Android-Dynamic-Analysis.md

Also it provides a group open-API for developer. It can trace Apk view without source code. So it also can be used in black-box testing of Android Development.

It is based on tracing apk view, and it implement two functions for Android development :

It provides apk automated testing interface.
It provides a event trigger tool for apk dynamic analysis.

adb auto-complete

http://romannurik-code.googlecode.com/git/misc/bash_completion/adb

AndBug is a debugger targeting the Android platform's Dalvik virtual machine intended for reverse engineers and developers. It uses the same interfaces as Android's Eclipse debugging plugin, the Java Debug Wire Protocol (JDWP) and Dalvik Debug Monitor (DDM) to permit users to hook Dalvik methods, examine process state, and even perform changes.

android_debug

https://github.com/wuntee/android_debug

agdb

http://code.google.com/p/rxwen-blog-stuff/source/browse/trunk/tools/agdb.py

An Android cross platform gdb wrapper.

GDB 7.4.1 for Android

http://gnutoolchains.com/android/

Android-OpenDebug

Make any application debuggable on a device.

https://github.com/iSECPartners/Android-OpenDebug

NDroid

A dynamic information flow tracing system for Android

https://github.com/0-14N/NDroid

db-wa

Web App and Database for DroidBox

https://github.com/bbokorney/db-wa

Injection, Hooking and Instrumentation

dexposed

dexposed enable 'god' mode for single android application.

https://github.com/alibaba/dexposed

android-lkms

Android Loadable Kernel Modules - mostly used for reversing and debugging on controlled systems/emulators

https://github.com/strazzere/android-lkms

aihl

Android import hook library

https://github.com/HiddenRambler/aihl

AndroidEagleEye

An Xposed based module which is capable of hooking both Android system APIs and applications' methods.

https://github.com/MindMac/AndroidEagleEye

SqlCipherHook

Xposed module for obtaining SQLCipher crypto keys

https://github.com/jakev/SqlCipherHook

arminject

An application to dynamically inject a shared object into a running process on ARM architectures.

https://github.com/evilsocket/arminject

AllHookInOne

A project contains all method hook approachs for android such as dalvik hook, art hook, elf hook and inline hook

https://github.com/boyliang/AllHookInOne

APKIL

https://github.com/kelwin/apkil

http://code.google.com/p/droidbox/wiki/APIMonitor

injection_by_ptrace

https://github.com/boyliang/injection_by_ptrace

ltrace

https://github.com/floe/ltrace

hooker

Hooker is an opensource project for dynamic analyses of Android applications. This project provides various tools and applications that can be use to automaticaly intercept and modify any API calls made by a targeted application.

https://github.com/AndroidHooker/hooker

apkil_apimonitor

This is an extension from DroidBox APIMonitor to instrument and monitor the entry and exit of specified methods.

https://github.com/ericjyc/apkil_apimonitor

Valgrind

http://valgrind.org

Sandbox

DroidBox

http://code.google.com/p/droidbox/

DroidBox provides:

an Android system image, which can log and output behaviours of applications running in it.
APIMonitor, a tool which can automatically modify APK file and add log codes for sensitive APIS.

taintdroid_runner

https://github.com/dbaeumges/taintdroid_runner

Anubis

http://anubis.iseclab.org

Andrubis executes Android apps in a sandbox and provides a detailed report on their behavior, including file access, network access, crypto operations, dynamic code loading and information leaks. In addition to the dynamic analysis in the sandbox, Andrubis also performs static analysis, yielding information on e.g. the app's activities, services, required external libraries and actually required permissions.

Tracedroid

http://tracedroid.few.vu.nl

CobraDroidBeta

CobraDroid is a custom build of the Android operating system geared specifically for application security analysts and for individuals dealing with mobile malware.

https://github.com/jakev/CobraDroidBeta