Hooker is an opensource project for dynamic analysis of Android applications. This project provides various tools and applications that can be use to automaticaly intercept and modify any API calls made by a targeted application. It leverages Android Substrate framework to intercept these calls and aggregate all their contextual information (parameters, returned values, ...) in an elasticsearch database. A set of python scripts can be used to automatize the execution of an analysis in order to collect any API calls made by a set of applications.
Technical Description
Hooker is made of multiple modules:
- APK-instrumenter is an Android application that must be installed prior to the analysis on an Android device (for instance, an emulator).
- hooker_xp is a python tool that can be use to control the android device and trigger the installation and stimulation of an application on it.
- hooker_analysis is a python script that can be use to collect results stored in the elasticsearch database.
- tools/APK-contactGenerator is an Android application that is automatically installed on the Android device by hooker_xp to inject fake contact informations.
- tools/apk_retriever is a Python tool that can be use to download APKs from various online public Android markets.
- tools/emulatorCreator is a script that can be use to prepare an emulator.