---
description: >-
  Hello everyone , In this blog post , I will try to explain my solution steps
  for Cycle Scanner challenge from Mobile Hacking Lab Platform . i hope it will
  be useful for you
---

# Cycle Scanner

1.  After install the app : my App GUI has a problem and i can’t access the button that enable the service use this command to enable the service :

    1. `adb shell am startservice com.mobilehackinglab.cyclicscanner/.scanner.ScanService`

    ![image.png](https://2140186435-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpoPpsF6DyQtOrXy70rxC%2Fuploads%2FNwlZkHOAs83H0UunxlWz%2Fimage.png?alt=media)
2. let’s examine the `AndroidManifest.xml file` we found : Main Activity and the Service :
3. **Main Activity Structure :**
   1. `handlePermissions()` :
      1. Checks if the app has permission to manage all files. If granted, calls `setupSwitch`; otherwise, launches an intent to request the permission.
   2. `setupSwitch()` :
      1. handle enabling or disabling the scan service.
      2. If switched on, starts the scan service and shows a toast message.
      3. If switched off, displays a toast stating that the service cannot be stopped and forces the switch back to "on."
   3. `startService()` :
      1. Starts the scan service in the foreground and displays a toast indicating that the service has started . :
4. **Scan Service Structure :**
   1. Service Lifecycle :
      1. onCreate (): Initializes the handler thread (`HandlerThread`) and sets up the `ServiceHandler` with the new thread’s `Looper`.
      2. onStartCommand () : Starts the foreground notification and sends a message to `ServiceHandler` to begin scanning.
      3. onBind () : Returns `null`, as this service does not support binding.
   2. we have the channel\_id : `ForegroundScanServiceChannel` and the channel\_name `ScanService`
   3. Access the External Storage :
      1. `Environment.getExternalStorageDirectory()` Retrieves the external storage directory using and checks if it is not `null`.
      2. **`File externalStorageDirectory`** represents the root directory of the external storage.
   4. use `FilesKt.walk` to look for Each file is checked for readability and whether it is a file.
      1.  Scan Each File : `ScanEngine.INSTANCE.scanFile(file)` to determine if the file is safe. Logs the result as either "SAFE" or "INFECTED”

          <figure><img src="https://2140186435-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpoPpsF6DyQtOrXy70rxC%2Fuploads%2FSwapEtyGLUDUNYR4BNmX%2Fimage.png?alt=media&#x26;token=c38393a7-39f4-43be-b44d-56d091b33d52" alt=""><figcaption></figcaption></figure>
5. **ScanFile Function :**
   1. scans a given file to check whether its hash matches any known malware samples.
   2. Uses `ProcessBuilder` to execute the command in a shell `.command("sh", "-c", command)` , redirecting the error stream to the standard output to the external storage .
   3. Read Command Output : Retrieves the output of the `toybox sha1sum` command
   4.  then Extract Hash Value and Compare Hash Against Known Malware

       <figure><img src="https://2140186435-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpoPpsF6DyQtOrXy70rxC%2Fuploads%2FZsUr5DnzYYsU2WSs59tX%2Fimage.png?alt=media&#x26;token=b86ad683-de9a-4995-afa7-10b1e0b58fa8" alt=""><figcaption></figcaption></figure>
6. attack here try to manipulate the object that created in the `AbsolutePath`
   1. create a file that contain malicious code the upload the file and then launch the scan : `"nano test.txt ; touch kero"` contain command `"test.txt ; touch kero "` and then upload it to the /sdcard/Download
   2.  and here we success

       <figure><img src="https://2140186435-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpoPpsF6DyQtOrXy70rxC%2Fuploads%2Fksd9nVe8bH4h1O1NTyDK%2Fimage.png?alt=media&#x26;token=f43d6172-6b04-4171-870d-635514bcf71b" alt="" width="252"><figcaption></figcaption></figure>
