* [78] ——. (2018, February) Selinux for android 8.0. [Online]. Available: https://source.android.com/security/selinux/images/SELinux_Treble.pdf
  * [79] Richard Haines. (2014, September) The selinux notebook. [Online]. Available: https://freecomputerbooks.com/books/The_SELinux_Notebook-4th_Edition.pdf
  * [80] Google. (2020) <permission>. [Online]. Available: https://developer.android.com/guide/topics/manifest/permission-element
  * [81] ——. (2020) <manifest>. [Online]. Available: https://developer.android.com/guide/topics/manifest/manifest-element
  * [82] Mirzaei, Omid and De Fuentes, José María and Tapiador, J. and González-Manzano, Lorena, “Androdet: An adaptive android obfuscation detector,” _Future Generation Computer Systems_ , vol. 90, 08 2018, code availabel at: https://github.com/OMirzaei/AndrODet. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0167739X18309312
  * [83] Google. apkanalyzer. [Online]. Available: https://developer.android.com/studio/command-line/apkanalyzer
  * [84] ——. (2020) Classyshark. [Online]. Available: https://github.com/google/android-classyshark
  * [85] Desnos, Anthony and Lantz, Patrik. (2011) Droidbox: An android application sandbox for dynamic analysis. [Online]. Available: https://github.com/pjlantz/droidbox
  * [86] Jeff Perkins and Michael Gordon, “Droidsafe,” Massachusetts Institute of Technology Cambridge United States, Tech. Rep., December 2016, code available at: https://github.com/MIT-PAC/droidsafe-src. [Online]. Available: https://apps.dtic.mil/sti/pdfs/AD1023840.pdf
  * [87] Bruno Morisson and Claudio Andre. (2018, Februar) Droidstatx. [Online]. Available: https://github.com/clviper/droidstatx
  * [88] Steven Arzt, “Static data flow analysis for android applications,” Ph.D. dissertation, Technische Universität, Darmstadt, 2017, code available at: https://github.com/secure-software-engineering/FlowDroid. [Online]. Available: http://tuprints.ulb.tu-darmstadt.de/5937/
  * [89] Tim Strazzere. (2015, March) Maldrolyzer. [Online]. Available: https://github.com/maldroid/maldrolyzer
  * [90] (2020) Medusa. [Online]. Available: https://github.com/Ch0pin/medusa
  * [91] (2016) Mobile-security-framework. [Online]. Available: https://github.com/MobSF/Mobile-Security-Framework-MobSF
  * [92] (2019) Quark engine. [Online]. Available: https://github.com/quark-engine/quark-engine
  * [93] Merlo, Alessio and Georgiu, Gabriel Claudiu, _RiskInDroid: Machine Learning-Based Risk Analysis on Android_. Springer International Publishing, 2017, pp. 538–552, code available at: https://github.com/ClaudiuGeorgiu/RiskInDroid. [Online]. Available: https://doi.org/10.1007/978-3-319-58469-0_36
  * [94] (2013) Smali-cfgs. [Online]. Available: https://github.com/EugenioDelfa/Smali-CFGs
  * [95] (2016) Super android analyzer. [Online]. Available: https://github.com/SUPERAndroidAnalyzer/super
  * [96] (2004) Virustotal. [Online]. Available: https://www.virustotal.com/
  * [97] (2020) Android aosp keys. [Online]. Available: https://github.com/wfairclough/android_aosp_keys
  * [98] Google. (2020) Compiling with jack for android 6.0–8.1. [Online]. Available: https://source.android.com/setup/build/jack
  * [99] (2020) Smali / backsmali github source page. [Online]. Available: https://github.com/JesusFreke/smali
  * [100] (2015) Aamo: Another android malware obfuscator. [Online]. Available: https://github.com/necst/aamo/
  * [101] (2019) Gda. [Online]. Available: https://github.com/charles2gan/GDA-android-reversing-Tool
  * [102] (2018) Jd-java decompiler. Code at https://github.com/java-decompiler/jd-gui. [Online]. Available: https://java-decompiler.github.io/
  * [103] (2020) Advobfuscator github source page. [Online]. Available: https://github.com/andrivet/ADVobfuscator
  * [104] (2020) Deoptfuscator: Automated deobfuscation of android bytecode using compilation optimization. [Online]. Available: https://github.com/Gyoonus/deoptfuscator
  * [105] P. Software. (2019) Jeb. [Online]. Available: https://www.pnfsoftware.com/index.php
  * [106] (2020) Allatori official page. [Online]. Available: http://www.allatori.com/
  * [107] (2020) Apkprotect github page. [Online]. Available: https://github.com/ijiami/ApkProtect
  * [108] (2020) Jeb. [Online]. Available: https://github.com/maiyao1988/deobf
  * [109] (2020) Appsuit official site. [Online]. Available: https://www.stealien.com/en/products/series
  * [110] (2020) Paranoid deobfuscator. [Online]. Available: https://github.com/giacomoferretti/paranoid-deobfuscator
  * [111] (2020) Preemptive official page. [Online]. Available: https://www.preemptive.com/products/dasho/overview
  * [112] (2020) Dexguard: Android app security. [Online]. Available: https://www.guardsquare.com/en/products/dexguard
  * [113] (2020) Dexprotector. [Online]. Available: https://dexprotector.com/
  * [114] (2020) Gemalto mobile security core, robust mobile software security, the corner stone of trusted digital identity. Official webpage: www.gemalto.com. [Online]. Available: https://www.thalesgroup.com/en/markets/digital-identity-and-security/government/identity/digital-identity-services/mobile-software-security
  * [115] (2020) Kiwisec official website. [Online]. Available: https://en.kiwisec.com/product/online-encrypt.html
  * [116] Simone Aonzo and Gabriel Claudiu Georgiu and Luca Verderame and Alessio Merlo, “Obfuscapk: An open-source black-box obfuscation tool for android apps,” _SoftwareX_ , vol. 11, p. 100403, 2020. [Online]. Available: http://www.sciencedirect.com/science/article/pii/S2352711019302791
  * [117] Pascal Junod and Julien Rinaldini and Johan Wehrli and Julie Michielin, “Obfuscator-LLVM – software protection for the masses,” in _Proceedings of the IEEE/ACM 1st International Workshop on Software Protection, SPRO’15, Firenze, Italy, May 19th, 2015_ , B. Wyseur, Ed. IEEE, 2015, pp. 3–9.
  * [118] (2020) Safeengine official site. [Online]. Available: http://www.safengine.com/
  * [119] (2020) Stringer java obfuscator. [Online]. Available: https://jfxstore.com/stringer/
  * [120] (2020) Promonshield official webpage. [Online]. Available: https://promon.co/
  * [121] (2020) Enigma. [Online]. Available: https://github.com/christopherney/Enigma
  * [122] (2016) Paranoid. [Online]. Available: https://github.com/MichaelRocks/paranoid
  * [123] (2017) simple-obfs for android. [Online]. Available: https://github.com/shadowsocks/simple-obfs-android
  * [124] (2016) Androidlibrary. [Online]. Available: https://github.com/StringCare/AndroidLibrary
  * [125] (2019) Aesjniencrypt. [Online]. Available: https://github.com/BruceWind/AESJniEncrypt
  * [126] (2019) Aabresguard. [Online]. Available: https://github.com/bytedance/AabResGuard
  * [127] (2018) Rotacsufbo. [Online]. Available: https://github.com/itemic/rotacsufbo
  * [128] (2018) Robfuscate. [Online]. Available: https://github.com/heruoxin/Robfuscate
  * [129] (2018) Andropgan. [Online]. Available: https://github.com/tianwaifeidie/AndrOpGAN
  * [130] (2017) Android-code-obfuscation-checker. [Online]. Available: https://github.com/SITSecureSoftwareDevelopmentTeam/AEON_Obfuscation
  * [131] (2020) Inter-procedural control flow graph obfuscation tool for android. [Online]. Available: https://github.com/Anttree1563/ICFGO
  * [132] Leo Sei. (2020) The path to dx deprecation. [Online]. Available: https://android-developers.googleblog.com/2020/02/the-path-to-dx-deprecation.html
  * [133] (2020) Yara github source page. [Online]. Available: https://github.com/VirusTotal/yara
  * [134] (2020) Virustotal report of the skinpackvivo.apk. [Online]. Available: https://www.virustotal.com/gui/file/06cc334dcd999c43d7db39db0511ee56121b7031e46396e2cbe92dc4fc5bb051/detection
  * [135] (2020) Malwarebytes forum: Android/adware.cootek. [Online]. Available: https://blog.malwarebytes.com/detections/android-adware-cootek/
  * [136] Corbin Davenport. (2019, July) Google ’temporarily disables’ dozens of cootek apps, including touchpal keyboard. [Online]. Available: https://www.androidpolice.com/2019/07/17/google-temporarily-disables-dozens-of-cootek-apps-including-touchpal-keyboard/
  * [137] (2015) Android obfuscation fingerprinter. [Online]. Available: https://github.com/veevelder/aof
  * [138] (2020) Android-code-obfuscation-checker. [Online]. Available: https://github.com/bobby-lin/Android-Code-Obfuscation-Checker
  * [139] (2020) Guardsquare official page for proguard. [Online]. Available: https://github.com/Guardsquare/proguard
  * [140] Ikram, Muhammad and Vallina-Rodriguez, Narseo and Seneviratne, Suranga and Kaafar, Mohamed Ali and Paxson, Vern, “An analysis of the privacy and security risks of android vpn permission-enabled apps,” in _Proceedings of the 2016 Internet Measurement Conference_ , ser. IMC ’16. New York, NY, USA: Association for Computing Machinery, 2016, p. 349–364. [Online]. Available: https://doi.org/10.1145/2987443.2987471
  * [141] Arp, Daniel and Spreitzenbarth, Michael and Hübner, Malte and Gascon, Hugo and Rieck, Konrad, “Drebin: Effective and explainable detection of android malware in your pocket,” 02 2014.
  * [142] _Open Source Similarity Digests DFRWS August 2016_ , August. [Online]. Available: https://github.com/fwaris/tlsh/blob/master/DFRWS_Similarity_Digests.pdf
  * [143] (2017) Lief. [Online]. Available: https://github.com/lief-project/LIEF
  * [144] Roussev, Vassil, “An evaluation of forensic similarity hashes,” _Digital Investigation_ , vol. 8, 08 2011.
  * [145] Python timecomplexity. [Online]. Available: https://wiki.python.org/moin/TimeComplexity
  * [146] Flask restx. [Online]. Available: https://github.com/python-restx/flask-restx
  * [147] Swagger.io official page. [Online]. Available: https://swagger.io/
  * [148] Gunicorn. [Online]. Available: https://gunicorn.org/
  * [149] Gevent. [Online]. Available: http://www.gevent.org/
  * [150] Mongoengine. [Online]. Available: http://mongoengine.org/
  * [151] Pythonrq. [Online]. Available: https://python-rq.org/
  * [152] Martijn Grooten. (2015, November) Optimizing ssdeep for use at scale. VirsuBulletin. [Online]. Available: https://www.virusbulletin.com/uploads/pdf/magazine/2015/vb201511-ssDeep.pdf
  * [153] Andrew Tridgell and Paul Mackerras. (1996, June) The rsync algorithm. [Online]. Available: https://openresearch-repository.anu.edu.au/bitstream/1885/40765/3/TR-CS-96-05.pdf
  * [154] (2021, January) Polyglot github repository. [Online]. Available: https://github.com/aboSamoor/polyglot
  * [155] (2021, January) Chardet: The universal character encoding detector - github repository. [Online]. Available: https://github.com/chardet/chardet
  * [156] Ngoc-Tu Chau and Souhwan Jung, “Dynamic analysis with android container: Challenges and opportunities,” _Digital Investigation_ , vol. 27, pp. 38 – 46, 2018. [Online]. Available: http://www.sciencedirect.com/science/article/pii/S1742287618301257
  * [157] (2021, January) Android emulator container scripts. [Online]. Available: https://github.com/google/android-emulator-container-scripts
  * [158] Google. Start the emulator from the command line. [Online]. Available: https://developer.android.com/studio/run/emulator-commandline
  * [159] Saudel, Florent and Salwan, Jonathan, “Triton: A dynamic symbolic execution framework,” in _Symposium sur la sécurité des technologies de l’information et des communications_ , ser. SSTIC, Rennes, France, July 2015, pp. 31–54, code available at: https://github.com/JonathanSalwan/Triton.
  * [160] Dynamorio. [Online]. Available: https://dynamorio.org/
  * [161] Valgrind. [Online]. Available: https://www.valgrind.org/
  * [162] (2020) Dexcalibur gtihub repository. [Online]. Available: https://github.com/FrenchYeti/dexcalibur
  * [163] (2020) Rms-runtime-mobile-securit github repository. [Online]. Available: https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security
  * [164] (2021, January) Adb shell github repository. [Online]. Available: https://github.com/JeffLIrion/adb_shell
  * [165] Google. (2020, October) Android 11 release notes. [Online]. Available: https://source.android.com/setup/start/android-11-release

###### List of Figures

  1. 2.1 Overview of ODM-specific components. Image source [44]
  2. 2.2 Overview of the extraction process.
  3. 2.3 Android Verified Boot Architecture.
  4. 2.4 Process of modifying an existing Android firmware.
  5. 2.5 Overview of the standard app signing process.
  6. 2.6 Example build process for system apps.
  7. 2.7 Overview of Androids access levels. Image source [80]
  8. 3.1 Android10: Permission usage by protection level.
  9. 3.2 Android10: Total permission usage grouped by base permissions.
  10. 3.3 Android10: Percentage of apps that request at least one 3rd party permission. True = Requests at least one 3rd party permission, False = requests no 3rd party permission.
  11. 3.4 Android10: Percentage of apps that declare at least one permission in their AndroidManifest.xml. True = Declares at least one permission, False = declares no permission.
  12. 3.5 Android 9: Top 30 most used permissions.
  13. 3.6 Android 9: Top 30 most used 3rd party permissions.
  14. 3.7 Android 8: Distribution of the dangerous protection level.
  15. 3.8 Android 8: Distribution of the signature protection level.
  16. 3.9 Android 8: Distribution of the normal protection level.
  17. 3.10 TLSH digest generation process. Image source [142]
  18. 3.11 TLSH hashing process in FirmwareDroid.
  19. 3.12 Hit- and missed- rate for 5’000 TLSH hashes with our filtering algorithm.
  20. 3.13 Number of TLSH comparisons
  21. 3.14 Estimated time necessary to compute the TLSH lookup table and to create clusters for 5000 files.
  22. 4.1 Overview of the docker environment.
  23. 4.2 Process of string meta data enrichment.
  24. 1 Android 9: Top 100 most used permissions.

