Project:AppAudit - Revision history

Genferei: /* 8.9(Le Temps, Watson Actu) */

2022-08-10T03:50:52Z

8.9(Le Temps, Watson Actu)

Haixinshi at 22:51, 9 August 2022

2022-08-09T22:51:05Z

Haixinshi at 07:52, 8 August 2022

2022-08-08T07:52:01Z

Haixinshi at 22:48, 7 August 2022

2022-08-07T22:48:54Z

Haixinshi at 14:35, 4 August 2022

2022-08-04T14:35:27Z

Haixinshi: /* Questions: */

2022-08-03T23:16:21Z

Questions:

Haixinshi at 23:15, 3 August 2022

2022-08-03T23:15:59Z

Genferei: /* 8.2(Le Temps) */

2022-08-03T13:29:14Z

8.2(Le Temps)

Haixinshi at 23:04, 2 August 2022

2022-08-02T23:04:08Z

Haixinshi at 23:00, 29 July 2022

2022-07-29T23:00:09Z

@@ Line 4: / Line 4: @@
 # Discuss with Chengyang and Andreas about the plan of App Audit project.
 # Write a [https://github.com/hestiaAI/hestialabs-bubble-server/issues/18#issuecomment-1209520952 report] to explain the design of whole App Audit system in details and set up plans this week.
 === Questions: ===
-What should the priority of current plans? Building up a coarse "Manager App" or try to explore Criteo?
+What should the priority of current plans? Building up a coarse "Manager App" or try to explore Criteo?  ''1- a coarse "Manager App"''
 === Plans: ===
 # Develop a very coarse mobile app that manages data stored by modified apps, which is named ”Manager App”. It can read the data in public folders and send it to a simple http server.
-# Work on the app le monde to understand how criteo intervenes. but it seems complicated because there is no criteo sdk.
+# Work on the app le Monde to understand how criteo intervenes. but it seems complicated because there is no criteo sdk.
 # Work on the app muslim pro which has the sdk of criteo.
 == 8.8([[Item:Q1185|Le Temps]], [[Item:Q5452|Watson Actu]]) ==
 === Progress: ===

@@ Line 1: / Line 1: @@
 This is a good place for [[User:Haixinshi]] to discuss his progress [[User:Podehaye|Podehaye]] ([[User talk:Podehaye|talk]])
 == 8.5([[Item:Q1185|Le Temps]], [[Item:Q5452|Watson Actu]]) ==
 === Progress: ===
 # Optimize dynamic hooking scripts, now it can hook functions in batch and support filtering. I used Python scripts to retrieve class name(with package names) from path of files in decompile folders. In this case, I can get the class names in batch and hook classes in batch(in specific directories). I believe Frida-Server can support the same competence as the framework I used in ByteDance and my ex-leader told me they also use Frida now :)
 # Google Ad still looks difficult. I hooked ALL functions that involves string related to “bid”, “currency” and “rtb”, but they are not called.
-# Analyze the Tencent SDK and VK SDK in Watson Actu, which was proposed by MP. The following functions in Tencent SDK are called. But no function in VK SDK is called. I explored Tencent SDK and found that [https://github.com/Kainanchen/Sangokushi/blob/80fdb55c92776690b9b02aa0a6fba3dc7790025e/com/tencent/wxop/stat/StatServiceImpl.java] tries to track events.
+# Analyze the Tencent SDK and VK SDK in Watson Actu, which was proposed by MP. The following functions in Tencent SDK are called. But no function in VK SDK is called. I explored Tencent SDK and found that [https://github.com/Kainanchen/Sangokushi/blob/80fdb55c92776690b9b02aa0a6fba3dc7790025e/com/tencent/wxop/stat/StatServiceImpl.java StatServiceImpl] tries to track events.
 * com.tencent.wxop.stat.common.StatLogger@7f01327----#setDebugEnable is called, and the parameters are:
 false

@@ Line 4: / Line 4: @@
 # Optimize dynamic hooking scripts, now it can hook functions in batch and support filtering. I used Python scripts to retrieve class name(with package names) from path of files in decompile folders. In this case, I can get the class names in batch and hook classes in batch(in specific directories). I believe Frida-Server can support the same competence as the framework I used in ByteDance and my ex-leader told me they also use Frida now :)
 # Google Ad still looks difficult. I hooked ALL functions that involves string related to “bid”, “currency” and “rtb”, but they are not called.
-# Analyze the Tencent SDK and VK SDK in Watson Actu, which was proposed by MP. The following functions in Tencent SDK are called. But no function in VK SDK is called.
+# Analyze the Tencent SDK and VK SDK in Watson Actu, which was proposed by MP. The following functions in Tencent SDK are called. But no function in VK SDK is called. I explored Tencent SDK and found that [https://github.com/Kainanchen/Sangokushi/blob/80fdb55c92776690b9b02aa0a6fba3dc7790025e/com/tencent/wxop/stat/StatServiceImpl.java] tries to track events.
 * com.tencent.wxop.stat.common.StatLogger@7f01327----#setDebugEnable is called, and the parameters are:
 false

