Result Analysis #7
Comments
|
Hi Abhishekpratapsingh, In order to help you, we need more information about your environment et what you describe... Can you please list:
Concerning your second question, you can store results in a file when you set the file_mode parameter to true in your hooker_xp configuration file. |
|
--Thanks for replying :) ----------- Configuration file content ----------- --# Path to the Android SDK --# Path to your local Android temporary directory --# Path to androguard framework --# type of device (real or emulated) --# --# --# activate or not the creation of a text report containing all the captured events --In which file (name + the path ) are the dynamic results getting stored ? --Log of Analysis --[MainProcess/MainThread/DEBUG] 768: Initialize the Elasticsearch reporter --Main Conf: --[MainProcess/MainThread/WARNING] 777: 12.apk --# File configuration --[analysis] --[MainProcess/MainThread/DEBUG] 101675: Executing command ['/home/abhishek/Downloads/android-sdk-linux/platform-tools/adb', '-s', 'emulator-5554', 'shell', 'mkdir', '/mnt/sdcard/hooker/'] --I ran this query --curl -XGET 'http://localhost:9200/*' --{"hooker_test":{"aliases":{},"mappings":{"apk":{"_id":{"path":"IDAPK"},"_timestamp":{"enabled":true,"path":"Timestamp"},"properties":{"Author":{"type":"string"},"Category":{"type":"string"},"Description":{"type":"string"},"Filename":{"type":"string"},"Filesha1":{"type":"string"},"Filesize":{"type":"long"},"IDAPK":{"type":"string"},"Market":{"type":"string"},"Name":{"type":"string"},"Timestamp":{"type":"date","format":"dateOptionalTime"},"Url":{"type":"string"},"Version":{"type":"string"}}},"static":{"_parent":{"type":"experiment"},"_routing":{"required":true},"_timestamp":{"enabled":true,"path":"Timestamp"},"properties":{"Activities":{"type":"nested","properties":{"Activity":{"type":"string"}}},"Android Version Code":{"type":"string"},"Android Version Name":{"type":"string"},"Filename":{"type":"string","index":"not_analyzed"},"Libraries":{"type":"nested","properties":{"Library":{"type":"string"}}},"Main Activity":{"type":"string"},"Max SDK Version":{"type":"string"},"Min SDK Version":{"type":"string"},"PackageName":{"type":"string"},"Permissions":{"type":"nested","properties":{"Permission":{"type":"string"}}},"Providers":{"type":"nested","properties":{"Provider":{"type":"string"}}},"Receivers":{"type":"nested","properties":{"Receiver":{"type":"string"}}},"Services":{"type":"nested","properties":{"Service":{"type":"string"}}},"Timestamp":{"type":"date","format":"dateOptionalTime"}}},"event":{"_parent":{"type":"experiment"},"_routing":{"required":true},"_timestamp":{"enabled":true,"path":"Timestamp"},"properties":{"ClassName":{"type":"string"},"Data":{"properties":{"DataName":{"type":"string"},"DataValue":{"type":"string"}}},"HookerName":{"type":"string","index":"not_analyzed"},"IntrusiveLevel":{"type":"short"},"MethodName":{"type":"string"},"PackageName":{"type":"string"},"Parameters":{"type":"nested"},"RelativeTimestamp":{"type":"long"},"Return":{"properties":{"ParameterType":{"type":"string"},"ParameterValue":{"type":"string"}}},"Timestamp":{"type":"date","format":"dateOptionalTime"}}},"experiment":{"_id":{"path":"IDXP"},"_timestamp":{"enabled":true,"path":"Timestamp"},"properties":{"Analysis":{"type":"string"},"Analyzed":{"type":"boolean"},"Author":{"type":"string","index":"not_analyzed"},"Description":{"type":"string"},"Emulator":{"type":"string","index":"not_analyzed"},"Filename":{"type":"string"},"Filesha1":{"type":"string"},"IDXP":{"type":"string"},"PackageName":{"type":"string"},"Timestamp":{"type":"date","format":"dateOptionalTime"}}}},"settings":{"index":{"creation_date":"1432647592995","uuid":"u7ZB4uulRGOelFRg0t3IRA","number_of_rep |
|
Hi Abhishekpratapsingh, |
|
--Hi Tibap, --LOG ERROR --emulator: ERROR: Unable to load VM from snapshot. The snapshot has been saved for a different hardware configuration. |
|
Hi Abhishekpratapsingh,
|
|
--The query " export ANDROID_HOME=/home/abhishek/Downloads/android-sdk-linux " gave empty results but the data was actually stored in the database which i could access after installing the suggested plugin. --After setting up the environment . I edited the emulator by UNTICKING the snapshot option,this resolved the "Can't launch from the snapshot Error". --But now it gets stuck while emulating the actions (intends). It was stuck on the same state for 15 minutes or so. --LOG --[MainProcess/MainThread/INFO] 145084: Once achieved, close the device and waits for the hooker to finish. --Any idea about it? |
|
Please try to reply ASAP :) |
|
Hi Abhishekpratapsingh, |
|
Thanks for the suggestion Tibap,I changed my previous comments on this issue to increase the readability of this issue. |
|
Abhishekpratapsingh, |
|
Hi, |
|
Abhishekpratapsingh, |
|
I tried at least 3 times creating new reference Emulators but the "Can't launch from the snapshot Error" just won't go. |
|
Well, this is not normal then... From my point of view, this is not a bug from Hooker. Did you check on the internet if someone else has found similar bug using the android emulator? Did you try with another version? |
|
Which system image did you choose for the emulation (ARM or INTEL) ? |
|
ARM image. |
|
I have the same problem as Abhishekpratapsingh. I have no lucky to launch Emulators from snapshot for one time, always the annoying "Can't launch from the snapshot Error". Definitely, hooker is not the cause. However, when this problem persist, I fail to experience this tool. From Tibap's response, it seems this problem happens occasionally. why 100 percent here? any clue? |
|
Guys, |
|
For your interest, the new version of Hooker now has the |
For some reasons actual data is not getting stored in my database,only their datatype are getting stored up on the elastic search database,even though the dynamic analysis ran successfully.
(Also what's up with the events.logs file ,where is it stored ? )
Can I somehow get the result of the analysis in a .txt file or is there some other way to extract the information out of the dynamic analysis done by the tool ?
Thanks in Advance :)
The text was updated successfully, but these errors were encountered: