private void startSampleScan(DroidefenseProject project) throws UnknownAnalyzerException { Log.write(LoggerType.TRACE, "Project ID:\t" + project.getProjectId()); AbstractAndroidAnalysis analyzer = AnalysisFactory.getAnalyzer(AnalysisFactory.GENERAL); project.analyze(analyzer); }
@Override public boolean analyze() { Log.write(LoggerType.INFO, "In-memory .apk decoder..."); //unpack file if (currentProject.getUsedUnpacker() == APKUnpacker.ZIP) { //since files are extracted using zip algorithm. no resource decoding nor xml deconfing is done. //now it is the time to do so. ArrayList<VirtualFile> files = currentProject.getAppFiles(); executionSuccessful = !files.isEmpty(); if (executionSuccessful) { apkFile.decodeWithTechnique(files); currentProject.setAppFiles(files); } } timeStamp.stop(); return executionSuccessful; }
@Override public void onExecute() { Manifest manif = currentProject.getManifestInfo(); if (manif != null) { sharedId = currentProject.getManifestInfo().getSharedUserId(); positiveMatch = sharedId != null && sharedId.length() > 0; } }
@Override public boolean unpackWithTechnique(DroidefenseProject currentProject, LocalApkFile apkFile) { MemAPKToolHandler handler = new MemAPKToolHandler(currentProject, apkFile); handler.doTheJob(); //todo implement memapktool decoding //TODO enable file, folder counting currentProject.setCorrectDecoded(true); ArrayList<VirtualFile> appfiles = currentProject.getAppFiles(); return appfiles != null && appfiles.size() > 0; }
ArrayList<VirtualFile> files = currentProject.getAppFiles(); ArrayList<DexHashedFile> dexList = new ArrayList<>(); this.currentProject.setDexList(dexList); this.currentProject.setRawFiles(rawFiles); this.currentProject.setAssetsFiles(assetFiles); this.currentProject.setLibFiles(libFiles); this.currentProject.setOtherFiles(otherFiles); this.currentProject.setDefaultFiles(defaultFiles); this.currentProject.setNumberofDex(dexList.size()); this.currentProject.setManifestFile(manifest); this.currentProject.setMetainfManifestFile(metamanifest); this.currentProject.setCertificateFile(certFile); this.currentProject.setProjectFolderName(FileIOHandler.getUnpackOutputPath(apk));
public void writeNaturalReport() { StringBuilder data = new StringBuilder(); String pkg = getManifestInfo().getPackageName() == null ? "unknown" : getManifestInfo().getPackageName(); String url = "https://www.virustotal.com/es/file/" + getProjectId().toLowerCase() + "/analysis/"; int entries = getInternalInfo().getEntryPoints().size(); data.append("<p>Analyzed application is called <strong>" + this.sample.getFilename() + "</strong> but it's internal name is <tt>" + pkg + "</tt></p>\n"); data.append("\n"); data.append("<p>Its file signature as unique SHA 256 bits identifier is <tt>" + getProjectId() + "</tt></p>\n"); data.append("\n"); data.append("<p>and VirusTotal result can be found at: <a href=\"" + url + "\" target=\"_blank\">" + url + "</a></p>\n"); data.append("\n"); Manifest info = getManifestInfo(); if (info != null) { ArrayList<UsesPermission> permissionList = info.getUsesPermissionList(); setSummary(data.toString());
currentProject.analyze(analyzer); if (currentProject.isCorrectUnpacked()) { currentProject.analyze(analyzer); if (currentProject.isCorrectDecoded()) { currentProject.analyze(analyzer); if (currentProject.isStaticAnalysisDone()) { currentProject.analyze(analyzer); currentProject.analyze(analyzer); currentProject.analyze(analyzer); if (currentProject.isDynamicAnalysisDone()) { currentProject.analyze(analyzer); currentProject.analyze(analyzer); currentProject.analyze(analyzer); currentProject.analyze(analyzer); currentProject.analyze(analyzer);
private void executeCustom(CommandLine cmd) throws UnknownAnalyzerException { this.project = new DroidefenseProject(); //get user selected unpacker. default zip APKUnpacker unpacker = APKUnpacker.ZIP; if (cmd.hasOption("unpacker")) { String unpackerStr = cmd.getOptionValue("unpacker"); unpacker = APKUnpacker.getUnpackerFromStringName(unpackerStr); } this.project.setUsedUnpacker(unpacker); if (cmd.hasOption("output")) { project.setSettingsReportType(cmd.getOptionValue("output")); } //set boolean values project.setSettingAutoOpen(cmd.hasOption("show")); Log.beVerbose(cmd.hasOption("verbose")); //read user selected .apk if (cmd.hasOption("input")) { processInput(cmd, unpacker); } else { //as default action options.showHelp(); } }
@Override public ArrayList<VirtualFile> decodeWithTechnique(DroidefenseProject currentProject, ArrayList<VirtualFile> files) { //files are already decoded when unpacking return currentProject.getAppFiles(); }