###### List of Tables

  1. 1.1 Overview of search terms used for our literature search in Appendix H.
  2. 1.2 List of topic related conference talks.
  3. 2.1 Overview of Android OS vendors and the checked links.
  4. 2.2 List of websites offering Android firmware. Note: the crawled number of bytes is without duplicates links.
  5. 2.3 AvbVBMetaImageHeader struct from avb_meta_image.h. Table source: [56]
  6. 3.1 Results of the tools evaluation.
  7. 3.2 Number of firmware archives by version.
  8. 3.3 Overview of unique values in brand, manufacturer, and model build properties by Android version
  9. 3.4 Count of detected brands  for Android 8 and 9.
  10. 3.5 Count of detected manufacturers  for Android 8 and 9.
  11. 3.6 Detected numbers of security relevant build properties.
  12. 3.7 Number of unique certificates in our database.
  13. 3.8 Top ten most used certificates for Android 8, 9, and 10 in our database.
  14. 3.9 Incomplete list of compilers, decompilers, de-/obfuscators and un-/packers for Android.
  15. 3.10 APKiD scan result for compilers.
  16. 3.11 APKiD obfuscators scan results for different Android versions.
  17. 3.12 APKiD scan result for packers.
  18. 3.13 APKiD scan result for Anti-VM checks.
  19. 3.14 APKiD scan result for Anti-Disassembly checks.
  20. 3.15 Androwarn privacy report example for Android10 firmware.
  21. 3.16 Androwarn categories grouped by unique apps. *Note: Only one MD5 hash shown to save space.
  22. 3.17 Androwarn results of UNIX command execution on Android10 firmware.
  23. 3.18 Androwarn UNIX execution detection results on Android10 firmware.
  24. 3.19 Androwarn native library detection examples on Android10 firmware. Note: Only some examples are shown. A complete list of all detected native libraries for Android10 is available in Appendix F.
  25. 3.20 Androwarn report results for Android 7, 8, 9 and 10 for the location, audio and video category.
  26. 3.21 VirusTotal scanning result of Android apps.
  27. 3.22 Detected malware for Android 8, 9, and 10 with APKiD compiler result. *Note: We provide only one MD5 hash to save space.
  28. 3.23 Malware samples with corresponding firmware brand and build key.
  29. 3.24 TLSH digest examples.
  30. 3.25 Performance measurement for 5000 TLSH hashes with variable band width thresholds.
  31. 3.26 Performance measurement for 10’000 TLSH hashes with variable band width thresholds.
  32. 3.27 Measurements for the missed rate with increasing number of files.
  33. 4.1 List of REST API endpoints with description.
  34. 1 Androwarn native code loading report for Android10 firmware.
  35. 2 Complete List of FirmareDroid REST API endpoints with description.
  36. 3

###### Listings

  1. 1 Contens of an exmple build.prop file.
  2. 2 Overview of avb descriptor structs from [56].
  3. 3 Descriptor validation found in the load_and_verify_vbmeta method. filename: avb_slot_verify.c
  4. 4 Lines 48 to 55 from android_filesystem_config.h. Source [74]
  5. 5 Example of a xml permission defintion and usage.
  6. 6 Python code to generate the TLSH lookup table.
  7. 7 Python code to find candidate hashes.
  8. 8 AVB avb_slot_verify from avb_slot_verify.c. Code source [56]
  9. 9 AVB hash-tree verification method in python. Code source [56] \- filename: avbtool.py
  10. 10 AVB hash-tree generation method in python. Code source [56] \- filename: avbtool.py
  11. 11 AVBTool example output of info_image.
  12. 12 Example output of the avb meta info_image command.

## Appendix

###  D Android Verified Boot code snippets and examples

⬇

1250AvbSlotVerifyResult avb_slot_verify(AvbOps* ops,

1251 const char* const* requested_partitions,

1252 const char* ab_suffix,

1253 AvbSlotVerifyFlags flags,

1254 AvbHashtreeErrorMode hashtree_error_mode,

1255 AvbSlotVerifyData** out_data) {

1256 AvbSlotVerifyResult ret;

1257 AvbSlotVerifyData* slot_data = NULL;

1258 AvbAlgorithmType algorithm_type = AVB_ALGORITHM_TYPE_NONE;

1259 bool using_boot_for_vbmeta = false;

1260 AvbVBMetaImageHeader toplevel_vbmeta;

1261 bool allow_verification_error =

1262 (flags & AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR);

1263 AvbCmdlineSubstList* additional_cmdline_subst = NULL;

1264 /* Fail early if we’re missing the AvbOps needed for slot verification.
*/

1265 avb_assert(ops->read_is_device_unlocked != NULL);

1266 avb_assert(ops->read_from_partition != NULL);

1267 avb_assert(ops->get_size_of_partition != NULL);

1268 avb_assert(ops->read_rollback_index != NULL);

1269 avb_assert(ops->get_unique_guid_for_partition != NULL);

1270 if (out_data != NULL) {

1271 *out_data = NULL;

1272 }

1273 /* Allowing dm-verity errors defeats the purpose of verified boot so

1274 * only allow this if set up to allow verification errors

1275 * (e.g. typically only UNLOCKED mode).

1276 */

1277 if (hashtree_error_mode == AVB_HASHTREE_ERROR_MODE_LOGGING &&

1278 !allow_verification_error) {

1279 ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_ARGUMENT;

1280 goto fail;

1281 }

1282 /* Make sure passed-in AvbOps support persistent values if

1283 * asking for libavb to manage verity state.

1284 */

1285 if (hashtree_error_mode ==
AVB_HASHTREE_ERROR_MODE_MANAGED_RESTART_AND_EIO) {

1286 if (ops->read_persistent_value == NULL ||

1287 ops->write_persistent_value == NULL) {

1288 avb_error(

1289 "Persistent values required for "

1290 "AVB_HASHTREE_ERROR_MODE_MANAGED_RESTART_AND_EIO "

1291 "but are not implemented in given AvbOps.\n");

1292 ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_ARGUMENT;

1293 goto fail;

1294 }

1295 }

1296 /* Make sure passed-in AvbOps support verifying public keys and getting

1297 * rollback index location if not using a vbmeta partition.

1298 */

1299 if (flags & AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION) {

1300 if (ops->validate_public_key_for_partition == NULL) {

1301 avb_error(

1302 "AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION was passed but the "

1303 "validate_public_key_for_partition() operation isn’t implemented.\n");

1304 ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_ARGUMENT;

1305 goto fail;

1306 }

1307 } else {

1308 avb_assert(ops->validate_vbmeta_public_key != NULL);

1309 }

1310 slot_data = avb_calloc(sizeof(AvbSlotVerifyData));

1311 if (slot_data == NULL) {

1312 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;

1313 goto fail;

1314 }

1315 slot_data->vbmeta_images =

1316 avb_calloc(sizeof(AvbVBMetaData) * MAX_NUMBER_OF_VBMETA_IMAGES);

1317 if (slot_data->vbmeta_images == NULL) {

1318 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;

1319 goto fail;

1320 }

1321 slot_data->loaded_partitions =

1322 avb_calloc(sizeof(AvbPartitionData) * MAX_NUMBER_OF_LOADED_PARTITIONS);

1323 if (slot_data->loaded_partitions == NULL) {

1324 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;

1325 goto fail;

1326 }

1327 additional_cmdline_subst = avb_new_cmdline_subst_list();

1328 if (additional_cmdline_subst == NULL) {

1329 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;

1330 goto fail;

1331 }

1332 if (flags & AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION) {

1333 if (requested_partitions == NULL || requested_partitions[0] == NULL) {

1334 avb_fatal(

1335 "Requested partitions cannot be empty when using "

1336 "AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION");

1337 ret = AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_ARGUMENT;

1338 goto fail;

1339 }

1340 /* No vbmeta partition, go through each of the requested partitions... */

1341 for (size_t n = 0; requested_partitions[n] != NULL; n++) {

1342 ret = load_and_verify_vbmeta(ops,

1343 requested_partitions,

1344 ab_suffix,

1345 flags,

1346 allow_verification_error,

1347 0 /* toplevel_vbmeta_flags */,

1348 0 /* rollback_index_location */,

1349 requested_partitions[n],

1350 avb_strlen(requested_partitions[n]),

1351 NULL /* expected_public_key */,

1352 0 /* expected_public_key_length */,

1353 slot_data,

1354 &algorithm_type,

1355 additional_cmdline_subst);

1356 if (!allow_verification_error && ret != AVB_SLOT_VERIFY_RESULT_OK) {

1357 goto fail;

1358 }

1359 }

1360 } else {

1361 /* Usual path, load "vbmeta"... */

1362 ret = load_and_verify_vbmeta(ops,

1363 requested_partitions,

1364 ab_suffix,

1365 flags,

1366 allow_verification_error,

1367 0 /* toplevel_vbmeta_flags */,

1368 0 /* rollback_index_location */,

1369 "vbmeta",

1370 avb_strlen("vbmeta"),

1371 NULL /* expected_public_key */,

1372 0 /* expected_public_key_length */,

1373 slot_data,

1374 &algorithm_type,

1375 additional_cmdline_subst);

1376 if (!allow_verification_error && ret != AVB_SLOT_VERIFY_RESULT_OK) {

1377 goto fail;

1378 }

1379 }

1380 if (!result_should_continue(ret)) {

1381 goto fail;

1382 }

1383 /* If things check out, mangle the kernel command-line as needed. */

1384 if (!(flags & AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION)) {

1385 if (avb_strcmp(slot_data->vbmeta_images[0].partition_name, "vbmeta") !=
0) {

1386 avb_assert(

1387 avb_strcmp(slot_data->vbmeta_images[0].partition_name, "boot") == 0);

1388 using_boot_for_vbmeta = true;

1389 }

1390 }

1391 /* Byteswap top-level vbmeta header since we’ll need it below. */

1392 avb_vbmeta_image_header_to_host_byte_order(

1393 (const AvbVBMetaImageHeader*)slot_data->vbmeta_images[0].vbmeta_data,

1394 &toplevel_vbmeta);

1395 /* Fill in |ab_suffix| field. */

1396 slot_data->ab_suffix = avb_strdup(ab_suffix);

1397 if (slot_data->ab_suffix == NULL) {

1398 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;

1399 goto fail;

1400 }

1401 /* If verification is disabled, we are done ... we specifically

1402 * don’t want to add any androidboot.* options since verification

1403 * is disabled.

1404 */

1405 if (toplevel_vbmeta.flags & AVB_VBMETA_IMAGE_FLAGS_VERIFICATION_DISABLED)
{

1406 /* Since verification is disabled we didn’t process any

1407 * descriptors and thus there’s no cmdline... so set root= such

1408 * that the system partition is mounted.

1409 */

1410 avb_assert(slot_data->cmdline == NULL);

1411 // Devices with dynamic partitions won’t have system partition.

1412 // Instead, it has a large super partition to accommodate *.img files.

1413 // See b/119551429 for details.

1414 if (has_system_partition(ops, ab_suffix)) {

1415 slot_data->cmdline =

1416 avb_strdup("root=PARTUUID=$(ANDROID_SYSTEM_PARTUUID)");

1417 } else {

1418 // The |cmdline| field should be a NUL-terminated string.

1419 slot_data->cmdline = avb_strdup("");

1420 }

1421 if (slot_data->cmdline == NULL) {

1422 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;

1423 goto fail;

1424 }

1425 } else {

1426 /* If requested, manage dm-verity mode... */

1427 AvbHashtreeErrorMode resolved_hashtree_error_mode = hashtree_error_mode;

1428 if (hashtree_error_mode ==

1429 AVB_HASHTREE_ERROR_MODE_MANAGED_RESTART_AND_EIO) {

1430 AvbIOResult io_ret;

1431 io_ret = avb_manage_hashtree_error_mode(

1432 ops, flags, slot_data, &resolved_hashtree_error_mode);

1433 if (io_ret != AVB_IO_RESULT_OK) {

1434 ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO;

1435 if (io_ret == AVB_IO_RESULT_ERROR_OOM) {

1436 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;

1437 }

1438 goto fail;

1439 }

1440 }

1441 slot_data->resolved_hashtree_error_mode = resolved_hashtree_error_mode;

1442 /* Add options... */

1443 AvbSlotVerifyResult sub_ret;

1444 sub_ret = avb_append_options(ops,

1445 flags,

1446 slot_data,

1447 &toplevel_vbmeta,

1448 algorithm_type,

1449 hashtree_error_mode,

1450 resolved_hashtree_error_mode);

1451 if (sub_ret != AVB_SLOT_VERIFY_RESULT_OK) {

1452 ret = sub_ret;

1453 goto fail;

1454 }

1455 }

1456 /* Substitute $(ANDROID_SYSTEM_PARTUUID) and friends. */

1457 if (slot_data->cmdline != NULL && avb_strlen(slot_data->cmdline) != 0) {

1458 char* new_cmdline;

1459 new_cmdline = avb_sub_cmdline(ops,

1460 slot_data->cmdline,

1461 ab_suffix,

1462 using_boot_for_vbmeta,

1463 additional_cmdline_subst);

1464 if (new_cmdline != slot_data->cmdline) {

1465 if (new_cmdline == NULL) {

1466 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;

1467 goto fail;

1468 }

1469 avb_free(slot_data->cmdline);

1470 slot_data->cmdline = new_cmdline;

1471 }

1472 }

1473 if (out_data != NULL) {

1474 *out_data = slot_data;

1475 } else {

1476 avb_slot_verify_data_free(slot_data);

1477 }

1478 avb_free_cmdline_subst_list(additional_cmdline_subst);

1479 additional_cmdline_subst = NULL;

1480 if (!allow_verification_error) {

1481 avb_assert(ret == AVB_SLOT_VERIFY_RESULT_OK);

1482 }

1483 return ret;

1484fail:

1485 if (slot_data != NULL) {

1486 avb_slot_verify_data_free(slot_data);

1487 }

1488 if (additional_cmdline_subst != NULL) {

1489 avb_free_cmdline_subst_list(additional_cmdline_subst);

1490 }

1491 return ret;

1492}

Listing 8: AVB avb_slot_verify from avb_slot_verify.c. Code source [56]

⬇

1class AvbHashtreeDescriptor(AvbDescriptor):

2 def verify(self, image_dir, image_ext, expected_chain_partitions_map,

3 image_containing_descriptor, accept_zeroed_hashtree):

4 """Verifies contents of the descriptor - used in verify_image sub-command.

5

6 Arguments:

7 image_dir: The directory of the file being verified.

8 image_ext: The extension of the file being verified (e.g. ’.img’).

9 expected_chain_partitions_map: A map from partition name to the

10 tuple (rollback_index_location, key_blob).

11 image_containing_descriptor: The image the descriptor is in.

12 accept_zeroed_hashtree: If True, don’t fail if hashtree or FEC data is

13 zeroed out.

14

15 Returns:

16 True if the descriptor verifies, False otherwise.

17 """

18 if not self.partition_name:

19 image_filename = image_containing_descriptor.filename

20 image = image_containing_descriptor

21 else:

22 image_filename = os.path.join(image_dir, self.partition_name + image_ext)

23 image = ImageHandler(image_filename, read_only=True)

24 # Generate the hashtree and checks that it matches what’s in the file.

25 digest_size = len(hashlib.new(self.hash_algorithm).digest())

26 digest_padding = round_to_pow2(digest_size) - digest_size

27 (hash_level_offsets, tree_size) = calc_hash_level_offsets(self.image_size,

28 self.data_block_size, digest_size + digest_padding)

29 root_digest, hash_tree = generate_hash_tree(image, self.image_size,

30 self.data_block_size,

31 self.hash_algorithm, self.salt,

32 digest_padding,

33 hash_level_offsets,

34 tree_size)

35 # The root digest must match unless it is not embedded in the descriptor.

36 if self.root_digest and root_digest != self.root_digest:

37 sys.stderr.write(’hashtree of {} does not match descriptor\n’.

38 format(image_filename))

39 return False

40 # ... also check that the on-disk hashtree matches

41 image.seek(self.tree_offset)

42 hash_tree_ondisk = image.read(self.tree_size)

43 is_zeroed = (self.tree_size == 0) or (hash_tree_ondisk[0:8] == b’ZeRoHaSH’)

44 if is_zeroed and accept_zeroed_hashtree:

45 print(’{}: skipping verification since hashtree is zeroed and ’

46 ’–accept_zeroed_hashtree was given’

47 .format(self.partition_name))

48 else:

49 if hash_tree != hash_tree_ondisk:

50 sys.stderr.write(’hashtree of {} contains invalid data\n’.

51 format(image_filename))

52 return False

53 print(’{}: Successfully verified {} hashtree of {} for image of {} bytes’

54 .format(self.partition_name, self.hash_algorithm, image.filename,

55 self.image_size))

56 # TODO(zeuthen): we could also verify that the FEC stored in the image is

57 # correct but this a) currently requires the ’fec’ binary; and b) takes a

58 # long time; and c) is not strictly needed for verification purposes as

59 # we’ve already verified the root hash.

60 return True

Listing 9: AVB hash-tree verification method in python. Code source [56] \-
filename: avbtool.py

⬇

1

2def generate_hash_tree(image, image_size, block_size, hash_alg_name, salt,

3 digest_padding, hash_level_offsets, tree_size):

4 """Generates a Merkle-tree for a file.

5

6 Arguments:

7 image: The image, as a file.

8 image_size: The size of the image.

9 block_size: The block size, e.g. 4096.

10 hash_alg_name: The hash algorithm, e.g. ’sha256’ or ’sha1’.

11 salt: The salt to use.

12 digest_padding: The padding for each digest.

13 hash_level_offsets: The offsets from calc_hash_level_offsets().

14 tree_size: The size of the tree, in number of bytes.

15

16 Returns:

17 A tuple where the first element is the top-level hash as bytes and the

18 second element is the hash-tree as bytes.

19 """

20 hash_ret = bytearray(tree_size)

21 hash_src_offset = 0

22 hash_src_size = image_size

23 level_num = 0

24 while hash_src_size > block_size:

25 level_output_list = []

26 remaining = hash_src_size

27 while remaining > 0:

28 hasher = hashlib.new(hash_alg_name, salt)

29 # Only read from the file for the first level - for subsequent

30 # levels, access the array we’re building.

31 if level_num == 0:

32 image.seek(hash_src_offset + hash_src_size - remaining)

33 data = image.read(min(remaining, block_size))

34 else:

35 offset = hash_level_offsets[level_num - 1] + hash_src_size - remaining

36 data = hash_ret[offset:offset + block_size]

37 hasher.update(data)

38

39 remaining -= len(data)

40 if len(data) < block_size:

41 hasher.update(b’\0’ * (block_size - len(data)))

42 level_output_list.append(hasher.digest())

43 if digest_padding > 0:

44 level_output_list.append(b’\0’ * digest_padding)

45

46 level_output = b”.join(level_output_list)

47

48 padding_needed = (round_to_multiple(len(level_output), block_size) -

49 len(level_output))

50 level_output += b’\0’ * padding_needed

51

52 # Copy level-output into resulting tree.

53 offset = hash_level_offsets[level_num]

54 hash_ret[offset:offset + len(level_output)] = level_output

55

56 # Continue on to the next level.

57 hash_src_size = len(level_output)

58 level_num += 1

59

60 hasher = hashlib.new(hash_alg_name, salt)

61 hasher.update(level_output)

62 return hasher.digest(), bytes(hash_ret)

Listing 10: AVB hash-tree generation method in python. Code source [56] \-
filename: avbtool.py

⬇

1Minimum libavb version: 1.0

2Header Block: 256 bytes

3Authentication Block: 320 bytes

4Auxiliary Block: 2048 bytes

5Public key (sha1): ad8569837cc06521720a35357475f87283b59234

6Algorithm: SHA256\_RSA2048

7Rollback Index: 1546646400

8Flags: 0

9Rollback Index Location: 0

10Release String: ’avbtool 1.1.0’

11Descriptors:

12Chain Partition descriptor:

13Partition Name: system

14Rollback Index Location: 1

15Public key (sha1): 46b77506c847920e3f00074c9ae005c96b6f416f

16Hash descriptor:

17Image Size: 30662656 bytes

18Hash Algorithm: sha256

19Partition Name: boot

20Salt:

215af8a8b131ed8a1f927e2c576fa26b37723ed600f930239a4457ba5fe50c4626

22Digest:

236d474128d079f95b9cc40c556f81bfc3e83697be1878146d8869acf8ccd9602d

24Flags: 0

25Hashtree descriptor:

26Version of dm-verity: 1

27Image Size: 309526528 bytes

28Tree Offset: 309526528

29Tree Size: 2445312 bytes

30Data Block Size: 4096 bytes

31Hash Block Size: 4096 bytes

32FEC num roots: 2

33FEC offset: 311971840

34FEC size: 2473984 bytes

35Hash Algorithm: sha1

36Partition Name: product

37Salt:

385af8a8b131ed8a1f927e2c576fa26b37723ed600f930239a4457ba5fe50c4626

39Root Digest: ded1d335ee0a135137cb95159764f2edd21f9319

40Flags: 0

41Hashtree descriptor:

42Version of dm-verity: 1

43Image Size: 792514560 bytes

44Tree Offset: 792514560

45Tree Size: 6246400 bytes

46Data Block Size: 4096 bytes

47Hash Block Size: 4096 bytes

48FEC num roots: 2

49FEC offset: 798760960

50FEC size: 6316032 bytes

51Hash Algorithm: sha1

52Partition Name: vendor

53Salt:

545af8a8b131ed8a1f927e2c576fa26b37723ed600f930239a4457ba5fe50c4626

55Root Digest: d225f7c4347cb4535254025d21bc7b751e2fa216

56Flags: 0

57Hash descriptor:

58Image Size: 1745968 bytes

59Hash Algorithm: sha256

60Partition Name: dtbo

61Salt:

625af8a8b131ed8a1f927e2c576fa26b37723ed600f930239a4457ba5fe50c4626

63Digest:

64155003d6e8a6b9b16e7911773d5e148903670885bdd94391d043de331044bcd7

65Flags: 0

Listing 11: AVBTool example output of info_image.

⬇

1./avbtool info_image –image ./1a.201005.006/vbmeta.img

2Minimum libavb version: 1.0

3Header Block: 256 bytes

4Authentication Block: 576 bytes

5Auxiliary Block: 4096 bytes

6Public key (sha1): e8162d81621cc011ad2dc2cf10880f955500c7e9

7Algorithm: SHA256_RSA4096

8Rollback Index: 1601856000

9Flags: 0

10Rollback Index Location: 0

11Release String: ’avbtool 1.1.0’

12Descriptors:

13Chain Partition descriptor:

14Partition Name: vbmeta_system

15Rollback Index Location: 1

16Public key (sha1): e8162d81621cc011ad2dc2cf10880f955500c7e9

17Prop: com.android.build.product.fingerprint ->

18’google/sunfish/sunfish:11/RP1A.201005.006/6828489:user/dev-keys’

19Prop: com.android.build.product.os_version -> ’11’

20Prop: com.android.build.product.security_patch -> ’2020-10-05’

21Prop: com.android.build.vendor.fingerprint ->

22’google/sunfish/sunfish:11/RP1A.201005.006/6828489:user/release-keys’

23Prop: com.android.build.vendor.os_version -> ’11’

24Prop: com.android.build.vendor.security_patch -> ’2020-10-05’

25Prop: com.android.build.boot.fingerprint ->

26’google/sunfish/sunfish:11/RP1A.201005.006/6828489:user/release-keys’

27Prop: com.android.build.boot.os_version -> ’11’

28Prop: com.android.build.boot.security_patch -> ’2020-10-05’

29Prop: com.android.build.dtbo.fingerprint ->

30’google/sunfish/sunfish:11/RP1A.201005.006/6828489:user/release-keys’

31Hash descriptor:

32Image Size: 33304576 bytes

33Hash Algorithm: sha256

34Partition Name: boot

35Salt: ea0769f822eed4e982da4d3d69b16b2bacb1dc1441d6db233eb42fc2ae401b22

36Digest:b5a534425ddb667adbb212de571774c672f5458e6a0b2524dc47ef05379435a2

37Flags: 0

38Hash descriptor:

39Image Size: 1997440 bytes

40Hash Algorithm: sha256

41Partition Name: dtbo

42Salt: 867b5747d12fe086925db995e189fe3be8ae3d34bf867284ad5ddac02ba0a15a

43Digest:c3dc64ad78723a1020120e8b3e821897972d2a3b03c3ca8d197538660fc5ecbc

44Flags: 0

45Hashtree descriptor:

46Version of dm-verity: 1

47Image Size: 2011947008 bytes

48Tree Offset: 2011947008

49Tree Size: 15847424 bytes

50Data Block Size: 4096 bytes

51Hash Block Size: 4096 bytes

52FEC num roots: 2

53FEC offset: 2027794432

54FEC size: 16031744 bytes

55Hash Algorithm: sha1

56Partition Name: product

57Salt: 56cf103d96aeb05ebee8cc346dbecac716e765f6e720e8fb7e6890d3cb66d9ec

58Root Digest: ca59a628aea04700db24de76c97502fa7c7b91c7

59Flags: 0

60Hashtree descriptor:

61Version of dm-verity: 1

62Image Size: 541900800 bytes

63Tree Offset: 541900800

64Tree Size: 4276224 bytes

65Data Block Size: 4096 bytes

66Hash Block Size: 4096 bytes

67FEC num roots: 2

68FEC offset: 546177024

69FEC size: 4325376 bytes

70Hash Algorithm: sha1

71Partition Name: vendor

72Salt: 56cf103d96aeb05ebee8cc346dbecac716e765f6e720e8fb7e6890d3cb66d9ec

73Root Digest: c825b8f0ea955bb543d49be412d7079e8bc92d42

74Flags: 0

Listing 12: Example output of the avb meta info_image command.

###  E AndroGuard Permission Statistics

Figure 1: Android 9: Top 100 most used permissions.

###  F Androwarn Native Code Loading

Table 1: Androwarn native code loading report for Android10 firmware. Androwarn message |  App count
---|---
This application loads a native library |  530
This application loads a native library: ’networkstackutilsjni’ |  136
This application loads a native library: ’Lcom/qualcomm/ltebc/LTEBCFactory;->getInstance()Lcom/qualcomm/ltebc/LTEBCFactory;’ |  106
This application loads a native library: ’printspooler.jni’ |  136
This application loads a native library: ’imscamera.jni’ |  92
This application loads a native library: ’imsmedia.jni’ |  92
This application loads a native library: ’jni.pacprocessor’ |  136
This application loads a native library: ’nfc.nci.jni’ |  136
This application loads a native library: ’wfds’ |  136
This application loads a native library: ’bluetooth.jni’ |  136
This application loads a native library: ’Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;’ |  170
This application loads a native library: ’motricity’ |  34
This application loads a native library: ’Lorg/chromium/net/impl/CronetLibraryLoader;->a(Ljava/lang/Runnable;)V’ |  34
This application loads a native library: ’brotli’ |  34
This application loads a native library: ’conscrypt.gmscore.jni’ |  68
This application loads a native library: ’conscrypt.jni’ |  68
This application loads a native library: ’game.sdk.device.info.jni’ |  34
This application loads a native library: ’gvr’ |  204
This application loads a native library: ’tensorflowlite.flex.jni’ |  68
This application loads a native library: ’tensorflowlite.jni’ |  68
This application loads a native library: ’AppDataSearch’ |  34
This application loads a native library: ’curve25519’ |  68
This application loads a native library: ’inertial-anchor-jni’ |  34
This application loads a native library: ’vcdiffjni’ |  34
This application loads a native library: ’wearable-selector’ |  34
This application loads a native library: ’Landroid/os/ConditionVariable;->open()V’ |  66
This application loads a native library: ’barhopper’ |  124
This application loads a native library: ’Lorg/chromium/net/impl/k;->a()Lorg/chromium/net/impl/cm;’ |  34
This application loads a native library: ’android.dtmf’ |  34
This application loads a native library: ’arcore.sdk.jni’ |  34
This application loads a native library: ’framesequence’ |  130
This application loads a native library: ’google.speech.micro.jni’ |  34
This application loads a native library: ’lens.image.util’ |  34
This application loads a native library: ’offline.actions.jni’ |  34
This application loads a native library: ’opuscodec’ |  34
This application loads a native library: ’sbcdecoder.jni’ |  34
This application loads a native library: ’sense’ |  26
This application loads a native library: ’elmyra’ |  34
This application loads a native library: ’dmengine’ |  34
This application loads a native library: ’Brella’ |  34
This application loads a native library: ’Ljava/util/Iterator;->next()Ljava/lang/Object;’ |  34
This application loads a native library: ’aiai-annotators’ |  34
This application loads a native library: ’cpuutils’ |  34
This application loads a native library: ’ocr’ |  34
This application loads a native library: ’particle-extractor.jni’ |  34
This application loads a native library: ’textclassifier3.jni.aosp’ |  34
This application loads a native library: ’textclassifier3.jni.aosp-size’ |  34
This application loads a native library: ’textclassifier3.jni.gmscore’ |  34
This application loads a native library: ’textclassifier3.jni.tclib’ |  34
This application loads a native library: ’tensorflow.jni’ |  68
This application loads a native library: ’flash’ |  34
This application loads a native library: ’sketchology.native’ |  34
This application loads a native library: ’Lasrp;->c()Laspa;’ |  18
This application loads a native library: ’Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V’ |  28
This application loads a native library: ’filterframework.jni’ |  68
This application loads a native library: ’flacJNI’ |  34
This application loads a native library: ’native’ |  68
This application loads a native library: ’oliveoil’ |  62
This application loads a native library: ’tonemap’ |  28
This application loads a native library: ’chromium.android.linker’ |  68
This application loads a native library: ’webviewchromium.plat.support’ |  64
This application loads a native library: ’GcamDepsJni’ |  22
This application loads a native library: ’RSSupport’ |  34
This application loads a native library: ’RSSupportIO’ |  34
This application loads a native library: ’SeeDarkJni’ |  34
This application loads a native library: ’aspect.scorer.jni’ |  34
This application loads a native library: ’blasV8’ |  34
This application loads a native library: ’bufferflinger’ |  34
This application loads a native library: ’cyclops’ |  34
This application loads a native library: ’entity-clusterer.jni’ |  22
This application loads a native library: ’halide.hexagon.host’ |  34
This application loads a native library: ’halide.hexagon.host.pixel1’ |  30
This application loads a native library: ’image’ |  22
This application loads a native library: ’lightcycle’ |  34
This application loads a native library: ’link.engine.jni’ |  22
This application loads a native library: ’refocus’ |  30
This application loads a native library: ’rsjni’ |  34
This application loads a native library: ’semanticlift-annotators’ |  14
This application loads a native library: ’smartcapture.native’ |  34
This application loads a native library: ’textclassifier.jni’ |  22
This application loads a native library: ’textclassifier.jni.noicu’ |  22
This application loads a native library: ’vision.face.jni’ |  30
This application loads a native library: ’giftranscode’ |  34
This application loads a native library: ’hobbes.jni’ |  34
This application loads a native library: ’language.detector.jni’ |  34
This application loads a native library: ’sensitive.classifier.jni’ |  34
This application loads a native library: ’gdx’ |  34
This application loads a native library: ’wallpapers-breel-jni’ |  26
This application loads a native library: ’WVphoneAPI’ |  34
This application loads a native library: ’wvmediadrm’ |  34
This application loads a native library: ’drishti.jni.native’ |  34
This application loads a native library: ’eko’ |  34
This application loads a native library: ’gvr.audio’ |  34
This application loads a native library: ’opusJNI’ |  34
This application loads a native library: ’vpx’ |  34
This application loads a native library: ’vpxJNI’ |  34
This application loads a native library: ’webp.android’ |  34
This application loads a native library: ’bitmap.parcel’ |  34
This application loads a native library: ’cello.native’ |  34
This application loads a native library: ’foxit’ |  34
This application loads a native library: ’facenet’ |  34
This application loads a native library: ’borders.scone.leveldb.jni’ |  12
This application loads a native library: ’gpu-retouching-jni’ |  12
This application loads a native library: ’geswallpapers-jni’ |  8
This application loads a native library: ’Laemk;->c()Ljava/lang/String;’ |  6
This application loads a native library: ’crashreporterer’ |  6
This application loads a native library: ’Lasrr;->c()Laspc;’ |  10

