def Main1(): inputAPK = "/home/guochenkai/droidWorkspace/Servicesink/bin/Servicesink.apk" #code = "onLocationChanged" apk, d, inputDex = AnalyzeAPK(inputAPK) #try: #d = DalvikVMFormat(open(inputDex, "rb").read()) #except Exception, e: #print "[E]Target file is valid" dx = uVMAnalysis(d) gx = GVMAnalysis(dx, None) d.set_vmanalysis(dx) d.set_gvmanalysis(gx) #sinkpremethods = [] sink_id = 1 c = CsdAnalysis(d, apk) #c.SinkMatchCode(csdConf.sink[-1], code, True) sinkpremethods = c.FindSinkPremethods() #method_node = MethodNode() #print c.MethodCmp(method_node, csdConf.sink[-1], True) if len(sinkpremethods) > 0: for singlesinkpre in sinkpremethods: print "###############" for sink, method_list in c.map_sinkpremethod.items(): if method_list == singlesinkpre: print "[sink}: " + sink + "\n" for s in singlesinkpre: if s.get_class_name().find("Service")>-1 or \ d.get_class(s.get_class_name()).get_superclassname().find("Service")>-1 : print " [premethod]: "+ s.get_name() + " [class name]"+s.get_class_name()\ + " [super class name]"+d.get_class(s.get_class_name()).get_superclassname()+"\n"
def globalvuls_dir(directory): list_dirs = os.walk(directory) for root, dirs, files in list_dirs: #for d in dirs: #print os.path.join(root, d) for f in files: abs_f = os.path.join(root, f) try: apk, d, inputDex = AnalyzeAPK(abs_f) csdGlobal.Main_Global((apk, d, inputDex), abs_f) except Exception, e: print "[ERROR]: app:" + str(abs_f) + "\n" traceback.print_exc()
def collectconditionblock_dir(directory): list_dirs = os.walk(directory) for root, dirs, files in list_dirs: #for d in dirs: #print os.path.join(root, d) for f in files: abs_f = os.path.join(root, f) try: apk, d, inputDex = AnalyzeAPK(abs_f) csdAnalysis.Main_Collect((apk, d, inputDex)) except Exception, e: print "[ERROR]: app:" + str(abs_f) + "\n" traceback.print_exc()
def pathfromsourcetosink_dir(directory): #print postfix list_dirs = os.walk(directory) for root, dirs, files in list_dirs: #for d in dirs: #print os.path.join(root, d) for f in files: abs_f = os.path.join(root, f) try: apk, d, inputDex = AnalyzeAPK(abs_f) csdAnalysis.Main_BackTrace_Source((apk, d, inputDex)) except Exception, e: print "[ERROR]: app:" + str(abs_f) + "\n" traceback.print_exc()
def servicewithsink_dir(directory): #print postfix list_dirs = os.walk(directory) for root, dirs, files in list_dirs: #for d in dirs: #print os.path.join(root, d) for f in files: #postfix = f[f.rfind(".")+1:] abs_f = os.path.join(root, f) try: apk, d, inputDex = AnalyzeAPK(abs_f) csdAnalysis.Main_If_Servicewithsink((apk, d, inputDex)) except Exception, e: print "[ERROR]: app:" + str(abs_f) + "\n" traceback.print_exc()
def read_apk(apk_name, md5): """ Read apk file and return a, d, dx """ # apk_basename = os.path.basename(apk_name) apk_session_name = apk_session_dir + md5 + ".apk" # mkdir session if not os.path.isdir(apk_session_dir): os.system("mkdir '{}'".format(apk_session_dir)) # check if session saved if not os.path.isfile(apk_session_name): a, d, dx = AnalyzeAPK(apk_name) androlyze.save_session([a, d, dx], apk_session_name) else: a, d, dx = androlyze.load_session(apk_session_name) return a, d, dx
def run_command(argv): try: # retrieve the arguments if (len(argv) == 0): print('Arguments number must not be 0, please try again.') usage() return opts, args = getopt.getopt( argv, 'hp:s:c:g:', ['help', 'path=', 'service=', 'collect=', 'global=']) #for a in argv: #print "args: " +a +"\n" #print str(len(opts)) except getopt.GetoptError as err: print(err) usage() sys.exit(2) compile_option = None run_option = None for o, a in opts: #print "o: "+ o + " a: " + a+"\n" if o in ('-h', "--help"): #print "i am help \n" usage() sys.exit() elif o in ('-p', '--path'): gen_option = a if gen_option == 'apk': if o == '-p': apkPath = argv[2] else: apkPath = argv[1] try: apk, d, inputDex = AnalyzeAPK(apkPath) csdAnalysis.Main_BackTrace_Source((apk, d, inputDex)) except