@@ Line 1: / Line 1: @@
 This is a good place for [[User:Haixinshi]] to discuss his progress [[User:Podehaye|Podehaye]] ([[User talk:Podehaye|talk]])
-== 8.4([[Item:Q1185|Le Temps]]) ==
+== 8.5([[Item:Q1185|Le Temps]], [[Item:Q5452|Watson Actu]]) ==
 === Progress: ===
-# Find the way to show the price of ads in Le Temps. [https://github.com/appnexus/mobile-sdk-android/blob/10897bb76706e1df00778750a7a214f3b172fde8/sdk/src/com/appnexus/opensdk/AdWebView.java#L266 Here] is a good place to inject price!
+# Optimize dynamic hooking scripts, now it can hook functions in batch and support filtering. I used Python scripts to retrieve class name(with package names) from path of files in decompile folders. In this case, I can get the class names in batch and hook classes in batch(in specific directories). I believe Frida-Server can support the same competence as the framework I used in ByteDance and my ex-leader told me they also use Frida now :)
 === Questions: ===
+No
 === Plans: ===
+# Optimize Scripts that apply Frida-Server API
+# Analyze Google Ads in Watson Actu.
 == 8.3([[Item:Q1185|Le Temps]]) ==
 === Progress: ===

@@ Line 1: / Line 1: @@
 This is a good place for [[User:Haixinshi]] to discuss his progress [[User:Podehaye|Podehaye]] ([[User talk:Podehaye|talk]])
 == 8.3([[Item:Q1185|Le Temps]]) ==
 === Progress: ===

@@ Line 4: / Line 4: @@
 # Successfully built up Frida-Server pipeline. Without modifying the source code of app. I can dynamically output all data that flows in interesting functions. Besides, I can get calling relationships(stack trace back) dynamically.
 === Questions: ===
-Question: MP-->''Could please explain more what Frida could do?''
+* Question: MP-->''Could please explain more what Frida could do?''
-Answer: [https://frida.re/docs/home/ Here] explains that Frida can easily inject our logics into app's functions, which exposes the information that the functions are called or not(We could inject some logging code into target functions, and when they are called, our logs will show up); besides, we can show the parameters(data). All things I did before(modify SMALI code of apps -> compile the modified code -> build and sign app -> run the app -> watch console and find our logs to see what happens in a target function) CAN BE REPLACE by Frida Server. Because this tool can help us easily inject codes into an app without modifying the app even when the app is running(I submit the injected scripts and then results will be available right away)! To conclude, this tool can help us analyze the SDKs efficiently. But at the end, we still have to modify smali code to get our product after we find the target functions and understand the logits.
+* Answer: [https://frida.re/docs/home/ Here] explains that Frida can easily inject our logics into app's functions, which exposes the information that the functions are called or not(We could inject some logging code into target functions, and when they are called, our logs will show up); besides, we can show the parameters(data). All things I did before(modify SMALI code of apps -> compile the modified code -> build and sign app -> run the app -> watch console and find our logs to see what happens in a target function) CAN BE REPLACE by Frida Server. Because this tool can help us easily inject codes into an app without modifying the app even when the app is running(I submit the injected scripts and then results will be available right away)! To conclude, this tool can help us analyze the SDKs efficiently. But at the end, we still have to modify smali code to get our product after we find the target functions and understand the logits.
 === Plans: ===
 # Try to find all class names by code or tool. And the class names can be fed into my scripts and then I can hook all functions in the app at one shot.

@@ Line 2: / Line 2: @@
 == 8.2([[Item:Q1185|Le Temps]]) ==
 === Progress: ===
-# Successfully built up Frida-Server in ROOT environment. It is very exciting, since:
+# Successfully built up [https://github.com/frida/frida Frida-Server] in ROOT environment. It is very exciting, since:
 * Previously, when I want to verify that an interesting function is called or not, I have to first modified the corresponding smali code to Log something, then compile,  then build the app and analyze logs on adb console, which would cost time;
 * Now, I can write JS code directly and hook target functions DYNAMICALLY, which means that I do not need to modify the source code of apps, and I can easily verify the functions being called and the data flowing in them.
@@ Line 9: / Line 9: @@
 === Questions: ===
 # It is not very efficient for me to do static analysis(function names are obfuscated and the calling relationships are complex), but now dynamic hooking is very convinient for me; therefore, I can show you more data that flows in the app.
 === Plans: ===
 # Now I can not dynamically hook A BATCH OF functions at a time. But I will try to fix the bugs and it is practical for me.
-# Try to implement the effect of showing the price of advertisement on UI by finding the connection between UI and data processing functions in LeTemps+AppNexus. But it is not promissing so far.
+# Try to implement the effect of showing the price of advertisement on UI by finding the connection between UI and data processing functions in LeTemps+AppNexus. But it is not promising so far.
 == 7.29([[Item:Q1185|Le Temps]], [[Item:Q5452|Watson Actu]]) ==
 === Progress: ===