###  G FirmareDroid Rest API

Table 2: Complete List of FirmareDroid REST API endpoints with description. HTTP Method |  Route |  Description
---|---|---
/v1/androguard/
POST |  /{mode} |  Analyse Android apps with AndroGuard.
POST |  /app_certificate/download/ |  Download a certificate in DER or PEM format.
GET |  /count/ |  Gets the number of AndroGuard reports in the database.
GET |  /count/app_certificates |  Gets the number of AndroGuard certificate reports in the database.
GET |  /count/string_analysis |  Gets the number of AndroGuard string analysis reports in the database.
POST |  /meta_string_analysis/ |  Starts the meta analysis of AndroGuard string analysis.
POST |  /set_packagename/ |  Copies AndroGuard packagenames to the Android app model.
/v1/androwarn/
POST |  /{mode} |  Analysis apps with Androwarn.
GET |  count/ |  Gets the number of Androwarn reports in the database.
GET |  /{androwarn_id} |  Gets an Androwarn report as json.
/v1/auth/
POST |  /auth/login/ |  Get a JWT token for a specific account.
POST |  /auth/signup/ |  Create an account for JWT based authentication.
/v1/comparer/
POST |  /firmware_compare/ |  Compares (diff) the files from the first firmware with the second.
/v1/firmware/
GET |  /by_md5/{md5} |  Gets a json report for the firmware.
DELETE |  /delete_all/ |  Deletes all firmware entries from the database and move the firmware archives to the import folder.
POST |  /detect_version/{mode} |  Attempts to detect the Android version of the firmware.
GET |  /download/build_prop_zip |  Download all build.props files as zip file.
GET |  /download/{firmware_id} |  Download a firmware as zip archive.
POST |  /get_app_id_list/ |  Get a list of Android app id’s for a firmware.
GET |  /get_import_queue_size/ |  Gets the number of files in the import folder.
GET |  /mass_import/ |  Starts the import of firmware files from the import folder.
GET |  /{android_version} |  Get a list of firmware-id’s with the given version (including subversions).
/v1/jobs/
POST |  /cancel/{job_id} |  Cancel a RQ job.
GET |  /get_result_file/{job_id} |  Get all the currently running job-id’s.
POST |  /status/{job_id} |  Get the status of a background job.
/v1/qark/
GET |  /count/ |  Gets the number of Qark reports in the database
POST |  /download/json_reports/{mode} |  Gets a Qark report as json.
POST |  /{mode} |  Analysis apps with Quick Android Review Kit (QARK) and create a report
/v1/statistics/
POST |  /androguard/create_certificate_report/ {mode}/{report_name} |  Create a statistical report for AndroGuard certificate data.
POST |  /androguard/create_report_plots/ {androguard_statistics_report_id} |  Create plots for a Androguard statistics report.
POST |  /v1/statistics/androguard/ create_statistics_report/ {mode}/{report_name} |  Create a statistical report for AndroGuard data
POST |  /v1/statistics/androguard/ create_string_analysis_report/ {report_name} |  Create a statistical report for AndroGuard string meta data.
POST |  /v1/statistics/androwarn/ create_statistics_report/ {mode}/ {report_name} |  Create a statistical report for androwarn data
POST |  /v1/statistics/apkid/ create_statistics_report/ {mode}/{report_name} |  Create a statistical report for apkid data
GET |  /v1/statistics/download/ grouped_by_version/ filter_duplicated_packagename/ {reference_file_id}/ {get_count} |  Download a reference file for a statistics report filtered by unqiue packagenames
GET |  /v1/statistics/download/ grouped_by_version/ {reference_file_id}/ {add_meta_data} |  Download a reference file for a statistics report
GET |  /v1/statistics/download/images/ {image_file_id} |  Download a reference file for a statistics report
POST |  /v1/statistics/download/references/ {reference_file_id} |  Download a reference file for a statistics report
POST |  /v1/statistics/firmware/ create_statistics_report/ {mode}/{report_name} |  Create a statistical report for firmware data
POST |  /v1/statistics/qark/ create_statistics_report/ {mode}/{report_name} |  Create a statistical report for qark data
POST |  /v1/statistics/virustotal/ create_statistics_report/ {mode}/{report_name} |  Create a statistical report for VirusTotal data
/v1/virustotal/
POST |  /add_key/ |  Add a VirusTotal api key to a user account
GET |  /count/ |  Gets the number of VirusTotal reports in the database
GET |  /{file_uuid_reference} |  /v1/virustotal/{file_uuid_reference}
POST |  /{mode} |  /v1/virustotal/{mode}
/v1/apkid/
GET |  /v1/apkid/count/ |  Gets the number of APKiD reports in the database
POST |  /v1/apkid/{mode} |  Scan the given apps with APKiD
/v1/android_app/
POST |  /by_id/ |  Get Android app meta data as json report.
GET |  /count/ |  Gets the number of Android apps in the database.
GET |  /download/{android_app_id} |  Download the app with the given id.
/v1/firmware_file/
POST |  /exporter/export_file_by_id/ |  Exports the specific firmware files.
POST |  /exporter/export_files_by_regex/ {firmware_file_name_regex}/{mode} |  Exports the specific firmware files from the given firmware list.
POST |  /index_firmware_files/{mode} |  Creates an index of the files within the firmware images.
/v1/fuzzy_hashing/
POST |  /v1/fuzzy_hashing/create_hashes/ firmware/{mode} |  Creates fuzzy hashes for every file of the given firmware.
DELETE |  /v1/fuzzy_hashing/delete_all/{mode} |  Deletes all ssDeep/tlsh digests from the given firmware.
POST |  /v1/fuzzy_hashing/ download_cluster_analysis/ {cluster_analysis_id}/{fuzzy_hash_type} |  Download a graph file for a cluster analysis.
POST |  /v1/fuzzy_hashing/ssdeep/compare/ |  Compare two ssdeep fuzzy hashes.
POST |  /v1/fuzzy_hashing/ssdeep/ create_cluster_analysis/ {regex_filter}/{mode} |  Creates a cluster analysis for ssdeep digests.
POST |  /v1/fuzzy_hashing/tlsh/compare/ |  Compare two tlsh fuzzy hashes with each other.
POST |  /v1/fuzzy_hashing/tlsh/ create_cluster_analysis/ {regex_filter}/{mode}/ {distance_threshold}/ {compare_mode}/ {tlsh_similiarity_lookup_id}/ {description} |  Creates a clustering analysis for tlsh digests.
POST |  /v1/fuzzy_hashing/tlsh/ create_similarity_lookup/ |  Create a tlsh similarity lookup table for all tlsh hashes.
POST |  /v1/fuzzy_hashing/tlsh/find_similar/ {cluster_analysis_id}/{tlsh_hash_id} |  Find similar tlsh hashes for a given hash.
POST |  /v1/fuzzy_hashing/tlsh/testing/ table_creator_test/ {mode}/{regex_string} /{number_of_test_files}/ {distance_threshold} |  Creates a static number of tlsh lookup tables and clusters with various sizes for evaluation purposes.
/v1/cleanup/
POST |  /androguard_certificate_references/ |  Checks if all certificate references are correctly set and correct them if necessary.
GET |  /der_certificates/ |  Bugfix: Adds missing certificate file for an Android app.
DELETE |  /firmware_files/ |  Deletes all dead firmware files references
DELETE |  /firmware_references/ |  Checks if the android app references are still valid and removes invalid references
GET |  /firmware_version/ |  Renew all firmware versions
DELETE |  /static_tool_references |  Checks if the android app references are still valid and removes invalid references
/v1/adb/
POST |  /emulator_control/run_monkey/ |  Run monkey test for an Android app.
/v1/frida/
POST |  /install_server/ |  Install a frida server on a device.
POST |  /run_frida_smoke_test/ {device_ip}/ {frida_port} |  Test if connection to frida server works.
POST |  /upload_script/ |  Upload a frida script to the database.