Exception, e: print "[ERROR]: app:" + apkPath + "\n" traceback.print_exc() #elif gen_option == 'dex': #if o=='-p': #dexPath = argv[2] #else: dexPath = argv[1] #csdAnalysis.Main_BackTrace_Source(dexPath, "dex") elif gen_option == 'dir': if o == '-p': dirPath = argv[2] else: dirPath = argv[1] pathfromsourcetosink_dir(dirPath) elif o in ('-s', '--service'): #print argv[1]+"\n" gen_option = a if gen_option == 'apk': #print argv[2]+"\n" if o == '-s': apkPath = argv[2] else: apkPath = argv[1] #csdAnalysis.Timeout_Main_If_Servicewithsink(apkPath, "apk") try: apk, d, inputDex = AnalyzeAPK(apkPath) csdAnalysis.Main_If_Servicewithsink((apk, d, inputDex)) except Exception, e: print "[ERROR]: app:" + apkPath + "\n" traceback.print_exc()
else: dirPath = argv[1] servicewithsink_dir(dirPath) elif o in ('-c', '--collect'): #print argv[1]+"\n" gen_option = a if gen_option == 'apk': #print argv[2]+"\n" if o == '-c': apkPath = argv[2] else: apkPath = argv[1] #csdAnalysis.Timeout_Main_If_Servicewithsink(apkPath, "apk") try: apk, d, inputDex = AnalyzeAPK(apkPath) csdBlockAnalysis.Main_Collect((apk, d, inputDex)) except Exception, e: print "[ERROR]: app:" + apkPath + "\n" traceback.print_exc() #elif gen_option == 'dex': #if o=='-c': #dexPath = argv[2] #else: dexPath = argv[1] ##csdAnalysis.Timeout_Main_If_Servicewithsink(dexPath, "dex") #csdBlockAnalysis.Main_Collect(dexPath, "dex") elif gen_option == 'dir': if o == '-c': dirPath = argv[2]
with open(csdConf.mtrace_result_path, mode='a') as f: f.write("[app] " + inputContent + "\n") f.write("--[error-2] timeout!\n") print "[error-2] timeout" return if __name__ == "__main__": #Main_BackTrace_Source() #Main_If_Servicewithsink() #inputContent = "/home/guochenkai/droidWorkspace/Servicesink/bin/Servicesink.apk"; inputContent = "/home/guochenkai/download/SW/clawer_googleplay/appcralwer/toilet.samruston.com.toilet.apk" inputAPK = inputContent try: apk, d, inputDex = AnalyzeAPK(inputAPK) print "parse success!!\n" except: print "[error-1]: Could not be parsed!" with open(csdConf.result_path, mode='a') as f: f.write("[app] " + inputContent + "\n") f.write("--[error-1] Androguard parse error!\n") #return csd = CsdAnalysis(d, apk) ##Main_If_Servicewithsink((apk,d,inputDex),"com.example.servicesink.OtherActivitywithsink") c, ret = Main_If_Servicewithsink((apk, d, inputDex), csdConf.first_state_class) #c,ret = Main_If_Servicewithsink((apk,d,inputDex),"Service") #print "before:" + str(ret)+" "+ str(len(ret))+"\n"
def Main(inputAPK, k_file, csp_file, reduction_csp_file): #inputAPK = "/home/guochenkai/download/SW/androguard/androguard/csdTesting/testing/testNotificationIcon.apk"; #inputAPK = "/home/guochenkai/droidWorkspace/GlobalVariable1/bin/GlobalVariable1.apk" #inputAPK = target_apk #inputAPK = "/home/guochenkai/download/SW/androguard/androguard/csdTesting/apps/benign/GPS/appinventor.ai_ikstarr.Garmin_GPS.apk" #directory = "/home/guochenkai/download/SW/androguard/androguard/AndroChecker/test" #textfilename= "/home/guochenkai/download/SW/androguard/androguard/AndroChecker/results" #list_dirs = os.walk(directory) #for root, dirs, files in list_dirs: #for d in dirs: #print os.path.join(root, d) #for f in files: # abs_f = os.path.join(root,f) try: with open(k_file, "a") as textfile: #signal.signal(signal.SIGALRM, handler) #signal.alarm(AndroConf.time_out) time_start = time.clock() parseResullt = AnalyzeAPK(inputAPK) time_parsed = time.clock() textfile.write("parse success!!\n") print "parse success!!\n" print "[parse time]: " + str(time_parsed - time_start) + "(sec)\n" #textfile.write("[parse success] \n") #textfile.write("[parse time]: " + str(time_parsed-time_start) + "(sec)\n") model = AndroGeneralModel.AndroGeneralModel(parseResullt) #ret = model.get_register_methods() #print ret if model.get_states(): ######################################## # category states according to component ######################################## # activities = {activity_name: {label_name: state, ...}, activity_name: {},...} # services are the same activities = {} services = {} receivers = {} activity_state_life_num = 0 service_state_life_num = 0 receiver_state_life_num = 0 activity_state_original_num = 0 service_state_original_num = 0 receiver_state_original_num = 0 for s in model.states: if s["component"] == "Activity": if not activities.has_key(s["label"].split(" ")[0]): activities[s["label"].split(" ")[0]] = {} activities[s["label"].split(" ")[0]][ s["label"]] = s else: activities[s["label"].split(" ")[0]][ s["label"]] = s if s["attr"] == model.ATTRORIGINAL: activity_state_original_num = activity_state_original_num + 1 else: activity_state_life_num = activity_state_life_num + 1 if s["component"] == "Service": if not services.has_key(s["label"].split(" ")[0]): services[s["label"].split(" ")[0]] = {} services[s["label"].split(" ")[0]][s["label"]] = s else: services[s["label"].split(" ")[0]][s["label"]] = s if s["attr"] == model.ATTRORIGINAL: service_state_original_num = service_state_original_num + 1 else: service_state_life_num = service_state_life_num + 1 if s["component"] == "Receiver": if not receivers.has_key(s["label"].split(" ")[0]): receivers[s["label"].split(" ")[0]] = {} receivers[s["label"].split(" ")[0]][s["label"]] = s else: receivers[s["label"].split(" ")[0]][s["label"]] = s #if s["attr"] == model.ATTRORIGINAL: #receiver_state_original_num = receiver_state_original_num +1 #else : #receiver_state_life_num = receiver_state_life_num + 1 lifecycle_total_nodes = activity_state_life_num + service_state_life_num orginal_total_nodes = activity_state_original_num + service_state_original_num ############################ # components statistic textfile.write( "############################\n# components statistic\n") textfile.write("activities:" + str(len(activities)) + "\n") textfile.write("services:" + str(len(services)) + "\n") textfile.write("receivers:" + str(len(receivers)) + "\n") ############################ # life_nodes statistic textfile.write( "############################\n# life_nodes statistic\n") textfile.write("activities: " + str(activity_state_life_num) + "\n") textfile.write("services: " + str(service_state_life_num) + "\n") #textfile.write("receivers: " + str(receiver_state_life_num) +"\n") textfile.write("------------------------------------------\n") textfile.write("lifecycle_total_nodes: " + str(lifecycle_total_nodes) + "\n") ############################ # generate lifecycle edges el_activities = 0 el_services = 0 #el_receivers = 0 hidden_node_edge_a = [0, 0] hidden_node_edge_s = [0, 0] #hidden_node_edge_r = [0,0] for activity_name in activities: model.activity_life(activities[activity_name]) el_activities = model.cal_edge_num(model.edges) hidden_node_edge_a[0] = model.hidden_nodes_edges_num[0] hidden_node_edge_a[1] = model.hidden_nodes_edges_num[1] for service_name in services: model.service_life(services[service_name]) el_services = model.cal_edge_num(model.edges) - el_activities hidden_node_edge_s[0] = model.hidden_nodes_edges_num[ 0] - hidden_node_edge_a[0] hidden_node_edge_s[1] = model.hidden_nodes_edges_num[ 1] - hidden_node_edge_a[1] #for receiver_name in receivers: #model.receiver_life(receivers[receiver_name]) #el_receivers = model.cal_edge_num(model.edges)- el_services - el_activities #hidden_node_edge_r[0] = model.hidden_nodes_edges_num[0]-hidden_node_edge_a[0]-hidden_node_edge_s[0] #hidden_node_edge_r[1] = model.hidden_nodes_edges_num[1]-hidden_node_edge_a[1]-hidden_node_edge_s[1] lifecycle_total_edges = model.cal_edge_num(model.edges) textfile.write( "############################\n# lifecycle edges\n") textfile.write("edges_lifecycle_activities:" + str(el_activities) + "\n") textfile.write("edges_lifecycle_services:" + str(el_services) + "\n") #textfile.write("edges_lifecycle_receivers:" + str(el_receivers) +"\n") textfile.write( "--------------------------------------------\n") textfile.write("edges_lifecycle_total:" + str(lifecycle_total_edges) + "\n") ############################ # hidden_nodes_edges statistic textfile.write( "############################\n# hidden_nodes_edges statistic\n" ) textfile.write("activities_node_edge_num:" + str(hidden_node_edge_a) + "\n") textfile.write("services_node_edge_num:" + str(hidden_node_edge_s) + "\n") textfile.write( "--------------------------------------------\n") textfile.write("hidden_edge_total:" + str(model.hidden_nodes_edges_num) + "\n") ################################# # generate non-lifecycle nodes # non-life of original nodes that also belong to non-lifecycle textfile.write( "############################\n# non-lifecycle nodes statistic\n" ) textfile.write("original_activity_nodes_num: " + str(activity_state_original_num) + "\n") textfile.write("original_service_nodes_num: " + str(service_state_original_num) + "\n") textfile.write("original_receiver_nodes_num: " + str(receiver_state_original_num) + "\n\n") textfile.write("original_nodes_num: " + str(orginal_total_nodes) + "\n") textfile.write( "----------------------------------------------------\n") # non-life of register register_triples = model.get_register_methods()[0] unregister_triples = model.get_register_methods()[1] textfile.write("non_lifecycle_nodes_num(register_num): " + str(len(register_triples)) + "\n") textfile.write("unregister_num:" + str(len(unregister_triples)) + "\n") #textfile.write("non_lifecycle_nodes_content:\n") register_con_num = 0 unregister_con_num = 0 register_in_onCreate = [] regist_in_onCreate_content = [] register_content = "" unregister_content = "" for regi in register_triples: if not regi["register"]["register"].find("set") > -1: for mb in regi["method_b"]: if mb.method_name.find("onCreate") > -1: register_in_onCreate.append(regi) regist_in_onCreate_content.append( (mb.class_name + "**" + mb.method_name, regi["register"]["register"], regi["methods_f"][0].get_name())) print "<register_triple> \n" + str(regi) print "<path_conditions> \n" + str(regi["path_conditions"]) register_content = register_content + "[regiter_item]: " + str( regi) + "\n" register_content = register_content + "[method_b]:" + str( regi["method_b"][-1].method_name + "\n") register_content = register_content + "[path_conditions]: " + str( regi["path_conditions"]) + "\n" #textfile.write("[regiter_item]: " + str(regi) +"\n") #textfile.write("[path_conditions]: " + str(regi["path_conditions"]) +"\n") if len(regi["path_conditions"]) > 0: register_con_num = register_con_num + 1 print "\n*********************************\n <register_in_onCreate> \n" + str( len(register_in_onCreate)) + " \n " for r in register_in_onCreate: print str(r["method_b"]) + "\n" print "<regist_in_onCreate_content> \n" + str( regist_in_onCreate_content ) + "\n************************\n\n" textfile.write("-----------------------------------------\n") textfile.write("<regist_in_onCreate_content> " + str(len(regist_in_onCreate_content)) + "\n") for ro in regist_in_onCreate_content: textfile.write(" " + str(ro) + "\n") textfile.write("-----------------------------------------\n") for unregi in unregister_triples: print "<unregister_triple> \n" + str(unregi) print "<path_conditions> \n" + str( unregi["path_conditions"]) unregister_content = unregister_content + "[unregiter_item]: " + str( unregi) + "\n" unregister_content = unregister_content + "[method_b]:" + str( unregi["method_b"][-1].method_name + "\n") unregister_content = unregister_content + "[path_conditions]: " + str( unregi["path_conditions"]) if len(unregi["path_conditions"]) > 0: unregister_con_num = unregister_con_num + 1 #textfile.write("[unregiter_item]: " + str(unregi) +"\n") #textfile.write("[path_conditions]: " + str(unregi["path_conditions"]) +"\n") ################################# # generate conditions statistic textfile.write( "############################\n# conditions statistic\n") textfile.write("register_con_num: " + str(register_con_num) + "\n") textfile.write("unregister_con_num: " + str(unregister_con_num) + "\n") ################################# # generate non-lifecycle edges # generate original edges model.gene_edges_origianl() # generate register edges model.gene_edges_non_lifecycle(register_triples) textfile.write( "############################\n# non-lifecycle edges statistic\n" ) textfile.write("non_lifecycle_edges: " + str( model.cal_edge_num(model.edges) - lifecycle_total_edges) + "\n") #content = model.smv_gene() #with open (AndroConf.model_file, "a") as f: #f.writelines(content) inner_component_nodes_num = len(model.states) inner_component_edges_num = model.cal_edge_num(model.edges) print "<states> " + str(len(model.states)) + "\n" + str( model.states) print "<edges> " + str(model.cal_edge_num( model.edges)) + "\n" + str(model.edges) + "\n" ################################# # generate inner-component statistic textfile.write( "############################\n# inner-component nodes_edges statistic\n" ) textfile.write("inner-component: nodes:" + str(len(model.states)) + " edges:" + str(model.cal_edge_num(model.edges)) + "\n") ############################################## # generate edges and parallel edges connecting different components connections = model.find_connections() model.gene_edge_bridge_different_components(connections) inter_activities_num = model.cal_edge_num( model.edges) - inner_component_edges_num textfile.write( "############################\n# inter-component activities statistic\n" ) textfile.write("connections: " + str(inter_activities_num) + "\n") connection_content = "" for conn in connections: connection_content = connection_content + str( conn) + "\n\n" textfile.write( "############################\n# inter-component parralel(services) statistic\n" ) textfile.write("parralel_connections_num: " + str(model.cal_edge_num(model.parallel_edges)) + "\n") #textfile.write("parallel_slice_states_num: "+ str(parallel_slice_states_num) +"\n") parralel_edge_content = str(model.parallel_edges) print "<parallel_edges> " + str( model.cal_edge_num(model.parallel_edges)) + "\n" + str( model.parallel_edges) ################################################ # add the "attr_glob_vars" to each state model.merge_attri_to_state() print "############################\n<globals_num> " + str( model.globals_num) + "\n" print "<globals_op_num> " + str(model.globals_op_num) + "\n" textfile.write("############################\n<globals_num> " + str(model.globals_num) + "\n") textfile.write("<globals_op_num> " + str(model.globals_op_num) + "\n") ############################################## # translate to PAT model checking content = model.model_pat_gene(model.states, model.edges) with open(csp_file, "a") as f: f.write(content[0]) f.write("\n") f.write(content[1]) f.write("\n") f.write(content[2]) f.write("\n") f.write(content[3]) f.write("\n") f.write(content[4]) f.write("\n") f.write(content[5]) f.write("\n") ################################################### # translate to reduction model checking reduct = model.reduct_model_from_attri() if reduct != None: reduct_states = reduct[0] reduct_edges = reduct[1] content = model.model_pat_gene(reduct_states, reduct_edges) with open(reduction_csp_file, "a") as f: f.write(content[0]) f.write("\n") f.write(content[1]) f.write("\n") f.write(content[2]) f.write("\n") f.write(content[3]) f.write("\n") f.write(content[4]) f.write("\n") f.write(content[5]) f.write("\n") else: with open(reduction_csp_file, "a") as f: f.write("reduct as none!