def run(self):
"""
Runs the pipeline on the apps from the sqlite db.
"""
print ("="*80)
print "{:<40}{:>40}".format("DECOMPILATION STARTED", str(datetime.now()))
print ("="*80)
failed_to_decompile_count = 0
mi = ModelInterface.get_instance()
num_apps = mi.get_num_apps()
for i in xrange(1, num_apps + 1):
app = mi.get_app_for_id(i)
if not app:
print "Failed to get app for id: " + str(i)
continue
dir_name = "decompiled/" + app.app_id
if not os.path.isdir(dir_name):
try:
subprocess.check_output("python androguard/androdd.py -i " +
app.apk_local + " -o " + dir_name + " -l " +
app.app_id + "*", shell=True)
except:
print "App " + app.app_id + " could not be decompiled"
failed_to_decompile_count += 1
continue
files = self.get_java_files_in_dir(dir_name)
for path_to_file in files:
self.analyze_file_for_vulns(app, path_to_file)
print "{:>5}/{:<5} ".format(i, num_apps) + app.app_id
print "Failed to decompile " + str(failed_to_decompile_count) + " apps"
print ("="*80)
print "{:<40}{:>40}".format("DECOMPILATION COMPLETED", str(datetime.now()))
print ("="*80)
def analyze_file_for_vulns(app, path_to_file):
mi = ModelInterface.get_instance()
vln = VulnLibChecker.get_instance()
with open(path_to_file) as f:
line_counter = 1
for line in f:
line = line.rstrip()
# Call the vulnerability analysis modules here.
if len(line) > 0:
# Check for potentially vulnerable library.
ids = vln.vulnCheck(line)
for vuln_id in ids:
mi.add_vulnerability_for_app(
app, vuln_id, path_to_file, line_counter, line)
# Check for secure keys.
is_key = keySearch(line)
if is_key[0]:
mi.add_vulnerability_for_app(app, 10,
path_to_file, line_counter, line)
# Check for http instead of https.
if httpschecker(line):
mi.add_vulnerability_for_app(app, 11,
path_to_file, line_counter, line)
if commentchecker(line):
mi.add_vulnerability_for_app(app, 12,
path_to_file, line_counter, line)
line_counter += 1
def __init__(self):
self._version = "v2.0.0"
self.meta_path = "./metadata.json"
self.mi = ModelInterface.get_instance()
self.num_apks = 0
self.apks = list()
self.failures = list() # holds apk names that failed to download
self.num_downloads = 0
def add_apps_to_db_test():
try:
apps = [{"category": "BOOKS_AND_REFERENCE", "version_string": "1.9.1", "star_rating": 3.32984, "title": "Free books to download & read", "metadata_url": "https://archive.org/download/playdrone-metadata-2014-10-31-70/com.panaceasupplies.android.reader.json", "downloads": 5000000, "version_code": 17, "app_id": "com.panaceasupplies.android.reader", "free": True, "snapshot_date": "2014-10-31", "developer_name": "Unwrapped Apps", "apk_url": "https://archive.org/download/playdrone-apk-70/com.panaceasupplies.android.reader-17.apk", "installation_size": 3857083}, {"category": "HEALTH_AND_FITNESS", "version_string": "1.60", "star_rating": 4.52128, "title": "CVS/pharmacy", "metadata_url": "https://archive.org/download/playdrone-metadata-2014-10-31-d3/com.cvs.launchers.cvs.json", "downloads": 1000000, "version_code": 30, "app_id": "com.cvs.launchers.cvs", "free": True, "snapshot_date": "2014-10-31", "developer_name": "CVS/pharmacy", "apk_url": "https://archive.org/download/playdrone-apk-d3/com.cvs.launchers.cvs-30.apk", "installation_size": 5208609}, {"category": "TRAVEL_AND_LOCAL", "version_string": "0.9.3", "star_rating": 4.51812, "title": "\u041c\u0438\u043d\u0441\u043a - \u0433\u043e\u0440\u043e\u0434\u0441\u043a\u043e\u0439 \u0433\u0438\u0434", "metadata_url": "https://archive.org/download/playdrone-metadata-2014-10-31-ef/org.ting.json", "downloads": 100000, "version_code": 20, "app_id": "org.ting", "free": True, "snapshot_date": "2014-10-31", "developer_name": "TingBY Team", "apk_url": "https://archive.org/download/playdrone-apk-ef/org.ting-20.apk", "installation_size": 13125305}, {"category": "MUSIC_AND_AUDIO", "version_string": "1.1.6", "star_rating": 4.15198, "title": "K-POP Hit Songs", "metadata_url": "https://archive.org/download/playdrone-metadata-2014-10-31-9e/forui.android.ProjectKPOP.json", "downloads": 100000, "version_code": 