Tracing Activities

• For tracing activities we also need to understand the activity lifecycle which is nicely documented here Android Activity Documentation.

Android Activity Lifecycle

• This image provides an brief overview of android activity lifecycle.

• onCreate() - Called when the activity is first created.

  • Provides Bundle containing activity’s previous frozen state ,if there was one.

  • Always followed by onStart()

• onRestart() - Called after the activity was stopped and before stating again

  • Always followed by onStart()

• onStart() - Called when activity is becoming visible to users.

  • Followed by onResume() (if activity comes to the foreground) or onStop() (If it becomes hidden)

• onResume() - Called when the activity interacts with the user (i.e. activity is at the top and running).

  • Always followed by onPause() .

  • This is best to hook if we want to know which activity is at the top currently.

• onPause() - Called when activity is no longer in foreground. (before transition to stopped/hidden or destroyed).

  • Next activity will not be resumed until this method returns.

  • Followed by onResume() (if activity returns back to front) or onStop() (if it becomes invisible to users)

• onStop() - Called when activity is no longer visible to user. (either another activity is being brought on front so previous one stops or the activity is being destroyed).

  • Followed by either onRestart() (if this activity is coming back to interact with the user or onDestroy() (If this activity is going away)).

• onDestroy() - Called before the activity is fully destroyed

  • This can happen either because the activity finished or the system closed the activity to save space (or due to some other reason).

    • To distinguish b/w these two scenarios we can use isFinishing() method. (this method return a boolean value)

• Frida Script to do so:-

Java.perform(() => {
    let activityclass = Java.use("android.app.Activity");
    activityclass.onResume.implementation = function() {
        console.log("Activity resumed: " + this.getClass().getName());
        this.onResume();
    }
})

---