add additional android rules

nursery/get-current-process-filesystem-mounts-on-linux.yml

@@ -0,0 +1,16 @@
+rule:
+  meta:
+    name: get current process filesystem mounts on Linux
+    namespace: host-interation/process
+    authors:
+      - [email protected]
+    scopes:
+      static: basic block
+      dynamic: call
+  features:
+    - and:
+      - or:
+        - os: linux
+        - os: android
+      - match: create or open file
+      - string: "/proc/self/mounts"

nursery/get-system-property-on-android.yml

@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: get system property on Android
+    namespace: host-interation/process
+    authors:
+      - [email protected]
+    scopes:
+      static: basic block
+      dynamic: call
+  features:
+    - and:
+      - os: android
+      - api: __system_property_get

nursery/load-packed-dex-via-jiagu-on-android.yml

@@ -0,0 +1,19 @@
+rule:
+  meta:
+    name: load packed DEX via Jiagu on Android
+    namespace: anti-analysis
+    authors:
+      - [email protected]
+    scopes:
+      static: function
+      dynamic: thread
+    references:
+      - https://github.com/Frezrik/Jiagu
+  features:
+    - and:
+      - os: android
+      - string: "NDK_JIAGU"
+      - string: "[-]get %s handle failed:%s"
+      - string: "[-]ANONYMOUS mmap failed:%s"
+      - string: "[-]g_sdk_int Update cookie failed"
+      - string: "dalvik/system/InMemoryDexClassLoader"