\n") ################################################### # total edges and nodes print "############################\n<final_states> " + str( len(model.states)) + "\n" + str(model.states) print "<final_edges> " + str(model.cal_edge_num( model.edges)) + "\n" + str(model.edges) textfile.write("############################\n# total num \n") textfile.write("total_reduct_nodes_num: " + str(len(model.states)) + "\n") textfile.write("total_reduct_edges_num: " + str(model.cal_edge_num(model.edges)) + "\n") ################################################ # total edges and nodes print "<final_reduction_states> " + str( len(reduct_states)) + "\n" + str(reduct_states) print "<final_reduction_edges> " + str( model.cal_edge_num(reduct_edges)) + "\n" + str( reduct_edges) textfile.write("############################\n# total num \n") textfile.write("total_nodes_num: " + str(len(reduct_states)) + "\n") textfile.write("total_edges_num: " + str(model.cal_edge_num(reduct_edges)) + "\n") ################################################ # time statistic time_end = time.clock() textfile.write("############################\n# total time \n") textfile.write("parse_time: " + str(time_parsed - time_start) + "\n") textfile.write("modelling_time: " + str(time_end - time_parsed) + "\n") ################################################ # content statistic textfile.write("\n############################\n") textfile.write("############################\n") textfile.write( "############################\n# register_content\n") textfile.write("register_content: " + register_content + "\n") textfile.write( "############################\n# unregister_content\n") textfile.write("unregister_content: " + unregister_content + "\n") textfile.write( "############################\n# connection_content\n") textfile.write("connection_content: " + connection_content + "\n") #textfile.write("############################\n# parallel_slice_states_content\n") #textfile.write("parallel_slice_states_content: "+ parallel_slice_states_content+"\n") textfile.write( "############################\n# parralel_edge_content\n") textfile.write("parralel_edge_content: " + parralel_edge_content + "\n") #signal.alarm(0) else: print "[ERROR]: get states error!" textfile.write("[ERROR]: get states error!") #csdAnalysis.Main_BackTrace_Source((apk,d,inputDex)) except Exception, e: print "[ERROR]: app:" + str(inputAPK) + "\n" print "[error-1]: Could not be parsed!" traceback.print_exc()
def get_application_name(self, xml_file): self.tree = ET.ElementTree(file = xml_file) for elem in self.tree.iter(tag="application"): for key in elem.attrib: print key if key.find("}name")>-1: return elem.attrib[key] return None def get_application_name_from_dom(self, dom): root = dom.documentElement nodes= root.getElementsByTagName("application") for n in nodes: if n.getAttribute("android:name")!= None: return n.getAttribute("android:name") #print n.childNodes[0].data return None if __name__ == "__main__": xml_file = "/home/guochenkai/download/SW/androguard/androguard/AndroChecker/test/test1.xml" inputAPK = "/home/guochenkai/droidWorkspace/GlobalVariable1/bin/GlobalVariable1.apk" parseResullt = AnalyzeAPK(inputAPK) manifest_dom = parseResullt[0].get_AndroidManifest() a = AndroXmlparser() ret = a.get_application_name_from_dom(manifest_dom) print ret
" (observed_set) observed_path_num: " + str(single_observed[sub_key]) + "\n") else: pass else: pass if __name__ == '__main__': method_trace = [] inputContent = "/home/guochenkai/droidWorkspace/Servicesink/bin/Servicesink.apk" inputAPK = inputContent try: apk, vm, inputDex = AnalyzeAPK(inputAPK) ##vmx = analysis.VMAnalysis(self.d) except: print "[error-1]: Could not be parsed!" #method1_list = vm.get_method("onCreate") #for method1 in method1_list: #if method1.get_class_name().find("MainActivity")!= -1: #method_trace.append(method1) ##for j in method_trace: ##j.show() csd = CsdAnalysis(vm, apk) csd_block = CsdBlockAnalysis(csd)