###  H Literature Search Results

Table 3:  Title | Year | Relvant
---|---|---
A ransomware detection method using fuzzy hashing for mitigating the risk of occlusion of information systems | 2019 | TRUE
Cyberthreat Hunting-Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules | 2019 | TRUE
Cyberthreat hunting-part 2: Tracking ransomware threat actors using fuzzy hashing and fuzzy c-means clustering | 2019 | TRUE
Fuzzy-Import Hashing: A malware analysis approach | 2020 | TRUE
Fuzzy hashing aided enhanced YARA rules for malware triaging | 2020 | TRUE
Lockout-Tagout Ransomware: A detection method for ransomware using fuzzy hashing and clustering | 2019 | TRUE
Augmented YARA rules fused with fuzzy hashing in ransomware triaging | 2019 | TRUE
Experimental study of fuzzy hashing in malware clustering analysis | 2015 | TRUE
Detection of malicious portable executables using evidence combinational theory with fuzzy hashing | 2016 | TRUE
A fuzzy hashing approach based on random sequences and hamming distance | 2012 | TRUE
F2S2: Fast forensic similarity search through indexing piecewise hash signatures | 2013 | TRUE
Security Aspects of Fuzzy Hashing | 2011 | TRUE
Forensic malware analysis: The value of fuzzy hashing algorithms in identifying similarities | 2016 | TRUE
A new edit distance for fuzzy hashing applications | 2015 | TRUE
Malware characterization using windows API call sequences | 2016 | FALSE
TLSH–a locality sensitive hash | 2013 | TRUE
Research on the classification model of similarity malware using fuzzy hash | 2012 | TRUE
Web document duplicate detection using fuzzy hashing | 2011 | FALSE
TLSH–a locality sensitive hash | 2013 | TRUE
Beyond precision and recall: understanding uses (and misuses) of similarity hashes in binary analysis | 2018 | TRUE
Forensic malware analysis: The value of fuzzy hashing algorithms in identifying similarities | 2016 | TRUE
A comparison of fuzzy hashes: evaluation, guidelines, and future suggestions | 2017 | TRUE
Using randomization to attack similarity digests | 2014 | TRUE
Dynamic Whitelisting Using Locality Sensitive Hashing | 2018 | TRUE
Hashing Incomplete and Unordered Network Streams | 2018 | FALSE
Document Copy Detection Using the Improved Fuzzy Hashing | 2015 | FALSE
Hac-t and fast search for similarity in security | 2020 | TRUE
Scalable Malware Clustering using Multi-Stage Tree Parallelization | 2020 | TRUE
Combined kNN Classification and hierarchical similarity hash for fast malware detection | 2020 | TRUE
Clustering IoT Malware based on Binary Similarity | 2020 | TRUE
Evaluación de algoritmos de fuzzy hashing para similitud entre procesos | 2017 | FALSE
: Hashing Unordered and Incomplete Network Streams on the Fly | 2017 | FALSE
An entropy-based solution for identifying android packers | 2019 | TRUE
Similarity hashing of malware on IoT devices | 2019 | TRUE
Using fuzzy bits and neural networks to partially invert few rounds of some cryptographic hash functions | 2019 | TRUE
Bytewise approximate matching: the good, the bad, and the unknown | 2016 | TRUE
TLSH–a locality sensitive hash | 2013 | TRUE
Beyond precision and recall: understanding uses (and misuses) of similarity hashes in binary analysis | 2018 | TRUE
Forensic malware analysis: The value of fuzzy hashing algorithms in identifying similarities | 2016 | TRUE
A comparison of fuzzy hashes: evaluation, guidelines, and future suggestions | 2017 | TRUE
Using randomization to attack similarity digests | 2014 | TRUE
Dynamic Whitelisting Using Locality Sensitive Hashing | 2018 | TRUE
Hashing Incomplete and Unordered Network Streams | 2018 | FALSE
Document Copy Detection Using the Improved Fuzzy Hashing | 2015 | TRUE
Hac-t and fast search for similarity in security | 2020 | TRUE
Scalable Malware Clustering using Multi-Stage Tree Parallelization | 2020 | TRUE
Combined kNN Classification and hierarchical similarity hash for fast malware detection | 2020 | TRUE
Clustering IoT Malware based on Binary Similarity | 2020 | TRUE
Evaluación de algoritmos de fuzzy hashing para similitud entre procesos | 2017 | FALSE
SFH: Hashing Unordered and Incomplete Network Streams on the Fly | FALSE
An entropy-based solution for identifying android packers | 2019 | TRUE
Similarity hashing of malware on IoT devices | 2019 | TRUE
Using fuzzy bits and neural networks to partially invert few rounds of some cryptographic hash functions | 2019 | TRUE
Bytewise approximate matching: the good, the bad, and the unknown | 2016 | TRUE
Lempel-Ziv Jaccard Distance, an effective alternative to ssdeep and sdhash | 2018 | TRUE
Application of Normalized Compression Distance and Lempel-Ziv Jaccard Distance in Micro-electrode Signal Stream Classification for the Surgical Treatment of … | 2018 | FALSE
Malware classification and class imbalance via stochastic hashed LZJD | 2017 | TRUE
Similarity hashing of malware on IoT devices | 2019 | TRUE
Fast k-NN based Malware Analysis in a Massive Malware Environment. | 2019 | TRUE
Hac-t and fast search for similarity in security | 2020 | TRUE
Fishdbc: Flexible, incremental, scalable, hierarchical density-based clustering for arbitrary data and distance | 2019 | TRUE
An Improved Bytewise Approximate Matching Algorithm Suitable for Files of Dissimilar Sizes | 2020 | TRUE
mrsh-mem: Approximate matching on raw memory dumps | 2018 | FALSE
Data Science: New Issues, Challenges and Applications | 2020 | FALSE
Survey of machine learning techniques for malware analysis | 2019 | FALSE
A Survey on Using Kolmogorov Complexity in Cybersecurity | 2019 | FALSE
A Mechanism for Copyright Protection under Information-Centric Networking | 2019 | FALSE
Clustering IoT Malware Samples based on Binary Similarity | 2019 | TRUE
Understanding plagiarism linguistic patterns, textual features, and detection methods | 2011 | FALSE
A Survey of Machine Learning Methods and Challenges for Windows Malware Classification | 2020 | FALSE
a framework for automated similarity analysis of malware | 2014 | TRUE
Cyberthreat Hunting-Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules | 2019 | TRUE
A ransomware detection method using fuzzy hashing for mitigating the risk of occlusion of information systems | 2019 | TRUE
Fuzzy-Import Hashing: A malware analysis approach | 2020 | TRUE
Augmented YARA rules fused with fuzzy hashing in ransomware triaging | 2019 | TRUE
Experimental study of fuzzy hashing in malware clustering analysis | 2015 | TRUE
A fuzzy hashing approach based on random sequences and hamming distance | 2012 | TRUE
Cyberthreat hunting-part 2: Tracking ransomware threat actors using fuzzy hashing and fuzzy c-means clustering | 2019 | TRUE
Lockout-Tagout Ransomware: A detection method for ransomware using fuzzy hashing and clustering | 2019 | TRUE
Fuzzy hashing aided enhanced YARA rules for malware triaging | 2020 | TRUE
mvHash: a new approach for fuzzy hashing | 2012 | TRUE
Forensic malware analysis: The value of fuzzy hashing algorithms in identifying similarities | 2016 | TRUE
TLSH–a locality sensitive hash | 2013 | FALSE
Security and implementation analysis of the similarity digest sdhash | 2012 | TRUE
F2S2: Fast forensic similarity search through indexing piecewise hash signatures | 2013 | TRUE
Properties of a similarity preserving hash function and their realization in sdhash | 2012 | TRUE
Detection of malicious portable executables using evidence combinational theory with fuzzy hashing | 2016 | TRUE
A comparison of fuzzy hashes: evaluation, guidelines, and future suggestions | 2017 | TRUE
Lempel-Ziv Jaccard Distance, an effective alternative to ssdeep and sdhash | 2018 | TRUE
2 Fuzzy Hashing Techniques in Applied Malware Analysis | 2012 | TRUE
Experimental study of fuzzy hashing in malware clustering analysis | 2015 | TRUE
Augmented YARA rules fused with fuzzy hashing in ransomware triaging | 2019 | TRUE
Cyberthreat Hunting-Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules | 2019 | TRUE
Fuzzy-Import Hashing: A malware analysis approach | 2020 | TRUE
Deep fuzzy hashing network for efficient image retrieval | 2020 | TRUE
A fuzzy hashing approach based on random sequences and hamming distance | 2012 | TRUE
Fuzzy hashing aided enhanced YARA rules for malware triaging | 2020 | TRUE
Cyberthreat hunting-part 2: Tracking ransomware threat actors using fuzzy hashing and fuzzy c-means clustering | 2019 | TRUE
Embedding fuzzy rules with YARA rules for performance optimisation of malware analysis | 2020 | TRUE
A Novel Information retrieval system for distributed cloud using Hybrid Deep Fuzzy Hashing Algorithm | 2020 | TRUE
Performance issues about context-triggered piecewise hashing | 2011 | TRUE
On fuzzy syndrome hashing with LDPC coding | 2011 | FALSE
2 Fuzzy Hashing Techniques in Applied Malware Analysis | 2012 | TRUE
Scaling up software birthmarks using fuzzy hashing | 2017 | FALSE
A fuzzy hashing technique for large scale software birthmarks | 2016 | FALSE
mvHash: a new approach for fuzzy hashing | 2012 | TRUE
Experimental study of fuzzy hashing in malware clustering analysis | 2015 | TRUE
Lockout-Tagout Ransomware: A detection method for ransomware using fuzzy hashing and clustering | 2019 | TRUE
Cyberthreat hunting-part 2: Tracking ransomware threat actors using fuzzy hashing and fuzzy c-means clustering | 2019 | TRUE
A ransomware detection method using fuzzy hashing for mitigating the risk of occlusion of information systems | 2019 | TRUE
Clustering spam campaigns with fuzzy hashing | 2014 | TRUE
Fuzzy-Import Hashing: A malware analysis approach | 2020 | TRUE
Cyberthreat Hunting-Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules | 2019 | TRUE
Augmented YARA rules fused with fuzzy hashing in ransomware triaging | 2019 | TRUE
Detection of malicious portable executables using evidence combinational theory with fuzzy hashing | 2016 | TRUE
Fuzzy hashing aided enhanced YARA rules for malware triaging | 2020 | TRUE
Evaluation on malware classification by combining traffic analysis and fuzzy hashing of malware binary | 2015 | TRUE
A Novel Information retrieval system for distributed cloud using Hybrid Deep Fuzzy Hashing Algorithm | 2020 | TRUE
Multiple kernel fuzzy clustering | 2011 | FALSE
Embedding fuzzy rules with YARA rules for performance optimisation of malware analysis | 2020 | TRUE
Emulator vs real phone: Android malware detection using machine learning | 2017 | TRUE
Evading android runtime analysis via sandbox detection | 2014 | TRUE
Morpheus: automatically generating heuristics to detect android emulators | 2014 | TRUE
A robust dynamic analysis system preventing SandBox detection by Android malware | 2015 | TRUE
Applying machine learning classifiers to dynamic android malware detection at scale | 2013 | TRUE
A study of android malware detection technology evolution | 2015 | TRUE
Rage against the virtual machine: hindering dynamic analysis of android malware | 2014 | TRUE
A Study on android emulator detection for mobile game security | 2015 | TRUE
Evaluation of android malware detection based on system calls | 2016 | TRUE
Malware detection using network traffic analysis in android based mobile devices | 2014 | TRUE
Android malware detection based on system calls | 2015 | TRUE
Out-of-Domain Characteristic Based Hierarchical Emulator Detection for Mobile | 2019 | TRUE
Data on vulnerability detection in android | 2019 | TRUE
Anti-Hijack: Runtime detection of malware initiated hijacking in android | 2016 | TRUE
CREDROID: Android malware detection by network traffic analysis | 2016 | TRUE
Deep4maldroid: A deep learning framework for android malware detection based on linux kernel system call graphs | 2016 | TRUE
AndroShield: automated android applications vulnerability detection, a hybrid static and dynamic analysis approach | 2019 | TRUE
Mobile-sandbox: having a deeper look into android applications | 2013 | TRUE
Android rooting: Methods, detection, and evasion | 2015 | TRUE
Jailbreak/root detection evasion study on iOS and Android | 2016 | TRUE
All your root checks are belong to us: The sad state of root detection | 2015 | TRUE
Riskranker: scalable and accurate zero-day android malware detection | 2012 | TRUE
System log-based android root state detection | 2017 | TRUE
Android root and its providers: A double-edged sword | 2015 | TRUE
Kernel-based behavior analysis for android malware detection | 2011 | TRUE
On Root Detection Strategies for Android Devices | 2020 | TRUE
Droidapiminer: Mining api-level features for robust malware detection in android | 2013 | FALSE
Root exploit detection and features optimization: mobile device and blockchain based medical data management | 2018 | FALSE
User conventional root detection for indoor mall | 2018 | FALSE
PREC: practical root exploit containment for android devices | 2014 | FALSE
Drebin: Effective and explainable detection of android malware in your pocket. | 2014 | FALSE
Detecting android root exploits by learning from root providers | 2017 | FALSE
Malware detection in android based on dynamic analysis | 2017 | TRUE
Fast, scalable detection of piggybacked mobile applications | 2013 | FALSE
Rooting attack detection method on the Android-based smart phone | 2011 | FALSE
Machine learning for android malware detection using permission and api calls | 2013 | FALSE
Who changed you? Obfuscator identification for Android | 2017 | TRUE
An anti-reverse engineering technique using native code and obfuscator-llvm for android applications | 2017 | TRUE
Automated deobfuscation of Android native binary code | 2019 | TRUE
Efficient code obfuscation for Android | 2013 | TRUE
Reliable third-party library detection in android and its security applications | 2016 | TRUE
TargO: A Targeted Obfuscator for Android Applications | 2019 | TRUE
Deobfuscating Android native binary code | 2019 | TRUE
Enriching reverse engineering through visual exploration of Android binaries | 2015 | TRUE
Android: Static analysis using similarity distance | 2012 | TRUE
Code protection in android | 2012 | FALSE
Control flow obfuscation for android applications | 2016 | TRUE
Testing android malware detectors against code obfuscation: a systematization of knowledge and unified methodology | 2017 | TRUE
Exploring reverse engineering symptoms in Android apps | 2015 | TRUE
Android: From reversing to decompilation | 2011 | FALSE
Understanding android obfuscation techniques: A large-scale investigation in the wild | 2018 | TRUE
Apposcopy: Semantics-based detection of android malware through static analysis | 2014 | TRUE
Prodact: Prefetch-obfuscator to defend against cache timing channels | 2019 | FALSE
Decompiling android | 2012 | FALSE
Statistical deobfuscation of android applications | 2016 | TRUE
Anti-proguard: Towards automated deobfuscation of android apps | 2017 | TRUE
Automated deobfuscation of Android native binary code | 2019 | TRUE
Android app deobfuscation using static-dynamic cooperation | 2018 | TRUE
A study on deobfuscation method of Android and implementation of automatic analysis tool | 2015 | TRUE
Leveraging historical versions of Android apps for efficient and precise taint analysis | 2018 | FALSE
Deobfuscating Android native binary code | 2019 | TRUE
Tackling runtime-based obfuscation in Android with TIRO | 2018 | TRUE
Automated analysis and deobfuscation of android apps & malware | 2013 | TRUE
Compile-time code virtualization for android applications | 2020 | FALSE
Efficient code obfuscation for Android | 2013 | FALSE
Dose: Deobfuscation based on semantic equivalence | 2018 | TRUE
Libd: Scalable and precise third-party library detection in android markets | 2017 | FALSE
Reversing Obfuscated Control Flow Structures in Android Apps using ReDex Optimizer | 2020 | TRUE
A survey of android application and malware hardening | 2021 | TRUE
Harvesting Runtime Values in Android Applications That Feature Anti-Analysis Techniques. | 2016 | FALSE
String deobfuscation scheme based on dynamic code extraction for mobile malwares | 2016 | TRUE
Automatic string deobfuscation scheme for mobile applications based on platform-level code extraction | 2019 | TRUE
Enabling automatic protocol behavior analysis for android applications | 2016 | FALSE
Dexhunter: toward extracting hidden code from packed android applications | 2015 | TRUE
Things You May Not Know About Android (Un) Packers: A Systematic Study based on Whole-System Emulation. | 2018 | TRUE
Appspear: Bytecode decrypting and dex reassembling for packed android malware | 2015 | TRUE
Android packers: facing the challenges, building solutions | 2014 | TRUE
Automated detection and classification for packed android applications | 2016 | TRUE
Adaptive unpacking of Android apps | 2017 | TRUE
DroidPDF: The Obfuscation Resilient Packer Detection Framework for Android Apps | 2020 | TRUE
DexX: a double layer unpacking framework for Android | 2018 | TRUE
AppSpear: automating the hidden-code extraction and reassembling of packed android malware | 2018 | TRUE
Code protection in android | 2012 | TRUE
PackerGrind: An Adaptive Unpacking System for Android Apps | 2020 | TRUE
An entropy-based solution for identifying android packers | 2019 | TRUE
Compile-time code virtualization for android applications | 2020 | FALSE
Automated code extraction from packed android applications. | 2016 | TRUE
Storydroid: Automated generation of storyboard for Android apps | 2019 | FALSE
RepDroid: an automated tool for Android application repackaging detection | 2017 | TRUE
Who changed you? Obfuscator identification for Android | 2017 | TRUE
Uncovering self code modification in android | 2015 | TRUE
AndroSimilar: robust statistical feature signature for Android malware detection | 2013 | FALSE
Efficient code obfuscation for Android | 2013 | FALSE
Adaptive unpacking of Android apps | 2017 | TRUE
DexX: a double layer unpacking framework for Android | 2018 | TRUE
Dexhunter: toward extracting hidden code from packed android applications | 2015 | TRUE
Things You May Not Know About Android (Un) Packers: A Systematic Study based on Whole-System Emulation. | 2018 | TRUE
PackerGrind: An Adaptive Unpacking System for Android Apps | 2020 | TRUE
AppSpear: automating the hidden-code extraction and reassembling of packed android malware | 2018 | TRUE
Compile-time code virtualization for android applications | 2020 | FALSE
UNPACKING THE PACKED UNPACKER: REVERSING AN ANDROID ANTI-ANALYSIS NATIVE LIBRARY | 2018 | TRUE
Tackling runtime-based obfuscation in Android with TIRO | 2018 | TRUE
