framework API 监控

how to use

1. define monitor APIs

以监控网络为例.

wangxin@wangxin:~/Downloads/temp/APIMonitor-beta$ vim config/default_api_collection
# DEFAULT API LIST

# Network IO
Ljava/net/URL;-><init>
Ljava/net/URL;->openConnection
Ljava/net/URL;->openStream

2. create NEW apk

wangxin@wangxin:~/Downloads/temp/APIMonitor-beta$ ./apimonitor.py chrome-debug.apk 
min_sdk_version=14
target_sdk_version=23
Parsing apimonitor_out/origin_smali...
Done!
Loading and processing API database...
Target API Level: 14
[Warn] Class not found in API-14 db: Landroid.location.LocationManager;
[Warn] Inferred API: Landroid/content/Context;->openOrCreateDatabase
Done!
Injecting...
Done!
Saving apimonitor_out/new_smali...
Done
NEW APK: chrome-debug_new.apk

3. see Logs with tag "DroidBox"

wangxin@wangxin:~/Downloads$ adb logcat -s DroidBox | grep --color -E 'http:'
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://p.s.360.cn/pstat/plog.php)V
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://m.yiche.com/?wt.mc_id=m360mz)V
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://m.yiche.com/?wt.mc_id=m360mz)V
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://news.m.yiche.com/others/20160715/1506625294.html)V
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://news.m.yiche.com/others/20160715/1506625294.html)V
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://p.s.360.cn/pstat/plog.php)V
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://chrome-native/newtab/)V
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://p.s.360.cn/pstat/plog.php)V
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://chrome-native/newtab/)V
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://apilocate.amap.com/mobile/binary)V
V/DroidBox(23726): Ljava/net/URL;->openConnection()Ljava/net/URLConnection;=libcore.net.http.HttpURLConnectionImpl:http://apilocate.amap.com/mobile/binary
V/DroidBox(23726): Ljava/net/URL;-><init>(Ljava/lang/String;=http://p.s.360.cn/pstat/plog.php)V

实现原理

反编译apk文件，遍历smali代码，利用配置文件中配置的需要监控的api，找到对API的调用，则分析其参数，然后调用droidbox包空间下对应的类的静态函数。
这些静态函数负责解析参数，打印输出log信息。
处理完毕，重新编译生成apk。

refer to :
http://blog.csdn.net/asmcvc/article/details/11595783
http://www.slideshare.net/KelwinYang/improving-droidbox
https://code.google.com/archive/p/droidbox/wikis/APIMonitor.wiki