[Android Software/Hacking General [Developers Only]] oF2pks:
>TRACKERS< apk static analysis was already available, on android, with AddonsDetectors ; thanks to non-profit εxodus, we have an open source, multi-platform tool, to analyze embedded trackers in apk, on android & PCs, using dexdump.

With it, Rom-developers can scan their already built apps, like webview or Turbo (DeviceHealthServices Google LLC), to countercheck their 'integrity'.

Analysis is based on cross examination of

εxodusJSON

& dexdump*apk. On android, dexdump can be found in /system/bin https://exodus-privacy.eu.org/media/static_analysis.png

For Playstore installed apps only , you can straight use open-source εxodus.apk https://play.google.com/store/apps/details?id=org.eu.exodus_privacy.exodusprivacy, or directly query online.

On PCs with python3 (&virtualenv), check exodus-standalone to scan any kind of apps package: *apk.

Otherwise with bash (& attached aapt-dexdump_Linux64.tar.gz with lib64/libc++.so) and working grep -P (pcre) you can also perform any apk like (latest Playstore) firefox61.0.2:

./dexdump firefox.apk | grep "Class descriptor" | sed 's/ Class descriptor : //' | grep / | sed 's/\//./g' |sort | uniq > tt.txt

curl -s https://reports.exodus-privacy.eu.org/api/trackers | grep -Po '"code_signature":.*?[^\\]",' | sed 's/"code_signature": //' | sed 's/"",/".",/' | sed 's/|/",\n"/g' | sed 's/"//' | sed 's/",//' | sort | uniq | sed -n '1!p' | xargs -I {} grep {} tt.txt

or simply use attached today signatures :

cat signatures20182408.txt | xargs -I {} grep {} tt.txt

To get more info on apk :

./aapt d badging firefox.apk

On android copy firefox.apk on sdcard

cd sdcard && curl32 -s https://reports.exodus-privacy.eu.org/api/trackers | grep64 --buffer-size=10000K -o '"code_signature":.*?[^\\]",' | sed 's/"code_signature": //' | sed 's/"",/".",/' | sed 's/|/",\n"/g' | sed 's/"//' | sed 's/",//' | sort | uniq | sed -n '1!p' > signatures.txt

--> code signature of these trackers in firefox

Adjust...com.adjust.sdk. *41
Google Analytics...com.google.android.gms.analytics. *112
Google Firebase Analytics...com.google.android.gms.measurement. *125
LeanPlum...com.leanplum. *262

[εxodus-STANDALONE: python exodus_analyze.py firefox.apk]

=== Information
- APK path: firefox.apk
- APK sum: 31ca22d9977f14b0cf13fa0075ac2acc96070491086498819f1c9adbf92223a8
- App version: 61.0.2
- App version code: 2015574793
- App UID: 0992532694558859C09D4071243035F6FE5A20EC
- App name: Firefox
- App package: org.mozilla.firefox
- App permissions: 32
- android.permission.GET_ACCOUNTS
- android.permission.ACCESS_NETWORK_STATE
- android.permission.MANAGE_ACCOUNTS
- android.permission.USE_CREDENTIALS
- android.permission.AUTHENTICATE_ACCOUNTS
- android.permission.WRITE_SYNC_SETTINGS
- android.permission.WRITE_SETTINGS
- android.permission.READ_SYNC_STATS
- android.permission.READ_SYNC_SETTINGS
- org.mozilla.firefox_fxaccount.permission.PER_ACCOUNT_TYPE
- com.google.android.c2dm.permission.RECEIVE
- org.mozilla.firefox.permission.C2D_MESSAGE
- com.samsung.android.providers.context.permission.WRITE_USE_APP_FEATURE_SURVEY
- android.permission.CHANGE_WIFI_STATE
- android.permission.ACCESS_WIFI_STATE
- android.permission.ACCESS_COARSE_LOCATION
- android.permission.ACCESS_FINE_LOCATION
- android.permission.ACCESS_NETWORK_STATE
- android.permission.INTERNET
- android.permission.RECEIVE_BOOT_COMPLETED
- android.permission.READ_EXTERNAL_STORAGE
- android.permission.WRITE_EXTERNAL_STORAGE
- com.android.launcher.permission.INSTALL_SHORTCUT
- com.android.launcher.permission.UNINSTALL_SHORTCUT
- com.android.browser.permission.READ_HISTORY_BOOKMARKS
- android.permission.WAKE_LOCK
- android.permission.VIBRATE
- android.permission.DOWNLOAD_WITHOUT_NOTIFICATION
- android.permission.SYSTEM_ALERT_WINDOW
- android.permission.NFC
- android.permission.RECORD_AUDIO
- android.permission.CAMERA
- Certificates: 1
- Issuer: countryName=US, stateOrProvinceName=California, localityName=Mountain View, organizationName=Mozilla Corporation, organizationalUnitName=Release Engineering, commonName=Release Engineering
Subject: countryName=US, stateOrProvinceName=California, localityName=Mountain View, organizationName=Mozilla Corporation, organizationalUnitName=Release Engineering, commonName=Release Engineering
Fingerprint: 920f4876a6a57b4a6a2f4ccaf65f7d29ce26ff2c
Serial: 1282604424
=== Found trackers: 4
- Google Firebase Analytics
- LeanPlum
- Google Analytics
- Adjust

