Scribd
Upload
4 views5 pages

unit5malware

Module 5 covers Android malware analysis, detailing the APK file structure, which includes components like classes.dex and AndroidManifest.xml, and the Android security model that ensures app isolation and permission management. It also discusses the implications of rooting devices, methods of app distribution, and the risks associated with third-party stores and side-loading. Additionally, it introduces Android debugging tools such as ADB and Android Studio Debugger for effective application management and error resolution.

Uploaded by

sakshisunilaru
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
4 views5 pages

unit5malware

Module 5 covers Android malware analysis, detailing the APK file structure, which includes components like classes.dex and AndroidManifest.xml, and the Android security model that ensures app isolation and permission management. It also discusses the implications of rooting devices, methods of app distribution, and the risks associated with third-party stores and side-loading. Additionally, it introduces Android debugging tools such as ADB and Android Studio Debugger for effective application management and error resolution.

Uploaded by

sakshisunilaru
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Module 5: Android Malware Analysis

APK File Structure and Android Basics


1. Introduction to APK File
An APK (Android Package Kit) is the file format used to distribute and install applications on
the Android operating system.

 Some applications come pre-installed on Android devices.


 Other apps can be downloaded from the Google Play Store.
 Apps downloaded from the Play Store are installed automatically.
 Apps from other sources must be installed manually (side-loading).

2. APK File Structure


An APK file contains multiple components required to run an Android application.

2.1 [Link]

 Contains compiled Java/Kotlin code.


 Converted into DEX (Dalvik Executable) format.
 Executed by the Android Runtime (ART).

2.2 [Link]

 Contains compiled resources.


 Includes:
o Strings
o Styles
o Layout references

2.3 lib/

 Contains native libraries (.so files).


 Used for specific device architectures such as:
o armeabi-v7a
o x86
 Improves performance for low-level operations.

2.4 res/

 Contains application resources like:


o Images
o XML layouts
o UI components
 These are not directly compiled into code but referenced via [Link].

2.5 assets/

 Contains raw files bundled with the app.


 Examples:
o HTML files
o Fonts
o JSON data
 Accessed using AssetManager.

2.6 [Link]

 Core configuration file of the application.


 Contains:
o App name and version
o Package name
o Permissions
o Activities, services, broadcast receivers

2.7 META-INF/

 Contains security and signature files.


 Ensures APK integrity and authenticity.
3. Android Security Model
Android follows a multi-layered security approach.

3.1 Linux Kernel Security

 Each app runs as a separate user (UID).


 Provides process isolation.

3.2 Application Sandbox

 Apps cannot access each other’s data.


 Each app has:
o Separate memory
o Private storage

3.3 Permission System

 Apps must request permissions (camera, storage, etc.).


 Two types:
o Normal permissions
o Dangerous permissions (require user approval)

3.4 Application Signing

 Every APK must be digitally signed.


 Ensures:
o Authenticity
o Integrity
o Secure updates
4. Android Root (Rooting)
Definition

Rooting is the process of gaining superuser (administrator) access on an Android device.

Advantages

 Full control over system


 Remove pre-installed apps
 Install custom ROMs
 Advanced customization

Disadvantages

 Security risks
 Voids warranty
 Possibility of device damage (bricking)

5. Spreading and Distribution of Android Apps


5.1 Official Distribution

 Through the Google Play Store


 Safer due to security checks

5.2 Third-Party Stores

 Less secure
 Higher malware risk

5.3 Side-loading

 Manual installation of APK files


 Common method for malware spread
5.4 Repackaged Apps

 Legitimate apps modified with malicious code

5.5 Phishing Attacks

 Fake apps or links trick users into installing malware

6. Introduction to Android Debugging Tools


6.1 Android Debug Bridge (ADB)

 Command-line tool to interact with Android devices

Functions:

 Install/uninstall apps
 Access device shell
 Debug logs

6.2 Android Studio Debugger

 GUI-based debugging tool

Features:

 Breakpoints
 Step execution
 Memory inspection

6.3 Logcat

 Displays system logs


 Useful for debugging errors

You might also like