KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
I am trying to analyse Android malware on an emulator with Android 2.1. I want to analyze the files permissions and fingerprints after the execution of the suspicious app. I know, I can use the adb shell to get this information, but I think I can't trust the information after the execution of e.g. a rootkit. I think the only way to prevent rootkits from hiding is by mounting the images directly or? I have the following files: ramdisk.img snapshots.img userdata-qemu.img cache.img system.img userdata.img zImage How can they be mounted/extracted on Ubuntu (read access is enough)? With unyaffs I can extract the system.img and userdata.img file. simg2img returns "bad magic" for all files. Thanks Alex Edit: userdata-qemu.img works unyaffs2
Tags (comma-separated)
Save Edits
Cancel