private void generateReportTemplate() throws IOException { switch (getSettingsReportType()) { case "html": reporter = new HTMLReporter(); break; case "json": { String jsonData = Util.toJson(this, JsonStyle.JSON_BEAUTY); File reportFile = FileIOHandler.getReportFolder(getProjectId() + ".json"); reporter = new BeautifiedJSONReporter(reportFile, jsonData); break; } case "json.min": { String jsonData = Util.toJson(this, JsonStyle.JSON_COMPRESSED); File reportFile = FileIOHandler.getReportFolder(getProjectId() + ".min.json"); reporter = new BeautifiedJSONReporter(reportFile, jsonData); break; } default: { //default output as beautified json String jsonData = Util.toJson(this, JsonStyle.JSON_BEAUTY); File reportFile = FileIOHandler.getReportFolder(getProjectId() + ".json"); reporter = new BeautifiedJSONReporter(reportFile, jsonData); break; } } reporter.generateReport(); if (isSettingAutoOpen()) { reporter.open(); } }
@Override protected boolean analyze() { if (currentProject != null && currentProject.getManifestInfo() != null) { this.usesPermissionsList = currentProject.getManifestInfo().getUsesPermissionList(); this.usesPermissions23List = currentProject.getManifestInfo().getUsesPermissionSdk23List(); this.permissionsList = currentProject.getManifestInfo().getPermissionList(); this.permissionGroupList = currentProject.getManifestInfo().getPermissionGroupList(); this.permissionTreeList = currentProject.getManifestInfo().getPermissionTreeList(); currentProject.setPrivacyResult(getPrivacyResult()); return executionSuccessful;
public static File getApkUnpackDir(DroidefenseProject project) { return new File(FileIOHandler.getUnpackOutputFile() + File.separator + project.getProjectId()); }
private void extractCertInfo(InputStream in) throws IOException { PKCS7 p7 = new PKCS7(in); X509Certificate[] cert = p7.getCertificates(); currentProject.setCertNumber(cert.length); for (X509Certificate c : cert) { System.out.println(c.toString()); certInfo = new CertificateModel(c); currentProject.addCertInfo(certInfo); } }
@Override public boolean doTheJob() { //for each dex file, read header DexFileLoader loader = new DexFileLoader(currentProject); loader.readAllDexAvailable(); //for each dex file, calculate some statistics DexFileStatistics statistics = new DexFileStatistics(currentProject, loader); currentProject.addDexFileStatistics(statistics); return true; } }
newClass.setJavaObject(newInstance); newClass.setSuperClass(null); currentProject.addDexClass(name, newClass); return newClass; } else if (lastCallArgs == null && name.startsWith("java/lang/")) { newClass.setClass(s); newClass.setJavaObject(newInstance); currentProject.addDexClass(name, newClass); return newClass; } else if (lastCallArgs == null) { newClass.setClass(s); newClass.setJavaObject(newInstance); currentProject.addDexClass(name, newClass); return newClass; Object newInstance = constructor.newInstance(lastCallArgs); IDroidefenseClass newClass = buildFakeClss(name, newInstance); currentProject.addDexClass(name, newClass); return newClass; ((DVMTaintClass) javaClass).addDVMTaintField(new DVMTaintField(data[i], javaClass)); currentProject.addDexClass(name, javaClass); } else { javaClass = new DVMTaintClass(name); currentProject.addDexClass(name, javaClass);
currentProject.addDynamicPlugin(pluginDynamic); executionSuccessful &= true; } catch (ClassNotFoundException e) {
public void loadClasses(final byte[] dexFileContent, boolean multidex) { //todo add support for multiple dex files synchronized (loadClassesMutex) { this.dexFileContent = dexFileContent; dexBodyModel.setOffset(-1); checkData("magic number", "6465780A30333500"); skip("checksum", 4); skip("SHA-1 signature", 20); checkUInt("file size", dexFileContent.length); checkUInt("header size", 0x70); checkUInt("endian", 0x12345678); checkUInt("link size", 0); checkUInt("link offset", 0); readMap(); readStrings(); readTypes(); readDescriptors(); readFields(); readMethods(); readClassContents(); } project.addDexBodyModel(dexBodyModel); }
@Override public ArrayList<VirtualFile> decodeWithTechnique(DroidefenseProject currentProject, ArrayList<VirtualFile> files) { //files are already decoded when unpacking return currentProject.getAppFiles(); }
@Override public void parserCode() { Log.write(LoggerType.INFO, "\n\nSearching for Steganos content...\n\n"); ArrayList<VirtualFile> fileList = currentProject.getAppFiles(); /*for (AbstractHashedFile r : fileList) { //TODO implement at least LSB algorithm }*/ } }
public void onPreExecute() { packageName = currentProject.getManifestInfo().getPackageName(); if (packageName != null) { url = BASE_URL + packageName; } }