The terminator to Android hardening services | 2015 | TRUE
Android malware familial classification and representative sample selection via frequent subgraph analysis | 2018 | TRUE
Appspear: Bytecode decrypting and dex reassembling for packed android malware | 2015 | TRUE
Code protection in android | 2012 | TRUE
Graph embedding based familial analysis of android malware using unsupervised learning | 2019 | FALSE
Divilar: Diversifying intermediate language for anti-repackaging on android platform | 2014 | TRUE
The Android malware detection systems between hope and reality | 2019 | TRUE
Honey, i shrunk your app security: The state of android app hardening | 2018 | TRUE
Ctdroid: leveraging a corpus of technical blogs for android malware analysis | 2019 | FALSE
How current android malware seeks to evade automated code analysis | 2015 | TRUE
revdroid: Code analysis of the side effects after dynamic permission revocation of android apps | 2016 | TRUE
Machine learning aided Android malware classification | 2017 | TRUE
How and Why did developers migrate Android Applications from Java to Kotlin? A study based on code analysis and interviews with developers | 2020 | FALSE
DroidFax: A toolkit for systematic characterization of Android applications | 2017 | TRUE
Stadyna: Addressing the problem of dynamic code updates in the security analysis of android applications | 2015 | TRUE
Enter sandbox: Android sandbox comparison | 2014 | TRUE
Understanding android obfuscation techniques: A large-scale investigation in the wild | 2018 | TRUE
Harvesting runtime data in android applications for identifying malware and enhancing code analysis | 2015 | TRUE
Android malware classification using static code analysis and Apriori algorithm improved with particle swarm optimization | 2014 | TRUE
Analysis of android applications’ permissions | 2012 | TRUE
Code protection in android | 2012 | TRUE
Static analysis of Android programs | 2012 | TRUE
Who changed you? Obfuscator identification for Android | 2017 | TRUE
Mobile application compatibility test system design for android fragmentation | 2011 | FALSE
Detecting software vulnerabilities in android using static analysis | 2014 | TRUE
Why Eve and Mallory love Android: An analysis of Android SSL (in) security | 2012 | FALSE
A dataset of open-source android applications | 2015 | FALSE
Droidfuzzer: Fuzzing the android apps with intent-filter tag | 2013 | TRUE
Making malory behave maliciously: Targeted fuzzing of android execution environments | 2017 | TRUE
Template-based Android inter process communication fuzzing | 2020 | TRUE
FANS: Fuzzing Android Native System Services via Automated Interface Analysis | 2020 | TRUE
IoTFuzzer: Discovering Memory Corruptions in IoT Through App-based Fuzzing. | 2018 | TRUE
Vulcan: Lessons on reliability of wearables through state-aware fuzzing | 2020 | FALSE
Caiipa: Automated large-scale mobile app testing through contextual fuzzing | 2014 | TRUE
Automated hybrid analysis of android malware through augmenting fuzzing with forced execution | 2018 | FALSE
Automated Functional Fuzzing of Android Apps | 2020 | TRUE
Fuzzing the Android Applications With HTTP/HTTPS Network Data | 2019 | TRUE
Evolutionary Fuzzing of Android OS Vendor System Services | 2019 | TRUE
A Practical Intent Fuzzing Tool for Robustness of Inter-Component Communication in Android Apps | 2018 | TRUE
Fuzzing android system services by binder call to escalate privilege | 2015 | TRUE
Fuzzing: State of the art | 2018 | TRUE
Efficient Evolutionary Fuzzing for Android Application Installation Process | 2019 | TRUE
Method of Fuzzing Document Application Based on Android Devices | 2015 | TRUE
A whitebox approach for automated security testing of Android applications on the cloud | 2012 | TRUE
IntentFuzzer: detecting capability leaks of android applications | 2014 | TRUE
Droidscope: Seamlessly reconstructing the OS and dalvik semantic views for dynamic android malware analysis | 2012 | TRUE
Machine learning aided Android malware classification | 2017 | TRUE
The evolution of android malware and android analysis techniques | 2017 | TRUE
Android malware and analysis | 2014 | TRUE
Deep neural architectures for large scale android malware analysis | 2018 | TRUE
Android malware familial classification and representative sample selection via frequent subgraph analysis | 2018 | TRUE
Droid permission miner: Mining prominent permissions for Android malware analysis | 2014 | TRUE
Droidmat: Android malware detection through manifest and api calls tracing | 2012 | TRUE
AdDroid: rule-based machine learning framework for android malware analysis | 2020 | TRUE
How current android malware seeks to evade automated code analysis | 2015 | TRUE
Ctdroid: leveraging a corpus of technical blogs for android malware analysis | 2019 | FALSE
Kernel-based behavior analysis for android malware detection | 2011 | FALSE
Machine learning classifiers for android malware analysis | 2016 | TRUE
Machine learning based hybrid behavior models for Android malware analysis | 2015 | TRUE
DRACO: DRoid analyst combo an android malware analysis framework | 2015 | TRUE
A system call-centric analysis and stimulation technique to automatically reconstruct android malware behaviors | 2013 | TRUE
Apposcopy: Semantics-based detection of android malware through static analysis | 2014 | TRUE
Rage against the virtual machine: hindering dynamic analysis of android malware | 2014 | TRUE
ScanMe mobile: a cloud-based Android malware analysis service | 2016 | TRUE
Deep ground truth analysis of current android malware | 2017 | TRUE
Android permissions demystified | 2011 | FALSE
Android permissions: a perspective combining risks and benefits | 2012 | FALSE
Android permissions: User attention, comprehension, and behavior | 2012 | FALSE
A conundrum of permissions: installing applications on an android smartphone | 2012 | FALSE
Dr. android and mr. hide: fine-grained permissions in android applications | 2012 | FALSE
Analysis of android applications’ permissions | 2012 | FALSE
Quantitative security risk assessment of android permissions and applications | 2013 | FALSE
Longitudinal analysis of android ad library permissions | 2013 | FALSE
Android permissions remystified: A field study on contextual integrity | 2015 | FALSE
Flow permissions for android | 2013 | FALSE
Studying the effectiveness of android application permissions requests | 2013 | FALSE
The effectiveness of application permissions | 2011 | FALSE
Asking for (and about) permissions used by android apps | 2013 | FALSE
Android security permissions–can we trust them? | 2011 | FALSE
Resolving the predicament of android custom permissions | 2018 | TRUE
Application Security for the Android Platform: Processes, Permissions, and Other Safeguards | 2011 | FALSE
Permission evolution in the android ecosystem | 2012 | FALSE
A novel security framework for managing android permissions using blockchain technology | 2018 | FALSE
Static detection of Android malware by using permissions and API calls | 2014 | TRUE
An investigation into Android run-time permissions from the end users’ perspective | 2018 | TRUE
Android privacy | 2012 | FALSE
AndroidLeaks: automatically detecting potential privacy leaks in android applications on a large scale | 2012 | FALSE
Iccta: Detecting inter-component privacy leaks in android apps | 2015 | TRUE
Investigating user privacy in android ad libraries | 2012 | FALSE
ScanDal: Static analyzer for detecting privacy leaks in android applications | 2012 | FALSE
Appintent: Analyzing sensitive data transmission in android for privacy leakage detection | 2013 | TRUE
A framework for static detection of privacy leaks in android applications | 2012 | FALSE
Assessing privacy risks in android: A user-centric approach | 2013 | FALSE
Appprofiler: a flexible method of exposing privacy-related behavior in android applications to end users | 2013 | FALSE
Securacy: an empirical investigation of Android applications’ network usage, privacy and security | 2015 | TRUE
Toward a framework for detecting privacy policy violations in android application code | 2016 | TRUE
Flexible and fine-grained mandatory access control on android for diverse security and privacy policies | 2013 | FALSE
Platform privacies: Governance, collaboration, and the different meanings of “privacy” in iOS and Android development | 2018 | FALSE
Android and iOS users’ differences concerning security and privacy | 2013 | FALSE
DroidJust: Automated functionality-aware privacy leakage analysis for Android applications | 2015 | TRUE
Influence of privacy attitude and privacy cue framing on android app choices | 2016 | TRUE
Privacy as part of the app decision-making process | 2013 | FALSE
Dynamic privacy leakage analysis of Android third-party libraries | 2019 | TRUE
I know what leaked in your pocket: uncovering privacy leaks on Android Apps with Static Taint Analysis | 2014 | TRUE
An Investigative Study on Android Verified Boot Process | 2019 | TRUE
Android security internals: An in-depth guide to Android’s security architecture | 2014 | TRUE
Android rooting: Methods, detection, and evasion | 2015 | TRUE
fastboot oem vuln: Android bootloader vulnerabilities in vendor customizations | 2017 | TRUE
The android platform security model | 2019 | TRUE
Verified boot in embedded systems with hard boot time constraints | 2017 | TRUE
A novel pattern recognition system for detecting Android malware by analyzing suspicious boot sequences | 2018 | TRUE
U-Boot–Multi image booting scenarios | 2013 | TRUE
Dm-x: protecting volume-level integrity for cloud volumes and local block devices | 2017 | TRUE
OS Resiliency | 2020 | FALSE
Fast boot and fast shutdown of Android on the embedded system | 2013 | FALSE
A Research On Android Technology With New Version Naugat (7.0, 7.1) | 2017 | FALSE
Android* Software Updates | 2015 | FALSE
Controlled Android application execution for the IoT infrastructure | 2015 | FALSE
Recent versions on android and survey on the versions lollipop, marshmallow and nougat | 2018 | FALSE
Android patching | 2014 | FALSE
Android Defense in Depth Strategy in an Automobile Ecosystem | 2020 | FALSE
Analysing the vulnerability exploitation in Android with the device-mapper-verity (dm-verity) student research abstract | 2017 | TRUE
Euphony: Harmonious unification of cacophonous anti-virus vendor labels for android malware | 2017 | FALSE
The android platform security model | 2019 | TRUE
Simulating Electronic Circuits on Android Device using Virtual Bread Board | 2017 | FALSE
An Android Data Protection Scheme for System-as-Root Architectures | 2020 | FALSE
Automation of the municipal inspection process in Ecuador applying mobile-D for android | 2019 | FALSE
Android Application Model of What’s Dating Violence as an Innovation to Increase the Knowledge among Adolescents | 2020 | FALSE
Creating better ground truth to further understand Android malware: A large scale mining approach based on antivirus labels and malicious artifacts | 2019 | FALSE
Automation of the Municipal Inspection Process in Ecuador Applying Mobile-D for Android | 2019 | FALSE
OS Resiliency | 2020 | FALSE
Metodologia para reconstrução de dados em dispositivos móveis com Sistema Operacional Android mediante aplicação de técnicas ISP e Combination firmware | 2020 | FALSE
Reverse Wenckebach “pseudo-supernormal” conduction or paroxysmal atrioventricular block | 2012 | FALSE
Android download and search service | 2011 | FALSE
Aplikasi Gamelan Jawa Berbasis Android | 2015 | FALSE
Integration of motor learning principles into real-time ambulatory voice biofeedback and example implementation via a clinical case study with vocal fold nodules | 2017 | FALSE
Association of aging-related obesity and metabolic syndrome in men | 2016 | FALSE
Androi-based C&D (connected & downloadable) IVI (in-vehicle infotainment) platform | 2015 | FALSE
Analysing the vulnerability exploitation in Android with the device-mapper-verity (dm-verity) student research abstract | 2017 | TRUE
Baredroid: Large-scale analysis of android apps on real devices | 2015 | FALSE
Dm-x: protecting volume-level integrity for cloud volumes and local block devices | 2017 | TRUE
Android* Software Updates | 2015 | FALSE
Controlled Android application execution for the IoT infrastructure | 2015 | FALSE
Subverting Android 6.0 fingerprint authentication | 2016 | FALSE
Secure containers in Android: the Samsung KNOX case study | 2016 | FALSE
fastboot oem vuln: Android bootloader vulnerabilities in vendor customizations | 2017 | FALSE
Android patching | 2014 | FALSE
OS Resiliency | 2020 | FALSE
Android Defense in Depth Strategy in an Automobile Ecosystem | 2020 | FALSE
Analysis of android vulnerabilities and modern exploitation techniques | 2014 | FALSE
Android security internals: An in-depth guide to Android’s security architecture | 2014 | FALSE
Android 7 File Based Encryption and the Attacks Against It | 2017 | FALSE
File System-level Integrity Protection | 2018 | TRUE
Android Camera Tuning Application | 2016 | FALSE
Hybrid firmware analysis for known mobile and iot security vulnerabilities | 2020 | TRUE
BigMAC: Fine-Grained Policy Analysis of Android Firmware | 2020 | TRUE
Detect malware in android firmware based on distributed network environment | 2019 | TRUE
Toward Automated Firmware Analysis in the IoT Era | 2019 | TRUE
The Nexmon firmware analysis and modification framework: Empowering researchers to enhance Wi-Fi devices | 2018 | FALSE
An analysis of pre-installed android software | 2020 | TRUE
Attention spanned: Comprehensive vulnerability analysis of AT commands within the android ecosystem | 2018 | FALSE
Vulnerabilities of android OS-based telematics system | 2017 | TRUE
Toward Automated Firmware Analysis in the IoT Era | 2019 | TRUE
Towards Automated Firmware Analysis in the IoT Era | 2019 | TRUE
Android forensics: investigation, analysis and mobile security for Google Android | 2011 | FALSE
Proxray: Protocol model learning and guided firmware analysis | 2019 | FALSE
FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware | 2020 | TRUE
Assessment of dual frequency GNSS observations from a Xiaomi Mi 8 Android smartphone and positioning performance analysis | 2019 | FALSE
Android anti-virus analysis | 2012 | FALSE
The evolution of android malware and android analysis techniques | 2017 | FALSE
DroidRay: a security evaluation system for customized android firmwares | 2014 | TRUE
Andrubis–1,000,000 apps later: A view on current Android malware behaviors | 2014 | FALSE
Static analysis of android apps: A systematic literature review | 2017 | FALSE
An analysis of pre-installed android software | 2020 | TRUE
Scalable graph-based bug search for firmware images | 2016 | TRUE
FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware | 2020 | TRUE
Detect malware in android firmware based on distributed network environment | 2019 | FALSE
Hybrid firmware analysis for known mobile and iot security vulnerabilities | 2020 | TRUE
Andrubis–1,000,000 apps later: A view on current Android malware behaviors | 2014 | FALSE
Sensitive data leakage detection in pre-installed applications of custom Android firmware | 2017 | FALSE
Attention spanned: Comprehensive vulnerability analysis of AT commands within the android ecosystem | 2018 | FALSE
Towards automated classification of firmware images and identification of embedded devices | 2017 | TRUE
Binarm: Scalable and efficient detection of vulnerabilities in firmware images of intelligent electronic devices | 2018 | FALSE
Static malware detection and attribution in android byte-code through an end-to-end deep system | 2020 | FALSE
A large-scale analysis of the security of embedded firmwares | 2014 | FALSE
The university of sussex-huawei locomotion and transportation dataset for multimodal analytics with mobile devices | 2018 | FALSE
Abusing Android Runtime for Application Obfuscation | 2020 | FALSE
Evaluation of tree based machine learning classifiers for android malware detection | 2018 | FALSE
Dissecting android malware: Characterization and evolution | 2012 | FALSE
Evaluating machine learning models for android malware detection: a comparison study | 2018 | FALSE
Efficient signature generation for classifying cross-architecture IoT malware | 2018 | FALSE
Proposing Automatic Dataset Generation System to Support Android Sensitive Data Leakage Detection Systems | 2019 | FALSE
Efficient, context-aware privacy leakage confinement for android applications without firmware modding | 2014 | FALSE
An analysis of pre-installed android software | 2020 | TRUE
Riskranker: scalable and accurate zero-day android malware detection | 2012 | FALSE
HALucinator: Firmware re-hosting through abstraction layer emulation | 2020 | FALSE
Dissecting android malware: Characterization and evolution | 2012 | FALSE
Cost-effective smartphone-based reconfigurable electrochemical instrument for alcohol determination in whole blood samples | 2018 | FALSE
Hey, you, get off of my market: detecting malicious apps in official and alternative android markets. | 2012 | FALSE
DroidRay: a security evaluation system for customized android firmwares | 2014 | FALSE
Monet: a user-oriented behavior-based malware variants detection system for android | 2016 | FALSE
Semantics-aware android malware classification using weighted contextual api dependency graphs | 2014 | FALSE
A close look at a daily dataset of malware samples | 2019 | FALSE
Sensitive data leakage detection in pre-installed applications of custom Android firmware | 2017 | FALSE
Evaluating machine learning models for android malware detection: a comparison study | 2018 | FALSE
Parallel Space Traveling: A Security Analysis of App-Level Virtualization in Android | 2020 | FALSE
Scalable graph-based bug search for firmware images | 2016 | FALSE
Evaluation of tree based machine learning classifiers for android malware detection | 2018 | FALSE
Andrubis–1,000,000 apps later: A view on current Android malware behaviors | 2014 | FALSE
Breaking all the things—A systematic survey of firmware extraction techniques for IoT devices | 2018 | FALSE
BigMAC: Fine-Grained Policy Analysis of Android Firmware | 2020 | TRUE
Android digital forensics: data, extraction and analysis | 2017 | FALSE
Attention spanned: Comprehensive vulnerability analysis of AT commands within the android ecosystem | 2018 | FALSE
