Exemple #1
0
def from_dex_classes(classes):
    """Extract information from dex classes."""
    doc = dict()

    for class_, infos in classes.items():
        pkg, name = package.split_class(class_)
        _setitem(doc, "dex::package", pkg)
        _setitem(doc, "dex::class", name)

        pkg, name = package.split_class(infos.get("super"))
        _setitem(doc, "dex::super-package", pkg)
        _setitem(doc, "dex::super-class", name)

    return doc
Exemple #2
0
def test_can_split_class_identifier():
    # ok
    assert package.split_class("LProcess;") == (None, "Process")
    assert package.split_class("Landroid/os/Process;") == [
        "android/os", "Process"
    ]
    assert package.split_class("[Landroid/os/Process;") == [
        "android/os", "Process"
    ]

    # errors
    ## no L at beginning
    assert package.split_class("android/os/Process;") == (None, None)
    ## no ; at the end
    assert package.split_class("Landroid/os/Process") == (None, None)
Exemple #3
0
def from_dex_fields(fields):
    """Extract information from dex fields."""
    doc = dict()

    for infos in fields.values():
        pkg, class_ = package.split_class(infos.get("class"))

        _setitem(doc, "dex::package", pkg)
        _setitem(doc, "dex::class", class_)
        _setitem(doc, "dex::field", infos.get("name"))

    return doc
Exemple #4
0
def from_dex_methods(methods):
    """Extract information from dex methods."""
    doc = dict()

    for infos in methods.values():
        pkg, class_ = package.split_class(infos.get("class"))

        _setitem(doc, "dex::package", pkg)
        _setitem(doc, "dex::class", class_)
        _setitem(doc, "dex::method", infos.get("name"))
        _setitem(doc, "dex::code", infos.get("sha256"), on_key=lower)

    return doc
Exemple #5
0
def from_dex(doc):
    """Index artifacts from dex."""
    entries = defaultdict(set)

    entries["source.debug"].add(doc.get("debug", False))
    entries["source.format"].add(_lownone(doc.get("format")))

    for x in doc.get("strings", []):
        if x is not None and len(x) <= 1000:
            entries["source.string"].add(x.lower())

    for x in doc.get("invokes", []):
        entries["source.invoke"].add(_lownone(x))

    for ID, field in doc.get("fields", {}).items():
        entries["source.field.path"].add(_lownone(ID))
        entries["source.field.name"].add(_lownone(field.get("name")))

    for ID, class_ in doc.get("classes", {}).items():
        pack, name = package.split_class(ID)

        entries["source.class.path"].add(_lownone(ID))
        entries["source.class.name"].add(_lownone(name))
        entries["source.class.package"].add(_lownone(pack))

        for inter_ in class_.get("inter", []):
            entries["source.class.inter"].add(_lownone(inter_))

        for super_ in class_.get("super", []):
            entries["source.class.super"].add(_lownone(super_))

    for ID, method in doc.get("methods", {}).items():
        entries["source.method.path"].add(_lownone(ID))
        entries["source.method.name"].add(_lownone(method.get("name")))
        entries["source.method.code"].add(_lownone(method.get("sha256")))

    return dict(entries)