HAL-Based Resource Manipulation Monitoring on AOSP

Table 3

HALWatcher vs. Frida in resource manipulation monitoring.

Test cases	HALWathcer	Frida
Ability to hook into the process which
Send SMS with normal app on rooted device	100%	100%
Send SMS with normal app on nonrooted device	100%	0%
Trojan-SMS request sendSMS on rooted device	100%	76%
Trojan-SMS request sendSMS on nonrooted device	100%	93%
Send SMS using ADB shell on rooted device	100%	0%
Send SMS using ADB shell on nonrooted device	100%	0%
Log size retrieved in the test of (#line)
Normal SMS apps	1	6.8
Trojan-SMS apps	1.84	3.84