Abstract: Android application dynamic monitoring scheme is usually implemented in three ways:1) custom ROM;2) after obtaining the device root permission,modify the system file or use ptrace technology to inject code into the target process;3) repackage APK to add monitoring code.All three methods are implemented in an intrusive manner,which depends on the system environment and is difficult to deploy to different devices.In order to solve the above problems,a non-intrusive dynamic monitoring scheme based on plug-in technology was proposed.The scheme releases the monitoring system in the form of host App and installs it on the target device.The application to be monitored is loaded by host App environment in the form of a plug-in for opera-tion,and the host App loads the corresponding monitoring module when loading the plug-in,so the App is monited.Start a process ahead of time before the application to be monitored runs as a plugin.The Binder proxy object in the process is replaced by a dynamic proxy method,and the Binder service request in the process is redirected to the virtual service in the virtual service process for processing,so that the components in the application to be monitored can run in the pre-started process.When the Application object in the application to be monitored is initialized,the Java layer and the Native layer monitoring module are loadedto complete the monitoring.According to this scheme,the prototype system AndroidMonitor is implemented on the VirtualApp sandbox and tested on the Nexus5 device.The experimental results show that compared with other schemes,although the startup time of the application to be monitored is increased by about 1.4s,the scheme does not need to acquire the root authority of the device system,and can simultaneously monitor the Java layer and the native layer sensitive API.The system introduces a device information protection module to prevent device information from leaking when monitoring applications.The system is distributed in the form of an app,which is easy to deploy to different devices and has multiple application scenarios.

Key words: Dynamic monitoring, Dynamic proxy, Hook, Non-root, Plug-in, Sandbox