Human assisted information extraction through Bluetooth low energy on android | 2019 | FALSE
A firmware code gene extraction technology for IoT terminal | 2019 | FALSE
Methodology for Forensics Data Reconstruction on Mobile Devices with Android Operating System Applying In-System Programming and Combination Firmware | 2020 | FALSE
Free your CSI: A channel state information extraction platform for modern Wi-Fi chipsets | 2019 | FALSE
Automatic feature extraction, categorization and detection of malicious code in Android applications | 2014 | FALSE
Android forensic capability and evaluation of extraction tools | 2012 | FALSE
WeChat forensic artifacts: Android phone extraction and analysis | 2015 | FALSE
Toward Automated Firmware Analysis in the IoT Era | 2019 | FALSE
Logical Acquisition in the Forensic Investigation Process of Android Smartphones based on Agent using Open Source Software | 2020 | FALSE
The Nexmon firmware analysis and modification framework: Empowering researchers to enhance Wi-Fi devices | 2018 | FALSE
Hybrid firmware analysis for known mobile and iot security vulnerabilities | 2020 | FALSE
Android hacker’s handbook | 2014 | FALSE
Android phone forensic: Tools and techniques | 2016 | FALSE
ADetect: Hybrid Analysis Feature Extraction for Android malware Detection | 2018 | FALSE
Android Forensics: Tools and Techniques for Manual Data Extraction | 2019 | FALSE
BaseSAFE: baseband sanitized fuzzing through emulation | 2020 | TRUE
Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets | 2020 | TRUE
Difuze: Interface aware fuzzing for kernel drivers | 2017 | TRUE
Periscope: An effective probing and fuzzing framework for the hardware-os boundary | 2019 | TRUE
HFL: Hybrid fuzzing on the linux kernel | 2020 | TRUE
BigMAC: Fine-Grained Policy Analysis of Android Firmware | 2020 | TRUE
Agamotto: Accelerating Kernel Driver Fuzzing with Lightweight Virtual Machine Checkpoints | 2020 | TRUE
Ex-vivo dynamic analysis framework for Android device drivers | 2020 | TRUE
Fw-fuzz: A code coverage-guided fuzzing framework for network protocols on firmware | 2020 | TRUE
Fuzzing: State of the art | 2018 | TRUE
Vulnerability detection in iot firmware: A survey | 2017 | TRUE
FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware | 2020 | TRUE
AFL++: Combining incremental steps of fuzzing research | 2020 | TRUE
Fuzzing the Android Applications With HTTP/HTTPS Network Data | 2019 | TRUE
Kernel vulnerability analysis: a survey | 2019 | TRUE
Charm: Facilitating dynamic analysis of device drivers of mobile systems | 2018 | TRUE
New flash memory acquisition methods based on firmware update protocols for LG Android smartphones | 2018 | TRUE
Slake: facilitating slab manipulation for exploiting vulnerabilities in the Linux kernel | 2019 | TRUE
BigMAC: Fine-Grained Policy Analysis of Android Firmware | 2020 | TRUE
Breaking all the things—A systematic survey of firmware extraction techniques for IoT devices | 2018 | TRUE
DETECT SECURITY THREAT IN ANDROID CUSTOM FIRMWARE BY ANALYZING APPLICATIONS FRAMEWORK AND DEFAULT SETTINGS | 2019 | TRUE
Detect malware in android firmware based on distributed network environment | 2019 | TRUE
Welcome to Binder: A kernel level attack model for the Binder in Android operating system | 2016 | TRUE
Live acquisition of main memory data from Android smartphones and smartwatches | 2017 | FALSE
Android digital forensics: data, extraction and analysis | 2017 | FALSE
A tool for volatile memory acquisition from Android devices | 2016 | FALSE
Android hacker’s handbook | 2014 | FALSE
A Novel approach for bootkit detection in Android Platform | 2018 | TRUE
Attention spanned: Comprehensive vulnerability analysis of AT commands within the android ecosystem | 2018 | TRUE
DroidRay: a security evaluation system for customized android firmwares | 2014 | TRUE
Free your CSI: A channel state information extraction platform for modern Wi-Fi chipsets | 2019 | FALSE
Mobile root exploit detection based on system events extracted from android platform | 2013 | FALSE
An Attack-Defense Model for the Binder on the Android Kernel Level | 2017 | TRUE
A firmware code gene extraction technology for IoT terminal | 2019 | TRUE
Difuze: Interface aware fuzzing for kernel drivers | 2017 | TRUE
Methodology for Forensics Data Reconstruction on Mobile Devices with Android Operating System Applying In-System Programming and Combination Firmware | 2020 | FALSE
BigMAC: Fine-Grained Policy Analysis of Android Firmware | 2020 | TRUE
FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware | 2020 | TRUE
Andrubis–1,000,000 apps later: A view on current Android malware behaviors | 2014 | FALSE
Anatomy of a vulnerable fitness tracking system: Dissecting the fitbit cloud, app, and firmware | 2018 | FALSE
Riskranker: scalable and accurate zero-day android malware detection | 2012 | FALSE
Breaking all the things—A systematic survey of firmware extraction techniques for IoT devices | 2018 | FALSE
Detect malware in android firmware based on distributed network environment | 2019 | FALSE
DroidRay: a security evaluation system for customized android firmwares | 2014 | FALSE
Sensitive data leakage detection in pre-installed applications of custom Android firmware | 2017 | FALSE
Hey, you, get off of my market: detecting malicious apps in official and alternative android markets. | 2012 | FALSE
Detecting repackaged smartphone applications in third-party android marketplaces | 2012 | FALSE
An analysis of pre-installed android software | 2020 | TRUE
ADROIT: Android malware detection using meta-information | 2016 | FALSE
Droideagle: seamless detection of visually similar android apps | 2015 | FALSE
Android digital forensics: data, extraction and analysis | 2017 | FALSE
Semantics-aware android malware classification using weighted contextual api dependency graphs | 2014 | FALSE
Toward Automated Firmware Analysis in the IoT Era | 2019 | FALSE
Effective detection of android malware based on the usage of data flow APIs and machine learning | 2016 | FALSE
DETECT SECURITY THREAT IN ANDROID CUSTOM FIRMWARE BY ANALYZING APPLICATIONS FRAMEWORK AND DEFAULT SETTINGS | 2019 | FALSE
An analysis of pre-installed android software | 2020 | TRUE
FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware | 2020 | TRUE
Pleasure or pain? An evaluation of the costs and utilities of bloatware applications in android smartphones | 2020 | TRUE
Jred: Program customization and bloatware mitigation based on static analysis | 2016 | FALSE
Checking intent-based communication in android with intent space analysis | 2016 | FALSE
Learning Android Forensics: Analyze Android devices with the latest forensic tools and techniques | 2018 | FALSE
Smartphone bloatware: an overlooked privacy problem | 2017 | TRUE
There is no such thing as free Lunch: An Investigation of Bloatware Effects on Smart Devices | 2018 | TRUE
How Did That Get In My Phone? Unwanted App Distribution on Android Devices | 2020 | TRUE
Ghost installer in the shadow: Security analysis of app installation on android | 2017 | FALSE
Characterizing smartphone usage patterns from millions of android users | 2015 | FALSE
Privacy Problem | 2017 | FALSE
Do android users write about electric sheep? examining consumer reviews in google play | 2013 | FALSE
Insights into rooted and non-rooted android mobile devices with behavior analytics | 2016 | FALSE
Selectively taming background android apps to improve battery lifetime | 2015 | FALSE
Intrusion Detection System for Android: Linux kernel system calls analysis | 2017 | FALSE
Bloatware and Jailbreaking: How Consumer-Initiated Modification Interacts with Product Pricing | 2016 | FALSE
Mobile application development approaches: a comparative analysis on the use of storage space | 2018 | FALSE
Rootguard: Protecting rooted android phones | 2014 | FALSE
An analysis of pre-installed android software | 2020 | TRUE
FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware | 2020 | TRUE
Towards mutation analysis of android apps | 2015 | FALSE
Permission evolution in the android ecosystem | 2012 | FALSE
Vetting undesirable behaviors in android apps with permission use analysis | 2013 | FALSE
System calls analysis of malwares on android | 2013 | FALSE
DroidRay: a security evaluation system for customized android firmwares | 2014 | FALSE
Forensic analysis of instant messenger applications on android devices | 2013 | FALSE
Going native: Using a large-scale analysis of android apps to create a practical native-code sandboxing policy | 2016 | FALSE
Android permissions demystified | 2011 | FALSE
Baredroid: Large-scale analysis of android apps on real devices | 2015 | FALSE
Systematic detection of capability leaks in stock android smartphones. | 2012 | FALSE
Harvesting inconsistent security configurations in custom android roms via differential analysis | 2016 | FALSE
Studying TLS usage in Android apps | 2017 | FALSE
Permission-based malware detection mechanisms on android: Analysis and perspectives | 2014 | FALSE
Forensic analysis of geodata in android smartphones | 2011 | FALSE
APK Auditor: Permission-based Android malware detection system | 2015 | TRUE
Mutation operators for testing Android apps | 2017 | TRUE
Insights into layout patterns of mobile user interfaces by an automatic analysis of android apps | 2013 | TRUE
Evading android runtime analysis via sandbox detection | 2014 | TRUE
An analysis of pre-installed android software | 2020 | TRUE
Android malware static analysis techniques | 2015 | TRUE
Going native: Using a large-scale analysis of android apps to create a practical native-code sandboxing policy | 2016 | TRUE
FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware | 2020 | TRUE
DroidRay: a security evaluation system for customized android firmwares | 2014 | TRUE
Permission evolution in the android ecosystem | 2012 | FALSE
Android permissions demystified | 2011 | FALSE
Merging permission and api features for android malware detection | 2016 | FALSE
Open doors for bob and mallory: Open port usage in android apps and security implications | 2017 | FALSE
Analyzing inter-application communication in Android | 2011 | FALSE
System calls analysis of malwares on android | 2013 | TRUE
Vetting undesirable behaviors in android apps with permission use analysis | 2013 | FALSE
A case study in open source software security and privacy: Android adware | 2012 | TRUE
Android multitasking mechanism: Formal semantics and static analysis of apps | 2019 | TRUE
Invetter: Locating insecure input validations in android services | 2018 | TRUE
Towards mutation analysis of android apps | 2015 | TRUE
Studying TLS usage in Android apps | 2017 | TRUE
Systematic detection of capability leaks in stock android smartphones. | 2012 | TRUE
A new android malware detection approach using bayesian classification | 2013 | FALSE
An analysis of pre-installed android software | 2020 | TRUE
System calls analysis of malwares on android | 2013 | TRUE
DroidRay: a security evaluation system for customized android firmwares | 2014 | TRUE
Dynamic analysis of android malware | 2013 | TRUE
Droidmate: a robust and extensible test generator for android | 2016 | TRUE
Evading android runtime analysis via sandbox detection | 2014 | TRUE
Vetting undesirable behaviors in android apps with permission use analysis | 2013 | TRUE
FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware | 2020 | TRUE
Samadroid: a novel 3-level hybrid malware detection model for android operating system | 2018 | FALSE
A machine-learning approach for classifying and categorizing android sources and sinks. | 2014 | FALSE
Going native: Using a large-scale analysis of android apps to create a practical native-code sandboxing policy | 2016 | TRUE
Analyzing inter-application communication in Android | 2011 | TRUE
Permission use analysis for vetting undesirable behaviors in android apps | 2014 | TRUE
Android permissions demystified | 2011 | TRUE
Analyzing android application in real-time at kernel level | 2017 | TRUE
Baredroid: Large-scale analysis of android apps on real devices | 2015 | TRUE
Automated dynamic enforcement of synthesized security policies in android | 2015 | TRUE
Analyzing android browser apps for file://vulnerabilities | 2014 | TRUE
The peril of fragmentation: Security hazards in android device driver customizations | 2014 | TRUE
DroidRay: a security evaluation system for customized android firmwares | 2014 | TRUE
Merging permission and api features for android malware detection | 2016 | TRUE
Droidapiminer: Mining api-level features for robust malware detection in android | 2013 | TRUE
PIndroid: A novel Android malware detection system using ensemble learning methods | 2017 | TRUE
Permission evolution in the android ecosystem | 2012 | TRUE
Permission-based malware detection mechanisms on android: Analysis and perspectives | 2014 | TRUE
A new android malware detection approach using bayesian classification | 2013 | TRUE
APK Auditor: Permission-based Android malware detection system | 2015 | TRUE
Android malware static analysis techniques | 2015 | TRUE
Malicious android applications in the enterprise: What do they do and how do we fix it? | 2012 | TRUE
Android SMS malware: Vulnerability and mitigation | 2013 | TRUE
An analysis of pre-installed android software | 2020 | TRUE
Using deep neural network for Android malware detection | 2019 | TRUE
Mobile malware report | 2015 | TRUE
A study of android malware detection technology evolution | 2015 | TRUE
Upgrading your android, elevating my malware: Privilege escalation through mobile os updating | 2014 | TRUE
System calls analysis of malwares on android | 2013 | TRUE
Intelligent Approach for Android Malware Detection. | 2015 | TRUE
Dynamic analysis of android malware | 2013 | TRUE
Libd: Scalable and precise third-party library detection in android markets | 2017 | TRUE
Reliable third-party library detection in android and its security applications | 2016 | TRUE
Libradar: Fast and accurate detection of third-party libraries in android apps | 2016 | TRUE
Addetect: Automated detection of android ad libraries using semantic analysis | 2014 | TRUE
Orlis: Obfuscation-resilient library detection for Android | 2018 | TRUE
Securing android applications via edge assistant third-party library detection | 2019 | TRUE
Detecting third-party libraries in android applications with high precision and recall | 2018 | TRUE
Large-scale third-party library detection in android markets | 2018 | TRUE
Automated Third-Party Library Detection for Android Applications: Are We There Yet? | 2020 | TRUE
Andarwin: Scalable detection of android application clones based on semantics | 2014 | TRUE
Libid: reliable identification of obfuscated third-party android libraries | 2019 | TRUE
Identify and inspect libraries in android applications | 2018 | TRUE
Automatic detection of inter-application permission leaks in android applications | 2013 | TRUE
The impact of third-party code on android app security | 2018 | TRUE
Revisiting the impact of common libraries for android-related investigations | 2019 | TRUE
Who changed you? Obfuscator identification for Android | 2017 | TRUE
Andarwin: Scalable detection of semantically similar android applications | 2013 | FALSE
Keep me updated: An empirical study of third-party library updatability on android | 2017 | TRUE
Dynamic detection of inter-application communication vulnerabilities in Android | 2015 | FALSE
Networkprofiler: Towards automatic fingerprinting of android apps | 2013 | TRUE
Fingerprinting Android malware families | 2019 | FALSE
Scalable and robust unsupervised android malware fingerprinting using community-based network partitioning | 2020 | TRUE
Design of a mobile inspector for detecting illegal Android applications using fingerprinting | 2013 | FALSE
Investigating Fingerprinters and Fingerprinting-Alike Behaviour of Android Applications | 2018 | FALSE
Resilient and Scalable Android Malware Fingerprinting and Detection | 2020 | FALSE
Android library for recognition of activities of daily living: implementation considerations, challenges, and solutions | 2018 | FALSE
WiFi RSSI preprocessing library for Android | 2018 | FALSE
Sensorid: Sensor calibration fingerprinting for smartphones | 2019 | FALSE
Development of a Smartphone-Based University Library Navigation and Information Service Employing Wi-Fi Location Fingerprinting | 2021 | FALSE
Orlis: Obfuscation-resilient library detection for Android | 2018 | TRUE
Website Fingerprinting by Power Estimation Based Side-Channel Attacks on Android 7 | 2018 | FALSE
Mobile device identification via sensor fingerprinting | 2014 | FALSE
Binsign: fingerprinting binary functions to support automated analysis of code executables | 2017 | FALSE
Pixel perfect: Fingerprinting canvas in HTML5 | 2012 | FALSE
POWERFUL: Mobile app fingerprinting via power analysis | 2017 | FALSE
Discovering flaws in security-focused static analysis tools for android using systematic mutation | 2018 | TRUE
HornDroid: Practical and sound static analysis of Android applications by SMT solving | 2016 | TRUE
droid: Assessment and evaluation of android application analysis tools | 2016 | TRUE
A dataset of open-source android applications | 2015 | TRUE
Static analysis of Android programs | 2012 | TRUE
Android: Static analysis using similarity distance | 2012 | TRUE
Jn-saf: Precise and efficient ndk/jni-aware inter-language static analysis framework for security vetting of android applications with native code | 2018 | TRUE
HybriDroid: static analysis framework for Android hybrid applications | 2016 | TRUE
Do android taint analysis tools keep their promises? | 2018 | TRUE
Where are we looking? Understanding android static analysis techniques | 2019 | TRUE
Dexpler: converting android dalvik bytecode to jimple for static analysis with soot | 2012 | TRUE
Static analysis of android apps: A systematic literature review | 2017 | TRUE
Androlic: an extensible flow, context, object, field, and path-sensitive static analysis framework for Android | 2019 | TRUE
Reflection-aware static analysis of android apps | 2016 | TRUE
Software quality through the eyes of the end-user and static analysis tools: A study on android oss applications | 2018 | TRUE
Andrubis–1,000,000 apps later: A view on current Android malware behaviors | 2014 | FALSE
RedDroid: Android application redundancy customization based on static analysis | 2018 | TRUE
