Interactive Mode

Sandroid’s interactive mode provides a user-friendly menu-driven interface for performing forensic analysis. This mode is perfect for manual analysis, learning the tool, and complex investigations requiring multiple steps.

Starting Interactive Mode

Launch Interactive Mode:

sandroid

or explicitly:

sandroid --interactive

With Custom Configuration:

sandroid --config my-analysis.toml --interactive

The Interactive Menu

When you start interactive mode, you’ll see the main menu:

┌───────────────────────────────────────────────────────────────────────┐
│                       Sandroid Interactive Menu                       │
├───────────────────────────────────────────────────────────────────────┤
│Frida Server: [Not running]                                            │
│HTTP Proxy: [Not set]                                                  │
│Spotlight Application: [Not set]                                       │
│Spotlight Files: [Not set]                                             │
│                                                                       │
│    === Action Recording & Playback ===                                │
│    * [r]ecord an action                                               │
│    * [p]lay the currently loaded action                               │
│    * e[x]port currently loaded action                                 │
│    * [i]mport action                                                  │
│                                                                       │
│    === Spotlight Application ===                                      │
│    * set [c]urrent app in focus as spotlight app                      │
│    * [a]nalyze spotlight app with asam                                │
│    * [d]ump memory of spotlight app (using fridump)                   │
│    * start android [m]alware motion monitor (am3) on spotlight app    │
│    * start o[b]jection interactive shell for spotlight app            │
│    * run [t]rigdroid malware triggers                                 │
│                                                                       │
│    === Spotlight Files ===                                            │
│    * [l]ist/add spotlight file                                        │
│    * remo[v]e spotlight file                                          │
│    * p[u]ll spotlight files                                           │
│    * [o]bserve file system changes (fsmon)                            │
│                                                                       │
│    === Emulator Management ===                                        │
│    * show [e]mulator information                                      │
│    * keys [1-8] create snapshots, key [0] lists/loads snapshots       │
│    * take [s]creenshot of device                                      │
│    * [g]rab video of screen                                           │
│    * [n]ew APK installation                                           │
│    * run/install [f]rida server                                       │
│                                                                       │
│    === Network Management ===                                         │
│    * set/unset network prox[y]                                        │
│    * [h]ook encryption routines with friTap                           │
│    * [w]rite network capture file                                     │
│                                                                       │
│                                                                       │
│    * [q]uit                                                           │
└───────────────────────────────────────────────────────────────────────┘

Step-by-Step Workflows

Basic Analysis Workflow

  1. Initialize Frida (if not running):

    Press ‘f’ → Install and start Frida server

  2. Start Recording:

    Press ‘r’ → Begin monitoring system changes

  3. Perform Analysis Target Actions

    • Install and run the target application

    • Interact with features you want to analyze

    • Generate the behaviors you want to capture

  4. Complete Analysis

    Press Enter → Stop recording and generate results

  5. Review Results

    Examine the generated JSON report and logs

Malware Analysis Workflow

  1. Setup Baseline:

    Press ‘1’ → Create clean snapshot

  2. Install Frida:

    Press ‘f’ → Install Frida server

  3. Set Spotlight App:

    # Install malware APK first

    Press ‘n’ → Install malware APK Press ‘c’ → Set as spotlight app

  4. Configure Network Monitoring:

    Press ‘y’ → Set up proxy (optional) Press ‘h’ → Enable friTap for SSL interception

  5. Execute Triggers:

    Press ‘t’ → Run TrigDroid automated triggers

  6. Monitor Behavior:

    Press ‘m’ → Start malware motion monitor

  7. Capture Evidence:

    Press ‘s’ → Take screenshots Press ‘w’ → Save network capture

  8. Memory Analysis:

    Press ‘d’ → Dump memory for analysis

  9. Clean Up:

    Press ‘0’ → Restore clean snapshot

App Development Testing Workflow

  1. Install Development APK:

    Press ‘n’ → Install your APK

  2. Set as Spotlight:

    Press ‘c’ → Set your app as spotlight

  3. Record User Flows:

    Press ‘r’ → Record specific user interactions

  4. Static Analysis:

    Press ‘a’ → Analyze APK structure and permissions

  5. Export Test Cases:

    Press ‘x’ → Export recorded interactions for regression testing

Status Indicators

The menu shows real-time status information:

Frida Server Status

  • [Running] - Frida server is active and ready

  • [Not running] - Frida server needs to be started

HTTP Proxy Status

  • [Set] - Network proxy is configured

  • [Not set] - No proxy configuration

Spotlight Application

  • Shows package name of currently monitored app

  • [Not set] if no app is being monitored

Spotlight Files

  • Number of files being monitored

  • [Not set] if no files are being watched

Tips for Interactive Mode

Best Practices

  1. Start with Frida: Always install Frida server first for dynamic analysis

  2. Use Snapshots: Create clean snapshots before analysis for repeatability

  3. Set Spotlight Apps: Focus analysis on specific applications for better results

  4. Monitor Network: Enable network monitoring for comprehensive analysis

  5. Take Screenshots: Document your analysis with visual evidence

Performance Tips

  1. Clean Baselines: Use fresh snapshots to avoid noise from previous analysis

  2. Focused Monitoring: Only monitor specific files/apps when possible

  3. Resource Management: Close unnecessary apps during analysis

Troubleshooting

  1. Frida Connection Issues: Restart Frida server with ‘f’

  2. No Device Detected: Check ADB connection with ‘e’

  3. Permission Errors: Ensure device is rooted for advanced features

  4. Slow Performance: Create a new snapshot and restart analysis

Advanced Tips

  1. Combine Tools: Use objection (‘b’) with memory dumping (‘d’) for comprehensive analysis

  2. Automate Triggers: Use TrigDroid (‘t’) for consistent malware activation

  3. Network Analysis: Combine proxy (‘y’) with friTap (‘h’) for complete traffic visibility

  4. Evidence Chain: Use screenshots (‘s’) and network capture (‘w’) to document findings

Keyboard Shortcuts

All menu options use single-key shortcuts:

  • Recording: r, p, x, i

  • App Analysis: c, a, d, m, b, t

  • File Monitoring: l, v, u, o

  • Device Management: e, 1-8, 0, s, g, n, f

  • Network: y, h, w

  • Exit: q

Configuration in Interactive Mode

Interactive mode respects your configuration file settings. You can:

  1. Modify behavior with environment variables:

    SANDROID_LOG_LEVEL=DEBUG sandroid

  2. Use different configs:

    sandroid –config analysis-config.toml

  3. Override settings:

    sandroid –network –screenshot 5

The interactive mode will honor these settings while providing the menu interface.

Getting Help

  • Press q to quit safely

  • Check logs at ~/.cache/sandroid/logs/ for detailed information

  • Use sandroid --help for command-line options

  • See Troubleshooting for common issues