How to hook system API

[zhengping]

Hi,

I try to figure out how to monitor all the outgoing info through Data Connection/SMS/Call.

MacOS have two API mach_inject and mach_override.

Windows provides Hook API.

How can I find similar API on Android system?

Thanks for help!

zwang

[Dianne Hackborn]

Sorry, Android doesn't work that way.

--
You received this message because you are subscribed to the Google Groups "android-ndk" group.
To post to this group, send email to andro...@googlegroups.com.
To unsubscribe from this group, send email to android-ndk...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/android-ndk?hl=en.

--
Dianne Hackborn
Android framework engineer
hac...@android.com

Note: please don't send private questions to me, as I don't have time to provide private support, and so won't reply to such e-mails.  All such questions should be posted on public forums, where I and others can see and answer them.

[Ngo Van Luyen]

Try to use BroadcastReceiver and "listen" for an action, for example: android.content.Intent.ACTION_CALL

Best,

2010/9/19 Dianne Hackborn <hac...@android.com>

--

Hello Android!

http://androidcore.com/

[Dianne Hackborn]

There are a few specific things you can do with broadcast receiver, but it is not an uber-general hook mechanism like the Windows hook API.  (And thank ghod for that.)

[Chris Stratton]

On a device that you own you can patch the kernel or platform to
intercept whatever. But android does not provide this capability to
applications.

Or for research/curiosity purposes run in the emulator where radio
stuff is simulated and network can be monitored at the hosting
machine.

Dianne Hackborn wrote:
> There are a few specific things you can do with broadcast receiver, but it
> is not an uber-general hook mechanism like the Windows hook API. (And thank
> ghod for that.)
>
> On Sun, Sep 19, 2010 at 12:58 PM, Ngo Van Luyen <nvlu...@gmail.com> wrote:
>
> > Try to use BroadcastReceiver and "listen" for an action, for
> > example: android.content.Intent.ACTION_CALL
> >
> > Best,
> >
> >
> > 2010/9/19 Dianne Hackborn <hac...@android.com>
> >
> > Sorry, Android doesn't work that way.
> >>
> >>
> >> On Sat, Sep 18, 2010 at 7:33 PM, zhengping <her...@gmail.com> wrote:
> >>
> >>> Hi,
> >>>
> >>> I try to figure out how to monitor all the outgoing info through Data
> >>> Connection/SMS/Call.
> >>>
> >>> MacOS have two API mach_inject and mach_override.
> >>>
> >>> Windows provides Hook API.
> >>>
> >>> How can I find similar API on Android system?
> >>>
> >>> Thanks for help!
> >>>
> >>> zwang
> >>>
> >>> --
> >>> You received this message because you are subscribed to the Google Groups
> >>> "android-ndk" group.
> >>> To post to this group, send email to andro...@googlegroups.com.
> >>> To unsubscribe from this group, send email to

> >>> android-ndk...@googlegroups.com<android-ndk%2Bunsu...@googlegroups.com>
> >>> .

> >>> For more options, visit this group at
> >>> http://groups.google.com/group/android-ndk?hl=en.
> >>>
> >>
> >>
> >>
> >> --
> >> Dianne Hackborn
> >> Android framework engineer
> >> hac...@android.com
> >>
> >> Note: please don't send private questions to me, as I don't have time to
> >> provide private support, and so won't reply to such e-mails. All such
> >> questions should be posted on public forums, where I and others can see and
> >> answer them.
> >>
> >>
> >> --
> >> You received this message because you are subscribed to the Google Groups
> >> "android-ndk" group.
> >> To post to this group, send email to andro...@googlegroups.com.
> >> To unsubscribe from this group, send email to

> >> android-ndk...@googlegroups.com<android-ndk%2Bunsu...@googlegroups.com>
> >> .

> >> For more options, visit this group at
> >> http://groups.google.com/group/android-ndk?hl=en.
> >>
> >
> >
> >
> > --
> > Hello Android!
> > http://androidcore.com/
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "android-ndk" group.
> > To post to this group, send email to andro...@googlegroups.com.
> > To unsubscribe from this group, send email to

> > android-ndk...@googlegroups.com<android-ndk%2Bunsu...@googlegroups.com>
> > .

> > For more options, visit this group at
> > http://groups.google.com/group/android-ndk?hl=en.
> >
>
>
>
> --
> Dianne Hackborn
> Android framework engineer
> hac...@android.com
>
> Note: please don't send private questions to me, as I don't have time to
> provide private support, and so won't reply to such e-mails. All such
> questions should be posted on public forums, where I and others can see and
> answer them.

Dianne Hackborn wrote:
> There are a few specific things you can do with broadcast receiver, but it
> is not an uber-general hook mechanism like the Windows hook API. (And thank
> ghod for that.)
>
> On Sun, Sep 19, 2010 at 12:58 PM, Ngo Van Luyen <nvlu...@gmail.com> wrote:
>
> > Try to use BroadcastReceiver and "listen" for an action, for
> > example: android.content.Intent.ACTION_CALL
> >
> > Best,
> >
> >
> > 2010/9/19 Dianne Hackborn <hac...@android.com>
> >
> > Sorry, Android doesn't work that way.
> >>
> >>
> >> On Sat, Sep 18, 2010 at 7:33 PM, zhengping <her...@gmail.com> wrote:
> >>
> >>> Hi,
> >>>
> >>> I try to figure out how to monitor all the outgoing info through Data
> >>> Connection/SMS/Call.
> >>>
> >>> MacOS have two API mach_inject and mach_override.
> >>>
> >>> Windows provides Hook API.
> >>>
> >>> How can I find similar API on Android system?
> >>>
> >>> Thanks for help!
> >>>
> >>> zwang
> >>>
> >>> --
> >>> You received this message because you are subscribed to the Google Groups
> >>> "android-ndk" group.
> >>> To post to this group, send email to andro...@googlegroups.com.
> >>> To unsubscribe from this group, send email to

> >>> android-ndk...@googlegroups.com<android-ndk%2Bunsu...@googlegroups.com>
> >>> .

> >>> For more options, visit this group at
> >>> http://groups.google.com/group/android-ndk?hl=en.
> >>>
> >>
> >>
> >>
> >> --
> >> Dianne Hackborn
> >> Android framework engineer
> >> hac...@android.com
> >>
> >> Note: please don't send private questions to me, as I don't have time to
> >> provide private support, and so won't reply to such e-mails. All such
> >> questions should be posted on public forums, where I and others can see and
> >> answer them.
> >>
> >>
> >> --
> >> You received this message because you are subscribed to the Google Groups
> >> "android-ndk" group.
> >> To post to this group, send email to andro...@googlegroups.com.
> >> To unsubscribe from this group, send email to

> >> android-ndk...@googlegroups.com<android-ndk%2Bunsu...@googlegroups.com>
> >> .

> >> For more options, visit this group at
> >> http://groups.google.com/group/android-ndk?hl=en.
> >>
> >
> >
> >
> > --
> > Hello Android!
> > http://androidcore.com/
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "android-ndk" group.
> > To post to this group, send email to andro...@googlegroups.com.
> > To unsubscribe from this group, send email to

> > android-ndk...@googlegroups.com<android-ndk%2Bunsu...@googlegroups.com>
> > .

[zhengping]

Hi,

Thanks for all kind reply.

I do more search, and found some helpful information, and implemented a prototype, which can block spam SMS/call with a black list.

The code looks like these:

...
if (!monitorStatus) {
                this.getContentResolver().registerContentObserver(
                        Uri.parse("content://sms"), true, observer);
                monitorStatus = true;
            }

...
getContentResolver().delete(
                        Uri.parse("content://sms/" + _id),
                        null, null);
...

But it looks like it's not possible to go any further with outgoing information. If I try to replace system service like "SMS". I have to rebuild android ROM with my own platform cert.

No offense, I think this is not a reasonable limitation. Yes, this design can make the system provider's life easier, since less possibility and less complexity, totally no security hole. And if you build your own ROM, you are on your own risk.

But assume I'm not a developer, I just a phone user. But I like install different software like game, tools, media player etc, and this software require the permission to "SEND_SMS" or "CONNECT_INTERNET" etc.

So I allow them, and I assume they just send sms to check license or get update. But if they abuse the permission to send SMS or data package to some other sites. I don't know it, since system doesn't support monitor things to normal phone user.

As a normal phone user, I want to know exactly my phone doesn't send out any information without notify me.

Since I'm a developer, so maybe after some struggle, I can build my customized ROM for myself. But the android phone not just a toy for developers, I hope android team can consider the needs of normal users.

Regards,

zwang

2010/9/20 Chris Stratton <cs0...@gmail.com>

To unsubscribe from this group, send email to android-ndk...@googlegroups.com.

[Chris Stratton]

If you had explained that from the beginning you would have gotten
more sympathy from other readers, but probably still not from the
resident google folks, who seem to feel you should either accept the
install time permission request as a blank check, or else avoid the
app (especially if any requested permission seems unwarranted)

You might be interested in a program called apktool for unpacking and
repacking applications. This makes it fairly simple to remove
permissions from the manifest, though depending on how it is coded the
program may then crash due to a permission error or null pointer when
an object such as a socket that it couldn't aquire unexpectedly
doesn't exist.

> > <android-ndk%2Bunsu...@googlegroups.com<android-ndk%252Buns...@googlegroups.com>

> > >
> > > >>> .
> > > >>> For more options, visit this group at
> > > >>> http://groups.google.com/group/android-ndk?hl=en.
> > > >>>
> > > >>
> > > >>
> > > >>
> > > >> --
> > > >> Dianne Hackborn
> > > >> Android framework engineer
> > > >> hac...@android.com
> > > >>
> > > >> Note: please don't send private questions to me, as I don't have time
> > to
> > > >> provide private support, and so won't reply to such e-mails. All such
> > > >> questions should be posted on public forums, where I and others can
> > see and
> > > >> answer them.
> > > >>
> > > >>
> > > >> --
> > > >> You received this message because you are subscribed to the Google
> > Groups
> > > >> "android-ndk" group.
> > > >> To post to this group, send email to andro...@googlegroups.com.
> > > >> To unsubscribe from this group, send email to
> > > >> android-ndk...@googlegroups.com<android-ndk%2Bunsu...@googlegroups.com>

> > <android-ndk%2Bunsu...@googlegroups.com<android-ndk%252Buns...@googlegroups.com>

> > >
> > > >> .
> > > >> For more options, visit this group at
> > > >> http://groups.google.com/group/android-ndk?hl=en.
> > > >>
> > > >
> > > >
> > > >
> > > > --
> > > > Hello Android!
> > > > http://androidcore.com/
> > > >
> > > > --
> > > > You received this message because you are subscribed to the Google
> > Groups
> > > > "android-ndk" group.
> > > > To post to this group, send email to andro...@googlegroups.com.
> > > > To unsubscribe from this group, send email to
> > > > android-ndk...@googlegroups.com<android-ndk%2Bunsu...@googlegroups.com>

> > <android-ndk%2Bunsu...@googlegroups.com<android-ndk%252Buns...@googlegroups.com>

> > <android-ndk%2Bunsu...@googlegroups.com<android-ndk%252Buns...@googlegroups.com>

> > >
> > > >>> .
> > > >>> For more options, visit this group at
> > > >>> http://groups.google.com/group/android-ndk?hl=en.
> > > >>>
> > > >>
> > > >>
> > > >>
> > > >> --
> > > >> Dianne Hackborn
> > > >> Android framework engineer
> > > >> hac...@android.com
> > > >>
> > > >> Note: please don't send private questions to me, as I don't have time
> > to
> > > >> provide private support, and so won't reply to such e-mails. All such
> > > >> questions should be posted on public forums, where I and others can
> > see and
> > > >> answer them.
> > > >>
> > > >>
> > > >> --
> > > >> You received this message because you are subscribed to the Google
> > Groups
> > > >> "android-ndk" group.
> > > >> To post to this group, send email to andro...@googlegroups.com.
> > > >> To unsubscribe from this group, send email to
> > > >> android-ndk...@googlegroups.com<android-ndk%2Bunsu...@googlegroups.com>

