Add RethinkDNS support for Android - #1291
Merged
Merged
Conversation
Three artifacts from databases/rethink_logs.db. RethinkDNS runs as a local VPN, so while it is running it sees the whole device's name resolution and traffic: - DNS Queries: every name each app asked to resolve, with the app and package that asked, the record type, the resolved addresses with their country, the resolver used and whether the answer was blocked or served from cache. - Network Connections: every connection with the app and package that opened it, destination address and port, protocol decoded from the IANA numbers, country, bytes transferred, duration, and the DNS name that resolved to that address where the app could associate the two. - App Events: the VPN lifecycle, which is how an examiner tells a gap in the two logs above from a period of no activity. Timestamps are Unix milliseconds reported as UTC. The DnsLogs responseTime column held the identical value to latency on all 79 tested rows, so only one is reported. The other store, databases/bravedns.db, holds only RethinkDNS's own inventory of installed packages with a per-app firewall setting that was at its default on 292 of 293 rows, so it records no configuration a person made and is not parsed. Verified on a multi-container tree: the storage spellings collapse, a second Android user adds its own rows against known deltas (79 then 119 queries, 113 then 163 connections), and a decoy package adds none. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Row counts from a real aleapp.py run against the emu_a15_oss_v6 corpus. The zero-row values are checked absences: the tables are present and empty in that image, confirmed against the source stores. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds RethinkDNS (com.celzero.bravedns) support for Android. It runs as a local VPN, so while it is running it sees the whole device's name resolution and traffic. Three artifacts from databases/rethink_logs.db:
Both logs only cover periods when RethinkDNS was running, and a connection records the app that opened it rather than a person using that app at that moment; the notes say both. Timestamps are Unix milliseconds reported as UTC.
The DnsLogs responseTime column held the identical value to latency on all 79 tested rows, so only one is reported. The other store, databases/bravedns.db, holds only RethinkDNS's own inventory of installed packages with a per-app firewall setting that was at its default on 292 of 293 rows, so it records no configuration a person made and is not parsed. RethinkLog and IpInfo were present and empty.
Verified on a multi-container tree: the storage spellings collapse, a second Android user adds its own rows against known deltas (79 then 119 queries, 113 then 163 connections), and a decoy package adds none. sample_data follows with the next corpus capture.