Get more intimate with your phone apps
Android had amazing debug tools called adb you can uninstall/install packages, get where it comefrome and of course brick your own phone due its powerful features.
Like usual today I mess again with Adware, but this time I want to share my bread and butter how to deal with anoying things in androids.
Disclaimer: Android malware wont easy to be detected like usually in desktop, encrypted payload and Matroshka logic render the detection fail. So proofing by log from they trace directly, which is risky to do.
adb logcat ActivityTaskManager:I '*:S'
This looking for UI page (activity) changes, usefull to detect popus. Keep mind with timestamp and the time the pop-us or weird behaivour happening.
adb shell dumpsys activity services
There also type of activity that render no UI : Services, usually the purpose to run in background like notification, music player or VPN. But that not stop there, because it could simply to run periodicaly.
Kill the apps:
adb shell am force-service <com.package.example>
Replace any
<com.package.example>with package name you want to take action.
This basically kill services process of the packages,
alternatively you could kill the process individualy using adb shell kill <PID>.
adb shell dumpsys activity processes
or, if you prefer Linux process tree (invoking toybox ps):
adb shell ps
Like common operating system, android had process entries that list a program that currently running in the system. All services and logcat show process ID (PID), so to kill a process do like these:
adb shell kill <PID>
adb shell cmd package list packages -f -U -l
This listing the packages name with it base.apk path and its UID. To get the apk, do this:
adb pull <the apk path, /data/.../base.apk> <package.name.apk>
adb shell dumpsys package <com.package.example>
This will dump the info about the package inculding their path, permissions, when they installed also from where they came and much more of the properties of the applications and it relations with the operating system.
This is place you to put verdict whether the apps is truly suspicious, like how many it need permission but not show correlation with the feature it holds (thinks calculator need permission for camera or GPS while the no such feature for it), verification domain (the TTP's) or else.
adb shell dumpsys package <com.package.example> | grep -i "firstInstallTime\|lastUpdateTime\|installer"
adb shell pm disable-user --user 0 <com.package.example>
Put the apps into disabled state, in wont running in time being, usually useful for system apps.
adb uninstall <com.package.example>
Self-explanatory.
This method is usually way I use to find and analyze suspicious behavior in my phone, its no need root. Think it basic malware analysis in Android.
Enjoy this ? Please consider rooting for Yukari's craft.