测试apk-异常管控Sensor攻击者开发

1. 目的

基于《软件绿色联盟应用体验标准》中 Sensor 资源的定义，对 Sensor 后台持续使用的测试apk。旨在触发手机中异常功耗管控机制。

可以明确，不会触发Sensor的异常通知提醒，但是有日志输出

2022-06-21 15:55:02.841 2585-2839/com.huawei.iaware D/APwActAnalysis: not process sensor 330389ms, pkg:com.sufadi.blocksensor
2022-06-21 15:55:02.860 2585-2839/com.huawei.iaware D/APwActAnalysis: not process sensor 330408ms, pkg:com.huawei.health
2022-06-21 15:55:02.863 2585-2839/com.huawei.iaware D/APwActAnalysis: not process sensor 330406ms, pkg:com.ss.android.article.news
2022-06-21 15:55:02.874 2585-2839/com.huawei.iaware D/APwActAnalysis: not process sensor 330417ms, pkg:com.cootek.crazyreader
2022-06-21 15:55:02.888 2585-2839/com.huawei.iaware D/APwActAnalysis: not process sensor 330428ms, pkg:com.huawei.hwireader


    private void analyseSensorAct(AppPowerRecord appPowerRecord, long duration) {
        long sensorTime = appPowerRecord.getSensorTime();
        int powerLevel = AppPowerLevelConfig.getPowerLevel(3);
        if (mIAbnormalPolicy.isAbnormalOptimOkay(appPowerRecord.mAppName, appPowerRecord.mUid, -1, "sensor", duration, (int) sensorTime) >= 1) {
            Log.i("APwActAnalysis", "PAS sensor optim: " + appPowerRecord.mAppName);
        } else if (!isImportantOsApp(appPowerRecord.mAppName, appPowerRecord.mUid, true)) {
            if ((powerLevel == 2 || powerLevel == 3) && DEBUG_USB) {
                Log.d("APwActAnalysis", "not process sensor " + sensorTime + "ms, pkg:" + appPowerRecord.mAppName);
            }
        }
    }

2. 测试步骤

H手机和T手机、其他手机进行安装该apk.
所有手机都需要设置应用为白名单。

2.1 手机白名单设置方法：

手机管家->应用启动设置：允许自启动、允许关联启动、允许后台启动

2.2 测试环境

除了白名单，其他无

2.3 运行本apk

灭屏后台的使用行为检测，直接打开应用运行，home键，退到后台，拔掉USB线，灭屏10分钟后，导出日志

3. apk 源码

本apk作用：后台无限制使用Sensor

3.1 UI

3.2 核心逻辑

3.2.1 MainActivity

package com.sufadi.blocksensor

import android.content.Intent
import androidx.appcompat.app.AppCompatActivity
import android.os.Bundle

class MainActivity : AppCompatActivity() {

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContentView(R.layout.activity_main)

        startService(Intent(this, BlockSensorService::class.java))
    }
}

3.3.2 权限配置

    <!-- 前台服务属性权限 -->
    <uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION"/>

3.3.3 核心逻辑

任意注册一个Sensor，并后台常驻运行

package com.sufadi.blocksensor

import android.app.Notification
import android.app.NotificationChannel
import android.app.NotificationManager
import android.app.Service
import android.content.Context
import android.content.Intent
import android.hardware.Sensor
import android.hardware.SensorManager
import android.location.Location
import android.location.LocationListener
import android.location.LocationManager
import android.os.Bundle
import android.os.IBinder
import android.util.Log
import android.R.attr.y
import android.R.attr.x
import android.hardware.SensorEvent
import android.hardware.SensorEventListener
import androidx.core.content.ContextCompat.getSystemService
import android.icu.lang.UCharacter.GraphemeClusterBreak.T



class BlockSensorService: Service() {

    var sensorMgr: SensorManager? = null
    var sensor: Sensor? =null

    companion object {
        val TAG = "BlockSensorService"
        val FORGROUND_ID = 0x11
    }


    override fun onBind(p0: Intent?): IBinder? {
        return null
    }

    override fun onCreate() {
        super.onCreate()
        Log.d(TAG, "onCreate")
        startMyForeground()

