Android Malware Analysis Framework

🔍 A professional, end-to-end toolkit to automate APK extraction, static & dynamic analysis, and store forensic data in MySQL. Perfect for security researchers and devs who mean business.

---

📋 Table of Contents

1. Features
2. Architecture
3. Prerequisites
4. Installation
5. Directory Layout
6. Usage
7. Database Schema
8. Troubleshooting
9. Contributing
10. License & Contact

---

🚀 Features

• Automated APK Extraction from rooted devices
• Static Analysis: Parse AndroidManifest.xml, permissions, signatures
• Dynamic Analysis:
  • Logcat capture & parsing
  • Syscall Tracing with strace
  • Network Traffic via tcpdump + tshark
  • System Metrics: CPU, memory, battery
• Event Detection: Flag suspicious syscalls, file access, network anomalies
• MySQL Integration: Predefined schema for comprehensive data storage
• FastAPI backend: Trigger scans and fetch results via REST APIs

---

🏗 Architecture

+----------------+     +----------------+     +-------------+
| Rooted Device  | --> | Controller     | --> | MySQL DB    |
| (Android ADB)  |     | (Python + ADB) |     | (Schema)    |
+----------------+     +----------------+     +-------------+
       |                      |
       v                      v
  APK Puller           Collectors (Logcat,  
                       Strace, Tcpdump,   
                       Metrics, FileOps)  

• Controller orchestrates all modules
• Collectors run in parallel/sequence for each app
• Database stores raw & processed data for querying

---

🎯 Prerequisites

• Rooted Android device or emulator
• ADB, strace, tcpdump binaries on device
• Python 3.8+ environment
• MySQL 5.7+
• Wireshark CLI (tshark) for HTTP parsing

---

📦 Installation

# Clone & enter directory
git clone https://github.com/yourorg/Android-Malware-Analysis.git
cd Malware-Analysis

# Setup Python environment
python3 -m venv .venv
source .venv/bin/activate  # Windows: .venv\Scripts\activate

# Install Python dependencies
pip install -r requirements.txt

# Ensure device tools
adb devices         # should list your device
adb root            # switch to root
# Push binaries if missing
adb push tcpdump /data/local/tmp/ && adb shell chmod +x /data/local/tmp/tcpdump
adb push strace /data/local/tmp/ && adb shell chmod +x /data/local/tmp/strace

---

🗂 Directory Layout

project_root/
├── app/
│   ├── main.py                # FastAPI server entrypoint
│   ├── analyzer.py            # Core orchestration
│   ├── db.py            # MySQL helpers
│   ├── adb_handler.py
│   ├── controller.py
│   └── modules/
│       ├── apk_extractor.py   # APK & metadata parser
│       ├── apk_scanner.py
│       ├── db_utils.py
│       ├── log_collector.py
│       ├── strace_collector.py
│       ├── tcpdump_collector.py
│       ├── system_metric.py
├── extracted_apks/                      # Pulled APK files
├── pcaps/                      # Traces, pcaps, system logs
├── requirements.txt
└── run_server.sh              # Start FastAPI server

---

🏃 Usage

1. Start FastAPI Server

./run_server.sh
# → uvicorn app.main:app --reload

2. Trigger Full Scan

POST http://127.0.0.1:8000/scan

• Response: { "status": "Scan complete", "details": {...} }

3. Query the Database

SELECT * FROM apps;
SELECT * FROM events WHERE severity = 'High';
SELECT * FROM network_traffic WHERE response_code <> 200;

---

🗄 Database Schema

• apps: APK metadata & permissions (JSON)
• logs: Logcat entries per app
• events: Syscall & file-access anomalies
• network_traffic: IPs, URLs, HTTP methods & codes
• system_metrics: CPU, memory, battery usage
• syscalls: Raw syscall traces
• files_accessed: File operations logs

(See mysql_schema.sql for full definitions)

---

🛠 Troubleshooting

• ADB unauthorized: adb kill-server → reconnect → authorize
• Missing binaries: Push tcpdump/strace via ADB, set chmod +x
• MySQL errors: Validate .env credentials, ensure DB & tables exist
• tshark errors: Install Wireshark CLI (sudo apt install tshark)

---

🤝 Contributing

1. Fork & branch: git checkout -b feature/awesome
2. Commit: `git commit -m "feat: add new collector"
3. PR: Open a pull request, reference issues

---

📄 License & Contact

• Licensed under the MIT License
• Maintained by Ashwin
• Questions? Reach out: ashwin.vp.2005@gmail.com

---

_{Designed with ❤️ & ☕ for serious Android forensics.}