> > <android-ndk%2Bunsu...@googlegroups.com<android-ndk%252Buns...@googlegroups.com>

> > >
> > > >> .
> > > >> For more options, visit this group at
> > > >> http://groups.google.com/group/android-ndk?hl=en.
> > > >>
> > > >
> > > >
> > > >
> > > > --
> > > > Hello Android!
> > > > http://androidcore.com/
> > > >
> > > > --
> > > > You received this message because you are subscribed to the Google
> > Groups
> > > > "android-ndk" group.
> > > > To post to this group, send email to andro...@googlegroups.com.
> > > > To unsubscribe from this group, send email to
> > > > android-ndk...@googlegroups.com<android-ndk%2Bunsu...@googlegroups.com>

> > <android-ndk%2Bunsu...@googlegroups.com<android-ndk%252Buns...@googlegroups.com>

[Dianne Hackborn]

On Sun, Sep 19, 2010 at 6:52 PM, Chris Stratton <cs0...@gmail.com> wrote:

If you had explained that  from the beginning you would have gotten
more sympathy from other readers, but probably still not from the
resident google folks, who seem to feel you should either accept the
install time permission request as a blank check, or else avoid the
app (especially if any requested permission seems unwarranted)

Like the account manager allowing you to approve account access at runtime, and the ability to enable disable IME at runtime, and the ability to select device administrators at runtime...

Oh, wait.

[zhengping]

Thanks your reply,

I tried apktool, it's very cool.

and my draft idea is:

1) Build ROM to enable ipfilter module, looks like someone already do that.  Then I can use the linux firewall to filter outgoing connections.

2) Wrap the SMSDispatcher, and redirect send API to my handler. Then every outgoing SMS will trigger an alert. And remember my choice to a blacklist.

Regards

2010/9/20 Chris Stratton <cs0...@gmail.com>

To unsubscribe from this group, send email to android-ndk...@googlegroups.com.

[Chris Stratton]

Do any of those things let the device owner override an application
manifest to bar an app with no core functional need to use the 3g
connection, write external storage, send an sms, etc from doing so?

[Pedro Lamarão]

zhengping wrote:

> So I allow them, and I assume they just send sms to check license or get
> update. But if they abuse the permission to send SMS or data package to some
> other sites. I don't know it, since system doesn't support monitor things to
> normal phone user.

This reasoning makes no sense, for this very simple reason: if every
application is allowed to abuse, then so is the monitoring application
allowed to abuse.

Of course, people in general consider confidence around them as an N
tier system where closer friends are less likely to lie than more
distant acquaintances. Therefore, one could argue that the monitoring
application would be a closer friend to the user of the device than
all other applications.

Unfortunately, the install/no-install duality is much less simple than
the whole universe of possible interactions between two people that
have recently met. The analogy is false. The reputation system for the
monitoring application is the same as for all other applications. If
it fails for a simple application, it will fail for monitoring
applications.

--
P.

[Chris Stratton]

Simple solution: You could have an open source, open to inspection
firewall application policing opaquely closed source applications.

Well, you could if you could have a firewall application...

[zhengping]

I agree Chirs's point.

The permission system of android just like a blank check.

If I pay someone, I'll write name and a number.

But on android, you give him a blank check, or give him nothing.

Fortunately, some open source project exists, like http://code.google.com/p/droidwall/

We just need an open source SMS firewall happen.

2010/9/21 Chris Stratton <cs0...@gmail.com>

[JiancongXie]

Actually, there is still have a way to inject android system calls without modifying source code and compiling. 

[凯 .张]

could you talk about this way clearly！thank you！
在 2013年10月10日星期四UTC+8下午8时05分31秒，JiancongXie写道：