./aapt d badging firefox.apk

package: name='org.mozilla.firefox' versionCode='2015574793' versionName='61.0.2' platformBuildVersionName=''
install-location:'internalOnly'
sdkVersion:'16'
targetSdkVersion:'23'
uses-permission: name='android.permission.GET_ACCOUNTS'
uses-permission: name='android.permission.ACCESS_NETWORK_STATE'
uses-permission: name='android.permission.MANAGE_ACCOUNTS'
uses-permission: name='android.permission.USE_CREDENTIALS'
uses-permission: name='android.permission.AUTHENTICATE_ACCOUNTS'
uses-permission: name='android.permission.WRITE_SYNC_SETTINGS'
uses-permission: name='android.permission.WRITE_SETTINGS'
uses-permission: name='android.permission.READ_SYNC_STATS'
uses-permission: name='android.permission.READ_SYNC_SETTINGS'
uses-permission: name='org.mozilla.firefox_fxaccount.permission.PER_ACCOUNT_TYPE'
uses-permission: name='com.google.android.c2dm.permission.RECEIVE'
uses-permission: name='org.mozilla.firefox.permission.C2D_MESSAGE'
uses-permission: name='com.samsung.android.providers.context.permission.WRITE_USE_APP_FEATURE_SURVEY'
uses-permission: name='android.permission.CHANGE_WIFI_STATE'
uses-permission: name='android.permission.ACCESS_WIFI_STATE'
uses-permission: name='android.permission.ACCESS_COARSE_LOCATION'
uses-permission: name='android.permission.ACCESS_FINE_LOCATION'
uses-permission: name='android.permission.ACCESS_NETWORK_STATE'
uses-permission: name='android.permission.INTERNET'
uses-permission: name='android.permission.RECEIVE_BOOT_COMPLETED'
uses-permission: name='android.permission.READ_EXTERNAL_STORAGE'
uses-permission: name='android.permission.WRITE_EXTERNAL_STORAGE'
uses-permission: name='com.android.launcher.permission.INSTALL_SHORTCUT'
uses-permission: name='com.android.launcher.permission.UNINSTALL_SHORTCUT'
uses-permission: name='com.android.browser.permission.READ_HISTORY_BOOKMARKS'
uses-permission: name='android.permission.WAKE_LOCK'
uses-permission: name='android.permission.VIBRATE'
uses-permission: name='android.permission.DOWNLOAD_WITHOUT_NOTIFICATION'
uses-permission: name='android.permission.SYSTEM_ALERT_WINDOW'
uses-permission: name='android.permission.NFC'
uses-permission: name='android.permission.RECORD_AUDIO'
uses-permission: name='android.permission.CAMERA'
application-label:'Firefox'
application-label-af:'Firefox'
application-label-am:'Firefox'
application-label-an:'Firefox'
application-label-ar:'Firefox'
application-label-as:'Firefox'
application-label-ast:'Firefox'
application-label-az:'Firefox'
application-label-az-AZ:'Firefox'
application-label-be:'Firefox'
application-label-bg:'Firefox'
application-label-bn-BD:'Firefox'
application-label-bn-IN:'Firefox'
application-label-br:'Firefox'
application-label-bs:'Firefox'
application-label-ca:'Firefox'
application-label-cak:'Firefox'
application-label-cs:'Firefox'
application-label-cy:'Firefox'
application-label-da:'Firefox'
application-label-de:'Firefox'
application-label-dsb:'Firefox'
application-label-el:'Firefox'
application-label-en-AU:'Firefox'
application-label-en-GB:'Firefox'
application-label-en-IN:'Firefox'
application-label-en-ZA:'Firefox'
application-label-eo:'Firefox'
application-label-es:'Firefox'
application-label-es-AR:'Firefox'
application-label-es-CL:'Firefox'
application-label-es-ES:'Firefox'
application-label-es-MX:'Firefox'
application-label-es-US:'Firefox'
application-label-et:'Firefox'
application-label-et-EE:'Firefox'
application-label-eu:'Firefox'
application-label-eu-ES:'Firefox'
application-label-fa:'Firefox'
application-label-ff:'Firefox'
application-label-fi:'Firefox'
application-label-fr:'Firefox'
application-label-fr-CA:'Firefox'
application-label-fy-NL:'Firefox'
application-label-ga-IE:'Firefox'
application-label-gd:'Firefox'
application-label-gl:'Firefox'
application-label-gl-ES:'Firefox'
application-label-gn:'Firefox'
application-label-gu-IN:'Firefox'
application-label-hi:'Firefox'
application-label-hi-IN:'Firefox'
application-label-hr:'Firefox'
application-label-hsb:'Firefox'
application-label-hu:'Firefox'
application-label-hy-AM:'Firefox'
application-label-in:'Firefox'
application-label-is:'Firefox'
application-label-is-IS:'Firefox'
application-label-it:'Firefox'
application-label-iw:'Firefox'
application-label-ja:'Firefox'
application-label-ka:'Firefox'
application-label-ka-GE:'Firefox'
application-label-kab:'Firefox'
application-label-kk:'Firefox'
application-label-kk-KZ:'Firefox'
application-label-km-KH:'Firefox'
application-label-kn:'Firefox'
application-label-kn-IN:'Firefox'
application-label-ko:'Firefox'
application-label-ky-KG:'Firefox'
application-label-lo:'Firefox'
application-label-lo-LA:'Firefox'
application-label-lt:'Firefox'
application-label-lv:'Firefox'
application-label-mai:'Firefox'
application-label-mk-MK:'Firefox'
application-label-ml:'Firefox'
application-label-ml-IN:'Firefox'
application-label-mn-MN:'Firefox'
application-label-mr:'Firefox'
application-label-mr-IN:'Firefox'
application-label-ms:'Firefox'
application-label-ms-MY:'Firefox'
application-label-my:'Firefox'
application-label-my-MM:'Firefox'
application-label-nb:'Firefox'
application-label-nb-NO:'Firefox'
application-label-ne-NP:'Firefox'
application-label-nl:'Firefox'
application-label-nn-NO:'Firefox'
application-label-oc:'Firefox'
application-label-or:'Firefox'
application-label-pa-IN:'Firefox'
application-label-pl:'Firefox'
application-label-pt:'Firefox'
application-label-pt-BR:'Firefox'
application-label-pt-PT:'Firefox'
application-label-rm:'Firefox'
application-label-ro:'Firefox'
application-label-ru:'Firefox'
application-label-si-LK:'Firefox'
application-label-sk:'Firefox'
application-label-sl:'Firefox'
application-label-son:'Firefox'
application-label-sq:'Firefox'
application-label-sq-AL:'Firefox'
application-label-sr:'Firefox'
application-label-sv:'Firefox'
application-label-sv-SE:'Firefox'
application-label-sw:'Firefox'
application-label-ta:'Firefox'
application-label-ta-IN:'Firefox'
application-label-te:'Firefox'
application-label-te-IN:'Firefox'
application-label-th:'Firefox'
application-label-tl:'Firefox'
application-label-tr:'Firefox'
application-label-trs:'Firefox'
application-label-uk:'Firefox'
application-label-ur:'Firefox'
application-label-ur-PK:'Firefox'
application-label-uz:'Firefox'
application-label-uz-UZ:'Firefox'
application-label-vi:'Firefox'
application-label-wo:'Firefox'
application-label-xh:'Firefox'
application-label-zam:'Firefox'
application-label-zh-CN:'Firefox'
application-label-zh-HK:'Firefox'
application-label-zh-TW:'Firefox'
application-label-zu:'Firefox'
application-icon-160:'res/drawable-hdpi-v4/icon.png'
application-icon-213:'res/drawable-hdpi-v4/icon.png'
application-icon-240:'res/drawable-hdpi-v4/icon.png'
application-icon-320:'res/drawable-xhdpi-v4/icon.png'
application-icon-480:'res/drawable-xxhdpi-v4/icon.png'
application-icon-640:'res/drawable-xxxhdpi-v4/icon.png'
application-icon-65535:'res/drawable-xxxhdpi-v4/icon.png'
application: label='Firefox' icon='res/drawable-hdpi-v4/icon.png'
feature-group: label=''
uses-gl-es: '0x20000'
uses-feature-not-required: name='android.hardware.audio.low_latency'
uses-feature-not-required: name='android.hardware.camera'
uses-feature-not-required: name='android.hardware.camera.any'
uses-feature-not-required: name='android.hardware.camera.autofocus'
uses-feature-not-required: name='android.hardware.location'
uses-feature-not-required: name='android.hardware.location.gps'
uses-feature-not-required: name='android.hardware.microphone'
uses-feature-not-required: name='android.hardware.nfc'
uses-feature: name='android.hardware.touchscreen'
uses-feature: name='android.hardware.wifi'
uses-implied-feature: name='android.hardware.wifi' reason='requested android.permission.ACCESS_WIFI_STATE permission, and requested android.permission.CHANGE_WIFI_STATE permission'
main
other-activities
other-receivers
other-services
supports-screens: 'small' 'normal' 'large' 'xlarge'
supports-any-density: 'true'
locales: '--_--' 'af' 'am' 'an' 'ar' 'as' 'ast' 'az' 'az-AZ' 'be' 'bg' 'bn-BD' 'bn-IN' 'br' 'bs' 'ca' 'cak' 'cs' 'cy' 'da' 'de' 'dsb' 'el' 'en-AU' 'en-GB' 'en-IN' 'en-ZA' 'eo' 'es' 'es-AR' 'es-CL' 'es-ES' 'es-MX' 'es-US' 'et' 'et-EE' 'eu' 'eu-ES' 'fa' 'ff' 'fi' 'fr' 'fr-CA' 'fy-NL' 'ga-IE' 'gd' 'gl' 'gl-ES' 'gn' 'gu-IN' 'hi' 'hi-IN' 'hr' 'hsb' 'hu' 'hy-AM' 'in' 'is' 'is-IS' 'it' 'iw' 'ja' 'ka' 'ka-GE' 'kab' 'kk' 'kk-KZ' 'km-KH' 'kn' 'kn-IN' 'ko' 'ky-KG' 'lo' 'lo-LA' 'lt' 'lv' 'mai' 'mk-MK' 'ml' 'ml-IN' 'mn-MN' 'mr' 'mr-IN' 'ms' 'ms-MY' 'my' 'my-MM' 'nb' 'nb-NO' 'ne-NP' 'nl' 'nn-NO' 'oc' 'or' 'pa-IN' 'pl' 'pt' 'pt-BR' 'pt-PT' 'rm' 'ro' 'ru' 'si-LK' 'sk' 'sl' 'son' 'sq' 'sq-AL' 'sr' 'sv' 'sv-SE' 'sw' 'ta' 'ta-IN' 'te' 'te-IN' 'th' 'tl' 'tr' 'trs' 'uk' 'ur' 'ur-PK' 'uz' 'uz-UZ' 'vi' 'wo' 'xh' 'zam' 'zh-CN' 'zh-HK' 'zh-TW' 'zu'
densities: '160' '213' '240' '320' '480' '640' '65535'
native-code: 'armeabi-v7a'

For odex /system packages; check

-PC: {

baksmali list classes

} on *.odex or {

dextra

} on *.vdex http://newandroidbook.com/tools/dextra.html

-android: {

oatdump --oat-file=

} on *.odex

For android check attached Magisk systemless module with aapt32 curl32 (curl 7.43.0-DEV Android 6.0.1 armv7-a-neon) and grep64 (pcre2grep version 10.22 2016-07-29)

More info for: "tracking software on smartphones" https://theintercept.com/2017/11/24...stine-trackers-found-in-popular-android-apps/

Related tools: https://github.com/ashishb/android-security-awesome

View attachment 4581433 View attachment 4581434

View attachment 5188223 View attachment 4620509 View attachment 4620510 View attachment 4655641 View attachment 5188229 View attachment 4669612