deploying environment, policy is static
INFO:AppEnvManager:finish deploying environment, policy is static
INFO:AppEventManager:start sending events, policy is static
INFO:Device:sending event: {'y': 32.8591446899452, 'x': 437.5584810568152, 'event_type': 'touch'}
INFO:Device:sending event: {'end_y': 498.1677162695015, 'end_x': 315.68866845993193, 'event_type': 'drag', 'start_x': 210.69466125667248, 'start_y': 328.3185878673619, 'duration': 1000}
INFO:Device:sending event: {'y': 493.094584939305, 'x': 154.26444767996884, 'duration': 2000, 'event_type': 'long_touch'}
INFO:Device:sending event: {'y': 444.3006494011745, 'x': 113.67011265128552, 'event_type': 'touch'}
INFO:Device:sending event: {'end_y': 672.0457399110186, 'end_x': 478.18141328307485, 'event_type': 'drag', 'start_x': 466.8914364961149, 'start_y': 92.84503510691451, 'duration': 1000}
INFO:Device:sending event: {'y': 68.3811014163477, 'x': 17.85127948145888, 'event_type': 'touch'}
INFO:Device:sending event: {'y': 658.3341716339296, 'x': 100.44058556767399, 'duration': 2000, 'event_type': 'long_touch'}
INFO:Device:sending event: {'end_y': 115.7405872155012, 'end_x': 475.0347537349947, 'event_type': 'drag', 'start_x': 366.2377565833698, 'start_y': 623.9578109991636, 'duration': 1000}
Traceback (most recent call last):
  File "start.py", line 59, in <module>
    main()
  File "start.py", line 54, in main
    droidbot.start()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/droidbot.py", line 57, in start
    event_manager.start()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 596, in start
    self.event_factory.start(self)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 622, in start
    event = self.generate_event()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/app_event.py", line 687, in generate_event
    event = IntentEvent(random.choice(self.possible_broadcasts))
  File "/usr/lib/python2.7/random.py", line 273, in choice
    return seq[int(self.random() * len(seq))]  # raises IndexError if seq is empty
TypeError: 'set' object does not support indexing

Feedbacks from ICSE 2017

Would be interesting to explore:

Test large-scale apps such as WeChat.
Estimate power consumption by running an app with the same input for hundreds of times.
Support record and replay.
Reproducible test.
Can we do something with CrashScope (another interesting demo in ICSE 2017)?
Testing game apps?

Inquiry for how to use Droidbot with Droidbox

Hi, thanks for sharing this tool. I see in your post that you do the evaluation using Droidbox. May I know how do you do that?

I mean, for droidbox, I need to use command:
./droidbox.sh <file.apk> <duration in secs (optional)>

and for droidbot, I need to use command:
droidbot -a <path_to_apk> -o output_dir

Both install the app into the AVD, won't there be some conflict?

Installation error

When trying to install Droidbot I get the following error.
Is this a known bug, am I doing something wrong or am I just plain stupid? :)

Thanks in advance,
Sam

Traceback (most recent call last):

File "", line 1, in

File "/tmp/pip_build_root/pillow/setup.py", line 753, in

zip_safe=not debug_build(), )

File "/usr/lib/python2.7/distutils/core.py", line 151, in setup

dist.run_commands()

File "/usr/lib/python2.7/distutils/dist.py", line 953, in run_commands

self.run_command(cmd)

File "/usr/lib/python2.7/distutils/dist.py", line 972, in run_command

cmd_obj.run()

File "/usr/lib/python2.7/dist-packages/setuptools/command/install.py", line 53, in run

return _install.run(self)

File "/usr/lib/python2.7/distutils/command/install.py", line 601, in run

self.run_command('build')

File "/usr/lib/python2.7/distutils/cmd.py", line 326, in run_command

self.distribution.run_command(command)

File "/usr/lib/python2.7/distutils/dist.py", line 972, in run_command

cmd_obj.run()

File "/usr/lib/python2.7/distutils/command/build.py", line 128, in run

self.run_command(cmd_name)

File "/usr/lib/python2.7/distutils/cmd.py", line 326, in run_command

self.distribution.run_command(command)

File "/usr/lib/python2.7/distutils/dist.py", line 972, in run_command

cmd_obj.run()

File "/usr/lib/python2.7/distutils/command/build_ext.py", line 337, in run

self.build_extensions()

File "/tmp/pip_build_root/pillow/setup.py", line 521, in build_extensions

' using --disable-%s, aborting' % (f, f))

ValueError: zlib is required unless explicitly disabled using --disable-zlib, aborting

Cleaning up...
Command /usr/bin/python -c "import setuptools, tokenize;file='/tmp/pip_build_root/pillow/setup.py';exec(compile(getattr(tokenize, 'open', open)(file).read().replace('\r\n', '\n'), file, 'exec'))" install --record /tmp/pip-AQtfcn-record/install-record.txt --single-version-externally-managed --compile failed with error code 1 in /tmp/pip_build_root/pillow

Error on running droidbot

I downloaded latest droidbot. Whenever I run it with any app I get following error

WARNING:DroidBot:Something went wrong: 'lxml.etree._Element' object has no attribute 'getElementsByTagName' Traceback (most recent call last): File "/home/*****/droidbot/droidbot/droidbot.py", line 87, in __init__ self.app = App(app_path, output_dir=self.output_dir) File "/home/*******/droidbot/droidbot/app.py", line 35, in __init__ self.get_activities() File "/home/********t/app.py", line 77, in get_activities for activity_dom in manifest.getElementsByTagName("activity"): AttributeError: 'lxml.etree._Element' object has no attribute 'getElementsByTagName' [CONNECTION] ADB is disconnected Error: Unknown id: com.android.inputmethod.latin/.LatinIME WARNING:DroidBotIme:Failed to disconnect DroidBotIME!

Screenshots are not generated in Windows

As a result of commit 997c16b, the screenshots are now captured with adb and pulled from the device to the temp directory. Although this works fine in Linux, for some reason it does not on Windows. The following issues were discovered -

The screenshots are not generated in the states directory.
The screenshots, although removed at the end, are still shown by Explorer.
A WARNING:Device:saving state to dir failed: is logged. This is due to a [Error 2] The system cannot find the file specified exception thrown here

Argparser mix up filepath and device_serial

Error 4 with filepath

If I only specify a filepath with -a option, then the droidbot interpretate this as device. I think there is something wrong with the argparser.

RuntimeError: ERROR: couldn't find device that matches '/home/hanno/mobileSamples/myApkTresor/0xA1EA512A.apk' in [<com.dtmilano.android.adb.adbclient.Device instance at 0x7fa431a23ea8>]

Can you reproduce this? Or did you need any further information?

Envirement:

Ubuntu 14.04 LTS, 64 bit
GIT: 8b3c4ce
Sample: http://www.h-lemoine.de/ctf.hack.lu_2011/0xA1EA512A.apk - NoMalware

Output

hanno@dockerDroidBox:~/work/PycharmProjects/gsoc_droidbot$ python start.py -a ~/mobileSamples/myApkTresor/0xA1EA512A.apk
Connecting to a device with serialno=/home/hanno/mobileSamples/myApkTresor/0xA1EA512A.apk with a timeout of 60 secs...
Traceback (most recent call last):
  File "start.py", line 59, in <module>
    main()
  File "start.py", line 54, in main
    droidbot.start()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/droidbot.py", line 47, in start
    device = Device(self.options.device_serial)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/types.py", line 44, in __init__
    self.connect()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/types.py", line 96, in connect
    self.get_view_client()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/droidbot/types.py", line 165, in get_view_client
    self.view_client = ViewClient(*ViewClient.connectToDeviceOrExit(**kwargs1), **kwargs2)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/com/dtmilano/android/viewclient.py", line 2551, in connectToDeviceOrExit
    device = adbclient.AdbClient(serialno, ignoreversioncheck=ignoreversioncheck)
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/com/dtmilano/android/adb/adbclient.py", line 160, in __init__
    self.__setTransport()
  File "/home/hanno/work/PycharmProjects/gsoc_droidbot/com/dtmilano/android/adb/adbclient.py", line 306, in __setTransport
    raise RuntimeError("ERROR: couldn't find device that matches '%s' in %s" % (self.serialno, devices))
RuntimeError: ERROR: couldn't find device that matches '/home/hanno/mobileSamples/myApkTresor/0xA1EA512A.apk' in [<com.dtmilano.android.adb.adbclient.Device instance at 0x7fa431a23ea8>]

AccessibilityService or Uiautomator?

The paper says droidbot using UI Automator or Hierarchy Viewer to dump UI hierarchy tree, however I can only find AccessibilityService in droidbot apk. I am confused about this. Can you give an explanation?

honeynet / droidbot Goto Github PK

droidbot's People

Contributors

Stargazers

Watchers

Forkers

droidbot's Issues

Error 3.1 with no options

Envirement:

Output

Error 6.1 - can't start activity

Envirement:

Output

Before GSOC starts:

0. Testing up to 10 Apps: [1 Week]

During GSoC:

1. Remove False LogMessages [1 Week]

2. Measure the Coverage of Dyn.Analysis [2 Weeks]

3. having a scripting language / Make analysis reproducible [4 Weeks]

4. Improving DroidBot [3 Weeks]

5. Docu, Refactoring, Buffer [2 Weeks]

Other:

6. Improve Scripting language by:

Not in GSOC:

7. Anti-Sandbox-Detection Techniques

8. Paper: AppContext (ICSE15)

Environment:

Error Message run 1

Error Message Run 2

Error 4 with filepath

Envirement:

Output

Recommend Projects

Recommend Topics

Recommend Org