5f0ne/androidappanalysis

Setup for Analysis of Android Applications

Description

Setup for Analysis of Android Applications

Architecture

---

Windows 11 Host

• Programs:
  • VirtualBox
  • Android Studio
  • Burp Suite Community Edition
  • Visual Studio Code
  • autoappanalysis

• Setup Host:
  • Add VboxManage to PATH
    • C:\Program Files\Oracle\VirtualBox
  • Add adb and emulator to PATH
    • C:\Users\[username]\AppData\Local\Android\Sdk\platform-tools
    • C:\Users\[username]\AppData\Local\Android\Sdk\emulator
  • Add the created AVD folder as a shared folder to your VM:
    • C:\Users\[username]\.android\avd\[name].avd
  • Add a shared folder for your analysis results:
    • Add subdirectory decrypted
      • Contains decrypted system images: *.raw
    • Add subdirectory files
      • Contains a folder for each snapshot with extracted files
    • Add subdirectory actions
      • Contains a folder for each action with analysis results

• Setup autoappanalysis:
  • In order to setup the Automation GUI correctly, follow the instructions of autoappanalysis

---

Ubuntu 22.02 VM:

• Programs:
  • avdecrypt.py
    • Removes full disk encryption from AVD snapshots
  • idifference2.py
    • Differential analysis of file systems
  • evidence
    • Differential analysis of idifference2.py output
  • sqliteview
    • Visualizes SQLite files
  • sqlitediff
    • Differential analysis of SQLite files
  • lineident
    • Searches files line by line for given words
  • fileextract
    • Extractes files from .raw files using sleuthkit
• Setup:
  • In order to setup the VM correctly, follow the instructions of app-analysis-setup

---

License

MIT