GSoC 2017 Summary: ReDroid toolbox
This is a contribution by GSoC student Ziyue Yang, find him on Github yzygitzh.
My project for GSoC 2017 is Android Sandbox Detection and Countermeasure, which came out to be the ReDroid toolbox. This post was presented for the final evaluation of my GSoC 2017 project.
ReDroid is a toolbox for automatically detecting and countering anti-sandbox behaviors in Android apps. You can:
Before GSoC 2017 begins, my GSoC mentor Yuanchun Li discussed with me about the proposal for the GSoC project. Generally our goal was to develop some mechanism that can counter anti-sandbox techniques presented in Android apps.
First, We raised three related research questions to solve:
- What sandbox-detection techniques are applied in Android apps, and how and to what extent are they applied?
- Is there a method capable of detecting such sandbox-detection techniques given a sample app?
- Is there an app analysis solution undetectable by common sandbox-detection methods?
After that, we came out with a plan with three stages:
- Investigating and collecting sandbox-detection techniques used in Android app (especially malware), and implementing a sample app using those techniques.
- Implementing a detection-aware system, which can identify whether an Android app has sandbox-detection techniques inside.
- Implementing an undetectable system. Such undetectable system is able to automatically find the detection activities inside an Android app, and convey countermeasures for them using data collected from 2). In such a system, an app would believe that it’s running on as a real device.
| Tasks | Status | Comments |
|---|---|---|
| Investigating and collecting sandbox-detection techniques used in Android app | Done | Investigated anti-emulator, DenDroid and a malware dataset provided by contagiominidump.blogspot.com |
| Implementing a detection-aware system | Done | Modified Android source to enable robust and automatic trace collection; Implemented a runtime trace collecting system based on DroidBot and a heuristic trace difference detection system |
| Implementing an undetectable system | Partly Done |
Implemented a dynamic control flow correction system based on JDWP and Xposed, which is capable for modifying method return values; Modified Android source to enable dynamic control flow correction without known by apps |
For more details, please visit this page
Future work:
- Support more complex method return types: currently ReDroid only supports return values of primitive types and
Stringtype. - Support more advanced method hooking: currently ReDroid only supports hacking methods according to stack trace, and the methods hacked can have only one return value.
- Wrap ReDroid to make it usable for most people: to run ReDroid, one has to configure real device and emulators, which is much too complicated for normal users. ReDroid can be wrapped into a cloud service in the future.
