Mobile phone forensicsJune 28 2020 18:16:38

A cellphone is basically a linux device that you're always carrying with you. Since I've got root access on mine - why not add a few tools that make my daily tasks easier? To this end I set out to modify my android system image.
I'm somewhat regularly curious about the contents of an android binary ( apk file ) and sometimes the code in JAR files. To this end I've included the tools "unapk" and "unjar" in my new system image. To use these I had to include a JDK - compiled for ARM64 of course. With the command "unjar" you can dissasemble a binary directly from an APK on the system ( found with "pm list packages -f" ) or from a file. Unjar/unapk will run on any computer however - and they're also attached to the bottom of this post for stand alone usage. I've also added reverse engineering tools like strace and binwalk to make debugging and reverse engineering from my phone easier.

To make working with disk volumes possible I've added ntfs3g, libde ( to mount encrypted LUKS systems ), bdemount ( to mount bitlocker volumes) and a lot of NTFS and FAT related tools. To build most of these tools I needed static libraries - which aren't shipped with most distros so I quickly whipped up an arm64 chroot with QEMU on my main machine so I could cross-compile for my phone. One more reason to stick with Gentoo forever :)
For other binaries (like git) the easiest solution was to simply modify the termux packages. I've included the source code to a binary patcher file below which you can use to search a binary or script for termux-specific paths and change them to paths in /system. This allows you to quickly re-use binaries from termux on an android system root.
This is also how I've added Perl and irssi to this system - just steal and patch the termux binaries. All of this does come at a cost to security because these binaries are rarely updated.. So do this at your own peril.

Just goes to show that a mobile phone nowadays is a fully capable computer - even good enough to do modern forensics on :)

Edit: I just checked the kali linux armhf firmware image - as far as command-line hacking tools goes this image has a lot more to offer than even Kali Nethunter :)