An app based on static analysis for Android ransomware | 2017 | TRUE
Evaluating state-of-the-art free and open source static analysis tools against buffer errors in android apps | 2017 | TRUE
Combining static analysis with probabilistic models to enable market-scale android inter-component analysis | 2016 | TRUE
Android: Static analysis using similarity distance | 2012 | TRUE
Using static analysis for automatic assessment and mitigation of unwanted and malicious activities within Android applications | 2011 | TRUE
Detecting software vulnerabilities in android using static analysis | 2014 | TRUE
Static analysis of android apps: A systematic literature review | 2017 | TRUE
Android Application Protection against Static Reverse Engineering based on Multidexing. | 2016 | TRUE
VAnDroid: A framework for vulnerability analysis of Android applications using a model-driven reverse engineering technique | 2019 | TRUE
Exploring reverse engineering symptoms in Android apps | 2015 | TRUE
Discovering optimal features using static analysis and a genetic search based method for Android malware detection | 2018 | TRUE
AndroShield: automated android applications vulnerability detection, a hybrid static and dynamic analysis approach | 2019 | TRUE
What static analysis can utmost offer for Android malware detection | 2019 | TRUE
RedDroid: Android application redundancy customization based on static analysis | 2018 | TRUE
Static and dynamic analysis of android malware. | 2017 | TRUE
Andlantis: Large-scale Android dynamic analysis | 2014 | TRUE
Static window transition graphs for Android | 2018 | TRUE
Reverse Engineering of Android Applications: REiMPAcT | 2020 | TRUE
Dexpler: converting android dalvik bytecode to jimple for static analysis with soot | 2012 | TRUE
Android applications scanning: The guide | 2019 | TRUE
A hybrid approach for reverse engineering GUI model from android apps for automated testing | 2017 | TRUE
An Android security case study with bauhaus | 2011 | TRUE
Detecting energy bugs in android apps using static analysis | 2017 | TRUE
Static analysis for extracting permission checks of a large scale framework: The challenges and solutions for analyzing android | 2014 | TRUE
Pscout: analyzing the android permission specification | 2012 | TRUE
Droid permission miner: Mining prominent permissions for Android malware analysis | 2014 | TRUE
Static and dynamic analysis of android malware. | 2017 | TRUE
Automatically securing permission-based software by reducing the attack surface: An application to android | 2012 | TRUE
Reevaluating android permission gaps with static and dynamic analysis | 2015 | TRUE
Two phase static analysis technique for android malware detection | 2015 | FALSE
ANASTASIA: ANdroid mAlware detection using STatic analySIs of Applications | 2016 | FALSE
DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware | 2013 | FALSE
DroidDet: effective and robust detection of android malware using static analysis along with rotation forest model | 2018 | FALSE
Machine learning for android malware detection using permission and api calls | 2013 | FALSE
An Android application risk evaluation framework based on minimum permission set identification | 2020 | TRUE
Analysis of android inter-app security vulnerabilities using covert | 2015 | FALSE
Static and dynamic analysis for android malware detection | 2016 | FALSE
Static detection of Android malware by using permissions and API calls | 2014 | FALSE
Static and dynamic analysis for android malware detection | 2018 | FALSE
A novel permission ranking system for android malware detection—the permission grader | 2020 | TRUE
An Android malware detection system based on machine learning | 2017 | FALSE
High accuracy android malware detection using ensemble learning | 2015 | FALSE
Detection of android malware by static analysis on permissions and sensitive functions | 2016 | TRUE
A study on static analysis model of mobile application for privacy protection | 2012 | FALSE
Vulnerability Parser: A Static Vulnerability Analysis System for Android Applications | 2019 | TRUE
Droidmat: Android malware detection through manifest and api calls tracing | 2012 | FALSE
Droidchecker: analyzing android applications for capability leak | 2012 | FALSE
S3ntinel: An Extensible Static Analysis Framework for Android Applications | 2018 | TRUE
Combining static analysis with probabilistic models to enable market-scale android inter-component analysis | 2016 | FALSE
Mobile-sandbox: having a deeper look into android applications | 2013 | FALSE
Jn-saf: Precise and efficient ndk/jni-aware inter-language static analysis framework for security vetting of android applications with native code | 2018 | FALSE
Android malware detection based on static analysis of characteristic tree | 2015 | FALSE
R-droid: Leveraging android app analysis with static slice optimization | 2016 | FALSE
ASAF: Android Static Analysis Framework | 2020 | FALSE
DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware | 2013 | FALSE
Effective inter-component communication mapping in android: An essential step towards holistic security analysis | 2013 | FALSE
Information flow analysis of android applications in droidsafe. | 2015 | FALSE
Andrubis–1,000,000 apps later: A view on current Android malware behaviors | 2014 | FALSE
Pscout: analyzing the android permission specification | 2012 | FALSE
Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps | 2014 | FALSE
Analysis of Bayesian classification-based approaches for Android malware detection | 2014 | FALSE
Effective real-time android application auditing | 2015 | FALSE
BigMAC: Fine-Grained Policy Analysis of Android Firmware | 2020 | TRUE
Efficient, context-aware privacy leakage confinement for android applications without firmware modding | 2014 | FALSE
Dynamic analysis of android malware | 2013 | FALSE
PARTEMU: Enabling Dynamic Analysis of Real-World TrustZone Software Using Emulation | 2020 | TRUE
Opening Pandora’s box through ATFuzzer: dynamic analysis of AT interface for Android smartphones | 2019 | FALSE
Code coverage measurement for Android dynamic analysis tools | 2015 | TRUE
FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware | 2020 | TRUE
DroidRay: a security evaluation system for customized android firmwares | 2014 | TRUE
Charm: Facilitating dynamic analysis of device drivers of mobile systems | 2018 | TRUE
New flash memory acquisition methods based on firmware update protocols for LG Android smartphones | 2018 | FALSE
Hybrid firmware analysis for known mobile and iot security vulnerabilities | 2020 | TRUE
AVATAR: A Framework to Support Dynamic Security Analysis of Embedded Systems’ Firmwares. | 2014 | TRUE
HALucinator: Firmware re-hosting through abstraction layer emulation | 2020 | TRUE
Vulnerability detection in iot firmware: A survey | 2017 | TRUE
Evading android runtime analysis through detecting programmed interactions | 2016 | FALSE
An analysis of pre-installed android software | 2020 | TRUE
Andrubis 1,000,000 apps later: A view on current Android malware behaviors | 2014 | FALSE
Toward Automated Firmware Analysis in the IoT Era | 2019 | FALSE
Detecting Android malware using long short-term memory (LSTM) | 2018 | FALSE
A collaborative framework for android malware detection using DNS & dynamic analysis | 2017 | FALSE
An analysis of pre-installed android software | 2020 | TRUE
DroidRay: a security evaluation system for customized android firmwares | 2014 | TRUE
System calls analysis of malwares on android | 2013 | FALSE
Dynamic analysis of android malware | 2013 | FALSE
Droidmate: a robust and extensible test generator for android | 2016 | FALSE
Samadroid: a novel 3-level hybrid malware detection model for android operating system | 2018 | FALSE
FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware | 2020 | TRUE
A machine-learning approach for classifying and categorizing android sources and sinks. | 2014 | FALSE
Vetting undesirable behaviors in android apps with permission use analysis | 2013 | FALSE
Beyond google play: A large-scale comparative study of chinese android app markets | 2018 | TRUE
Automated dynamic enforcement of synthesized security policies in android | 2015 | FALSE
The peril of fragmentation: Security hazards in android device driver customizations | 2014 | FALSE
Going native: Using a large-scale analysis of android apps to create a practical native-code sandboxing policy | 2016 | FALSE
Droidapiminer: Mining api-level features for robust malware detection in android | 2013 | FALSE
Evading android runtime analysis via sandbox detection | 2014 | FALSE
Analyzing android browser apps for file://vulnerabilities | 2014 | FALSE
A case study in open source software security and privacy: Android adware | 2012 | FALSE
Device administrator use and abuse in Android: Detection and characterization | 2019 | FALSE
Systematic detection of capability leaks in stock android smartphones. | 2012 | FALSE
Design and implementation of an android host-based intrusion prevention system | 2014 | FALSE
Malware detection using network traffic analysis in android based mobile devices | 2014 | TRUE
Andlantis: Large-scale Android dynamic analysis | 2014 | TRUE
CREDROID: Android malware detection by network traffic analysis | 2016 | TRUE
Ananas-a framework for analyzing android applications | 2013 | TRUE
Mobile-sandbox: having a deeper look into android applications | 2013 | TRUE
Android malware detection based on network traffic using decision tree algorithm | 2018 | TRUE
Identifying vulnerabilities of SSL/TLS certificate verification in Android apps with static and dynamic analysis | 2020 | TRUE
LIBSPECTOR: Context-Aware Large-Scale Network Traffic Analysis of Android Applications | 2020 | TRUE
Comparative study of k-means and mini batch k-means clustering algorithms in android malware detection using network traffic analysis | 2014 | TRUE
Rage against the virtual machine: hindering dynamic analysis of android malware | 2014 | TRUE
Malware detection in Android by network traffic analysis | 2015 | TRUE
Manilyzer: automated android malware detection through manifest analysis | 2014 | TRUE
AndroShield: automated android applications vulnerability detection, a hybrid static and dynamic analysis approach | 2019 | TRUE
Visualizing the outcome of dynamic analysis of Android malware with VizMal | 2020 | TRUE
IntelliDroid: A Targeted Input Generator for the Dynamic Analysis of Android Malware. | 2016 | TRUE
NTPDroid: a hybrid android malware detector using network traffic and system permissions | 2018 | TRUE
Static and dynamic analysis of android malware. | 2017 | TRUE
An in-depth analysis of Android malware using hybrid techniques | 2018 | TRUE
A novel dynamic Android malware detection system with ensemble learning | 2018 | TRUE
Mobile-Sandbox: combining static and dynamic analysis with machine-learning techniques | 2015 | TRUE
DroidDocker: Dynamic analysis of android applications on Docker | 2016 | TRUE
A new tool for static and dynamic Android malware analysis | 2018 | TRUE
Detecting repackaged android applications using perceptual hashing | 2020 | FALSE
Dynalize: Dynamic analysis of mobile apps in a platform-as-a-service cloud | 2015 | TRUE
Scredent: Scalable real-time anomalies detection and notification of targeted malware in mobile devices | 2016 | FALSE
Android malware detection through hybrid features fusion and ensemble classifiers: The AndroPyTool framework and the OmniDroid dataset | 2019 | FALSE
R2-d2: Color-inspired convolutional neural network (cnn)-based android malware detections | 2018 | FALSE
Grefenstette Bias based genetic algorithm for multi-site offloading using docker container in edge computing | 2019 | FALSE
Analysis and detection of malware in Android applications using machine learning | 2019 | FALSE
Android malware classification based on mobile security framework | 2018 | FALSE
Understanding the Security Risks of Docker Hub | 2020 | FALSE
Time-travel testing of Android apps | 2020 | FALSE
Concurrency-related flaky test detection in android apps | 2020 | FALSE
Dynamic malware analysis in the modern era. A state of the art survey | 2019 | FALSE
An empirical case study on the temporary file smell in dockerfiles | 2019 | FALSE
Performance tuning and modeling for big data applications in docker containers | 2017 | FALSE
Verifying Android Applications Using Java PathFinder | 2017 | FALSE
FastBuild: Accelerating Docker image building for efficient development and deployment of container | 2019 | FALSE
Andlantis: Large-scale Android dynamic analysis | 2014 | FALSE
Emulator vs real phone: Android malware detection using machine learning | 2017 | TRUE
Rage against the virtual machine: hindering dynamic analysis of android malware | 2014 | FALSE
A robust dynamic analysis system preventing SandBox detection by Android malware | 2015 | FALSE
Ananas-a framework for analyzing android applications | 2013 | FALSE
AndroShield: automated android applications vulnerability detection, a hybrid static and dynamic analysis approach | 2019 | FALSE
Dissecting the android bouncer | 2012 | FALSE
Static and dynamic analysis of android malware. | 2017 | FALSE
DynaLog: An automated dynamic analysis framework for characterizing android applications | 2016 | FALSE
ARTDroid: A Virtual-Method Hooking Framework on Android ART Runtime. | 2016 | FALSE
Ex-vivo dynamic analysis framework for Android device drivers | 2020 | FALSE
Condroid: Targeted dynamic analysis of android applications | 2015 | FALSE
Mobile-sandbox: having a deeper look into android applications | 2013 | TRUE
Glassbox: dynamic analysis platform for malware android applications on real devices | 2016 | TRUE
DDefender: Android application threat detection using static and dynamic analysis | 2018 | FALSE
DroidTrace: A ptrace based Android dynamic analysis system with forward execution capability | 2014 | FALSE
Droid-AntiRM: Taming control flow anti-analysis to support automated dynamic analysis of android malware | 2017 | FALSE
Effectiveness of state-of-the-art dynamic analysis techniques in identifying diverse Android malware and future enhancements | 2020 | FALSE
DaVinci: Android App Analysis Beyond Frida via Dynamic System Call Instrumentation | 2020 | TRUE
ARTDroid: A Virtual-Method Hooking Framework on Android ART Runtime. | 2016 | TRUE
EDAroid: An Efficient Dynamic Analysis Tool for Android Applications | 2020 | TRUE
T2Droid: A TrustZone-based dynamic analyser for Android applications | 2017 | TRUE
Toward developing a systematic approach to generate benchmark android malware datasets and classification | 2018 | TRUE
On the (un) reliability of privacy policies in android apps | 2020 | TRUE
Honey, i shrunk your app security: The state of android app hardening | 2018 | FALSE
Two Anatomists Are Better than One—Dual-Level Android Malware Detection | 2020 | FALSE
An Automated Assessment of Android Clipboards | 2020 | TRUE
ARTist-A novel ins trumentation framework for reversing and analyzing android apps and the middleware | 2019 | TRUE
Bringing Balance to the Force: Dynamic Analysis of the Android Application Framework | 2021 | TRUE
Android Hook Detection Based on Machine Learning and Dynamic Analysis | 2020 | TRUE
Remote runtime detection of tampering and of dynamic analysis attempts for Android apps | 2019 | TRUE
Evaluating Dynamic AnalysisMethods for Android Applications | 2017 | TRUE
Exploring Syscall-Based Semantics Reconstruction of Android Applications | 2019 | TRUE
A Hidden File Extraction Scheme Defeating Malware Using Android Dynamic Loading | 2019 | TRUE
Aspectdroid: Android app analysis system | 2016 | TRUE
DynaLog: An automated dynamic analysis framework for characterizing android applications | 2016 | TRUE
Droidward: an effective dynamic analysis method for vetting android applications | 2018 | TRUE
Reevaluating android permission gaps with static and dynamic analysis | 2015 | TRUE
IntelliDroid: A Targeted Input Generator for the Dynamic Analysis of Android Malware. | 2016 | TRUE
Towards dynamically monitoring Android applications on non-rooted devices in the wild | 2018 | FALSE
AndroShield: automated android applications vulnerability detection, a hybrid static and dynamic analysis approach | 2019 | TRUE
Code coverage measurement for Android dynamic analysis tools | 2015 | FALSE
DroidTrace: A ptrace based Android dynamic analysis system with forward execution capability | 2014 | TRUE
Security assessment of code obfuscation based on dynamic monitoring in android things | 2017 | TRUE
DroidDolphin: a dynamic Android malware detection framework using big data and machine learning | 2014 | TRUE
The state of Android security | 2020 | TRUE
Effectiveness of state-of-the-art dynamic analysis techniques in identifying diverse Android malware and future enhancements | 2020 | TRUE
Rage against the virtual machine: hindering dynamic analysis of android malware | 2014 | TRUE
Analysis of malicious behavior of android apps | 2016 | FALSE
DroidInjector: A process injection-based dynamic tracking system for runtime behaviors of Android applications | 2017 | TRUE
Malicious behavior analysis for android applications | 2016 | FALSE
A novel dynamic Android malware detection system with ensemble learning | 2018 | FALSE
DroidMonitor: a high-level programming model for dynamic API monitoring on Android | 2015 | TRUE
Mobile-sandbox: having a deeper look into android applications | 2013 | FALSE
DroidTrace: A ptrace based Android dynamic analysis system with forward execution capability | 2014 | TRUE
Droidward: an effective dynamic analysis method for vetting android applications | 2018 | TRUE
Real time android ransomware detection by analyzed android applications | 2019 | TRUE
IntelliDroid: A Targeted Input Generator for the Dynamic Analysis of Android Malware. | 2016 | TRUE
Towards dynamically monitoring Android applications on non-rooted devices in the wild | 2018 | FALSE
Aspectdroid: Android app analysis system | 2016 | TRUE
A novel dynamic Android malware detection system with ensemble learning | 2018 | FALSE
Samadroid: a novel 3-level hybrid malware detection model for android operating system | 2018 | FALSE
A hybrid approach of mobile malware detection in Android | 2017 | FALSE
Malware detection in android based on dynamic analysis | 2017 | FALSE
Android based mobile application development and its security | 2012 | FALSE