I am trying to analyse Android malware on an emulator with Android 2.1. I want to analyze the files permissions and fingerprints after the execution of the suspicious app. I know, I can use the adb shell to get this information, but I think I can't trust the information after the execution of e.g. a rootkit.

I think the only way to prevent rootkits from hiding is by mounting the images directly or? I have the following files:

ramdisk.img  snapshots.img  userdata-qemu.img  cache.img  system.img  userdata.img  zImage

How can they be mounted/extracted on Ubuntu (read access is enough)?

With unyaffs I can extract the system.img and userdata.img file. simg2img returns "bad magic" for all files.

Thanks Alex

Edit: userdata-qemu.img works unyaffs2

android image emulation mount
Edit
Report