Course 42 - Mobile Malware Analysis Fundamentals | Episode 12: Dynamic Analysis Tools, Techniques, and Assessment — CyberCode Academy

This episode covers dynamic analysis of Android applications, with a strong emphasis on runtime interaction, monitoring, and debugging.1. Android Dynamic Analysis with DrozerThe episode introduces Drozer, an Android security assessment framework that allows researchers to interact with application components while they are running.Key capabilities include:

Establishing communication between the analysis machine and Android device using ADB port forwarding.
Enumerating installed packages and examining metadata such as permissions, UIDs, and package information.
Identifying potentially exposed attack surfaces, including:
- Exported Activities
- Broadcast Receivers
- Content Providers
Interacting directly with application components to observe their runtime behavior.

This makes Drozer particularly useful for discovering insecurely exposed Android components that may not be obvious through static analysis alone.2. Runtime File-System MonitoringThe episode introduces FSmon for monitoring file-system activity in real time.Researchers can observe:

Files being created or modified.
Files being deleted.
Changes occurring while an application executes.
System-level activity associated with suspicious behavior.

The collected information can then be analyzed to determine how an application interacts with the underlying operating system.3. Network MonitoringNetwork behavior is investigated using TCPDump.The general workflow is:Android Device → TCPDump → PCAP → WiresharkCapturing traffic allows analysts to investigate:

Remote connections.
Destination IP addresses.
DNS activity.
HTTP/HTTPS communications.
Potential command-and-control infrastructure.
Data transmitted by the application.

Network analysis is particularly valuable when static analysis reveals suspicious URLs or networking functions but does not establish exactly when or why those connections occur.4. Debugging and InstrumentationThe episode also introduces several debugging approaches:

GDB for remote debugging sessions.
Android Studio for Java-level debugging.
Anbug as an additional Android debugging tool.

Debugging provides a deeper level of visibility than simple behavioral monitoring because analysts can inspect program execution and investigate what happens at specific points during runtime.5. Connecting Android and iOS AnalysisThe knowledge check reinforces that the same fundamental methodology applies across both platforms:Static Analysis → Hypothesis → Dynamic Analysis → Observation → ConfirmationFor iOS, important concepts include:

UIApplicationMain
The five application lifecycle states.
Method swizzling for modifying or intercepting method behavior during runtime analysis.

For Android, the focus is on ADB, particularly commands used to:

Install applications.
Communicate with devices.
Forward ports for remote analysis and debugging.

Overall TakeawayThe major lesson is that static and dynamic analysis are complementary rather than competing approaches.Static analysis tells you:“What could this application do?”Dynamic analysis tells you:“What does this application actually do?”By combining component enumeration, filesystem monitoring, network capture, debugging, and static inspection, an analyst can move from an initial suspicion to a much stronger, evidence-based understanding of a mobile application's behavior.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy