예제 #1
0
    def extract_dex(self):
        for dex_name in self.dex_names:
            # Log Start
            #logger.debug("Extracting %s" % dex_name)
            # Validate existing
            if not os.path.isfile(dex_name):
                #logger.error("%s is not a file" % dex_name)
                return -1
            # Create a Dex object for each dex file contained in the apk.

            current_dex = dex_parser.DexFile(dex_name)
            self.dex_objects.append(current_dex)
            for dex_class_def_obj in current_dex.dexClassDefList:
                weight, raw_sha256, hex_sha256, permission_list = self.extract_class(
                    dex_obj=current_dex, dex_class_def_obj=dex_class_def_obj)
                class_name = current_dex.getDexTypeId(
                    dex_class_def_obj.classIdx)
                """
                I got many \x01 here before the class name.
                    such as '\x01Lcom/vungle/publisher/inject'
                don't know exactly but could use code below to deal with it.
                """
                if class_name[0] is not 'L':
                    l_index = class_name.find('L')
                    if l_index == '-1':
                        continue
                    class_name = class_name[l_index:]
                if IGNORE_ZERO_API_FILES and weight == 0:
                    continue
                self.tree.insert(package_name=class_name,
                                 weight=weight,
                                 sha256=raw_sha256,
                                 permission_list=permission_list)
        return 0
예제 #2
0
    def extract_dex(self, dex_name, return_data, lock):
        _, filename = os.path.split(dex_name)
        print("Processing : " + filename + "...")
        current_dex = dex_parser.DexFile(dex_name)
        self.dex_objects.append(current_dex)
        pass
        for dex_class_def_obj in current_dex.dexClassDefList:
            weight, raw_sha256, hex_sha256, permission_list = self.extract_class(
                dex_obj=current_dex, dex_class_def_obj=dex_class_def_obj)
            class_name = current_dex.getDexTypeId(dex_class_def_obj.classIdx)
            """
            I got many \x01 here before the class name.
                such as '\x01Lcom/vungle/publisher/inject'
            don't know exactly but could use code below to deal with it.
            """
            if class_name[0] is not 'L':
                l_index = class_name.find('L')
                if l_index == '-1':
                    continue
                class_name = class_name[l_index:]
            if IGNORE_ZERO_API_FILES and weight == 0:
                continue
            data = [class_name, weight, raw_sha256, permission_list]
            return_data.append(data)

        print(filename + " done.")
    def extract_dex(self):
        for dex_name in self.dex_names:
            # Log Start
            logger.debug("Extracting %s" % dex_name)
            # Validate existing
            if not os.path.isfile(dex_name):
                logger.error("%s is not a file" % dex_name)
                return -1
            # Create a Dex object for each dex file contained in the apk.
            current_dex = dex_parser.DexFile(dex_name)
            self.dex_objects.append(current_dex)
            for dex_class_def_obj in current_dex.dexClassDefList:
                weight, raw_sha256, hex_sha256, permission_list = self.extract_class(
                    dex_obj=current_dex, dex_class_def_obj=dex_class_def_obj)
                class_name = current_dex.getDexTypeId(
                    dex_class_def_obj.classIdx)
                """
                I got many \x01 here before the class name.
                    such as '\x01Lcom/vungle/publisher/inject'
                don't know exactly but could use code below to deal with it.
                """
                if class_name[0] is not 'L':
                    l_index = class_name.find('L')

                    if l_index == '-1':
                        continue

                    class_name = class_name[l_index:]

                if IGNORE_ZERO_API_FILES and weight == 0:
                    continue
                # print("Found package {}".format(class_name))
                class_name = str(class_name)

                ignore_package_keywords = {
                    "Lcom/google/", "Landroid/", "Landroidx"
                }
                to_add = not any(
                    map(lambda ignoring: class_name.startswith(ignoring),
                        ignore_package_keywords))

                if to_add:
                    self.add_package_toTrie(package=class_name)
                else:
                    pass
                    # print("IGNORING: ", class_name)
                    # self.packages.append(class_name)
                    # self.tree.insert(package_name=class_name, weight=weight, sha256=raw_sha256,
                    #                  permission_list=permission_list)
        return 0
예제 #4
0
    def extract_dex(self):
        # Log Start
        logger.debug("Extracting %s" % self.dex_name)
        # Validate existing
        if not os.path.isfile(self.dex_name):
            logger.error("%s not file" % self.dex_name)
            return -1
        # Create a Dex object
        self.dex = dex_parser.DexFile(self.dex_name)
        pnl = PackageNodeList()
        # Generate sha256 from Dex

        class_info_list = list()
        for dex_class_def_obj in self.dex.dexClassDefList:
            weight, raw_sha256, hex_sha256 = self.extract_class(
                dex_class_def_obj=dex_class_def_obj)
            class_name = self.dex.getDexTypeId(dex_class_def_obj.classIdx)
            """
            I got many \x01 here before the class name.
                such as '\x01Lcom/vungle/publisher/inject'
            don't know exactly but could use code below to deal with it.
            """
            if class_name[0] is not 'L':
                l_index = class_name.find('L')
                if l_index == '-1':
                    continue
                class_name = class_name[l_index:]
            if IGNORE_ZERO_API_FILES and weight == 0:
                continue
            class_info_list.append((class_name, weight, raw_sha256))
        """
            Sort the info list with the package name.
        """
        class_info_list.sort(cmp=lambda x, y: cmp(x[0], y[0]))
        for class_info in class_info_list:
            # logger.debug("class_name %s" % class_name)
            class_name = class_info[0]
            raw_sha256 = class_info[2]
            weight = class_info[1]
            last_slash = class_name.rfind('/')
            # If a class belongs to root, just ignore it because it hardly be a library.
            if last_slash == -1:
                continue
            # get the package name
            # for class name Lcom/company/air/R; It's package name is Lcom/company/air
            package_name = class_name[:last_slash]
            pnl.catch_a_class_def(package_name, raw_sha256, weight)
        # Let PackageNodeList pop all the nodes.
        pnl.catch_a_class_def("", "", 0)
        return 0
예제 #5
0
 def extract_dex(self):
     # Log Start
     logger.debug("Extracting %s" % self.dex_name)
     # Validate existing
     if not os.path.isfile(self.dex_name):
         logger.error("%s is not a file" % self.dex_name)
         return -1
     # Create a Dex object
     self.dex = dex_parser.DexFile(self.dex_name)
     for dex_class_def_obj in self.dex.dexClassDefList:
         weight, raw_sha256, hex_sha256, permission_list, api_id_list = \
             self.extract_class(dex_class_def_obj=dex_class_def_obj)
         class_name = self.dex.getDexTypeId(dex_class_def_obj.classIdx)
 
         if class_name[0] is not 'L':
             l_index = class_name.find('L')
             if l_index == '-1':
                 continue
             class_name = class_name[l_index:]
         if IGNORE_ZERO_API_FILES and weight == 0:
             continue
         self.tree.insert(package_name=class_name, weight=weight, sha256=raw_sha256,
                          permission_list=permission_list, api_id_list=api_id_list)
     return 0