        sensorMgr = getSystemService(SENSOR_SERVICE) as SensorManager
        sensor = sensorMgr?.getDefaultSensor(Sensor.TYPE_ACCELEROMETER)
        Log.d(TAG, "registerSensorListener :" + this.baseContext.packageName)
        sensorMgr?.registerListener(InnerSensorEventListener(), sensor, SensorManager.SENSOR_DELAY_NORMAL)
    }

    inner class InnerSensorEventListener : SensorEventListener {

        override
        fun onSensorChanged(e: SensorEvent) {

            val x = e.values[SensorManager.DATA_X]

            val y = e.values[SensorManager.DATA_Y]

            val z = e.values[SensorManager.DATA_Z]

            Log.d(TAG, "x=" + x + "," + "y=" + y + "," + "z=" + z)

        }

        override
        fun onAccuracyChanged(s: Sensor, accuracy: Int) {

        }

    }

    override fun onDestroy() {
        super.onDestroy()
        stopForeground(true)
    }


    private fun startMyForeground() {
        Log.d(TAG, "startMyForeground show notification")
        Log.d(TAG, "PhoneDataService startMyForeground sdk :" + android.os.Build.VERSION.SDK_INT)
        val nb = Notification.Builder(this)

        if (android.os.Build.VERSION.SDK_INT >= 26) {
            val CHANNEL_ONE_ID = "channel_id_foreground"
            val CHANNEL_ONE_NAME = "Channel One"
            var notificationChannel: NotificationChannel? = null

            notificationChannel = NotificationChannel(
                CHANNEL_ONE_ID,
                CHANNEL_ONE_NAME, NotificationManager.IMPORTANCE_LOW
            )

            nb.setChannelId(CHANNEL_ONE_ID)

            val manager = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
            manager.createNotificationChannel(notificationChannel)
        }

        nb.setSmallIcon(R.mipmap.ic_launcher)
        nb.setContentTitle(getString(R.string.notification_title))
        nb.setContentText(getString(R.string.notification_Content))

        try {
            startForeground(FORGROUND_ID, nb.build())
        } catch (e: Exception) {
            e.printStackTrace()
        }

    }
}

3.3.4 华为异常检测日志

可以明确，不会触发Sensor的异常通知提醒，但是有日志输出

2022-06-21 15:55:02.841 2585-2839/com.huawei.iaware D/APwActAnalysis: not process sensor 330389ms, pkg:com.sufadi.blocksensor
2022-06-21 15:55:02.860 2585-2839/com.huawei.iaware D/APwActAnalysis: not process sensor 330408ms, pkg:com.huawei.health
2022-06-21 15:55:02.863 2585-2839/com.huawei.iaware D/APwActAnalysis: not process sensor 330406ms, pkg:com.ss.android.article.news
2022-06-21 15:55:02.874 2585-2839/com.huawei.iaware D/APwActAnalysis: not process sensor 330417ms, pkg:com.cootek.crazyreader
2022-06-21 15:55:02.888 2585-2839/com.huawei.iaware D/APwActAnalysis: not process sensor 330428ms, pkg:com.huawei.hwireader


    private void analyseSensorAct(AppPowerRecord appPowerRecord, long duration) {
        long sensorTime = appPowerRecord.getSensorTime();
        int powerLevel = AppPowerLevelConfig.getPowerLevel(3);
        if (mIAbnormalPolicy.isAbnormalOptimOkay(appPowerRecord.mAppName, appPowerRecord.mUid, -1, "sensor", duration, (int) sensorTime) >= 1) {
            Log.i("APwActAnalysis", "PAS sensor optim: " + appPowerRecord.mAppName);
        } else if (!isImportantOsApp(appPowerRecord.mAppName, appPowerRecord.mUid, true)) {
            if ((powerLevel == 2 || powerLevel == 3) && DEBUG_USB) {
                Log.d("APwActAnalysis", "not process sensor " + sensorTime + "ms, pkg:" + appPowerRecord.mAppName);
            }
        }
    }