False positives in DroidBox logs

[yuanchun-li]

I tested DroidBox4.1.1 with simple apps.

I found that some of the DroidBox logs are not related to the target app but still counted as sensitive behaviors of the app. For example, the following log message:

05-28 03:50:04.743   150   164 W DroidBox: DroidBox: { "FileRW": { "operation": "read", "data": "636f6d2e676e6f6d2e616e746f6e3a7a707274000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000676e6f6d2e616e746f6e2e53686f72740076697479330000", "id": "1981810222" } }

is produced by system_server instead of target app according to the output of adb shell ps -t command:

USER     PID   PPID  VSIZE  RSS     WCHAN    PC         NAME
system    150   37    288764 59420 ffffffff 40032b64 S system_server

To remove these false positive logs, I rewrote the droidbox.py script and put it in my DroidBot project. The method I used for connecting log message to process is continuously calling ps command and maintaining a pid-to-process mapping.

If you find it interesting, please let me know. I can help you improve the scripts.