16, "app_id": "forui.android.ProjectKPOP", "free": True, "snapshot_date": "2014-10-31", "developer_name": "glovit", "apk_url": "https://archive.org/download/playdrone-apk-9e/forui.android.ProjectKPOP-16.apk", "installation_size": 3622785}, {"category": "SOCIAL", "version_string": "24.6", "star_rating": 3.81115, "title": "Smax", "metadata_url": "https://archive.org/download/playdrone-metadata-2014-10-31-63/mobi.skyrock.Smax.json", "downloads": 100000, "version_code": 202, "app_id": "mobi.skyrock.Smax", "free": True, "snapshot_date": "2014-10-31", "developer_name": "Telefun", "apk_url": "https://archive.org/download/playdrone-apk-63/mobi.skyrock.Smax-202.apk", "installation_size": 4697319}, {"category": "SOCIAL", "version_string": "8.4", "star_rating": 3.30174, "title": "Tchatche : chat gratuit", "metadata_url": "https://archive.org/download/playdrone-metadata-2014-10-31-6e/com.m123.tchatche.android.json", "downloads": 100000, "version_code": 28, "app_id": "com.m123.tchatche.android", "free": True, "snapshot_date": "2014-10-31", "developer_name": "123MULTIMEDIA", "apk_url": "https://archive.org/download/playdrone-apk-6e/com.m123.tchatche.android-28.apk", "installation_size": 2700608}, {"category": "GAME_ARCADE", "version_string": "2.0.5", "star_rating": 2.87314, "title": "Pau", "metadata_url": "https://archive.org/download/playdrone-metadata-2014-10-31-79/com.samy.pau.json", "downloads": 100000, "version_code": 24, "app_id": "com.samy.pau", "free": True, "snapshot_date": "2014-10-31", "developer_name": "SamySoft", "apk_url": "https://archive.org/download/playdrone-apk-79/com.samy.pau-24.apk", "installation_size": 2822456}, {"category": "GAME_FAMILY", "version_string": "1.0", "star_rating": 4.01911, "title": "I Am Vegend \u2013 Zombiegeddon", "metadata_url": "https://archive.org/download/playdrone-metadata-2014-10-31-f8/com.iamvegend.gp.json", "downloads": 100000, "version_code": 1, "app_id": "com.iamvegend.gp", "free": True, "snapshot_date": "2014-10-31", "developer_name": "SMS Services LLC", "apk_url": "https://archive.org/download/playdrone-apk-f8/com.iamvegend.gp-1.apk", "installation_size": 38382523}, {"category": "ENTERTAINMENT", "version_string": "1.4", "star_rating": 4.07836, "title": "Crafting Guide for Minecraft", "metadata_url": "https://archive.org/download/playdrone-metadata-2014-10-31-b5/com.refurbished.craftingguide.json", "downloads": 100000, "version_code": 5, "app_id": "com.refurbished.craftingguide", "free": True, "snapshot_date": "2014-10-31", "developer_name": "Refurbished, Inc.", "apk_url": "https://archive.org/download/playdrone-apk-b5/com.refurbished.craftingguide-5.apk", "installation_size": 4261597}, {"category": "GAME_CASUAL", "version_string": "1.0", "star_rating": 3.73703, "title": "Paint Power Rangers", "metadata_url": "https://archive.org/download/playdrone-metadata-2014-10-31-c0/com.rangers.powerpaint.json", "downloads": 100000, "version_code": 10, "app_id": "com.rangers.powerpaint", "free": True, "snapshot_date": "2014-10-31", "developer_name": "DEAW NETWORK", "apk_url": "https://archive.org/download/playdrone-apk-c0/com.rangers.powerpaint-10.apk", "installation_size": 4507774}]
mi = ModelInterface.get_instance()
mi.add_apps_to_db(apps)
except Exception as e:
print e
print "add_apps_to_db_test FAILED to complete"
def ressemblesKey(inputString): extract = inQuotes(inputString) extract = str(extract) if extract != False: if lengthNotAppropriate(extract): return False; if containsSpaces(extract): return False; unique_letters = uniqueLetterCount(extract) symbols = symbolCount(extract) numbers = numberCount(extract) unique_upperCase = uniqueUpperCaseCount(extract) unique_lowerCase = uniqueLowerCaseCount(extract) ## Filter out typical file names and websites if "/" in extract: #website detection if DEBUG: print "Detected web url..." return False if "\\" in extract: #website detection if DEBUG: print "Detected seperator" return False if doSymbolsRepeat(extract): if DEBUG: print "Detected repeating symbols" return False extension = checkIfFilename(extract) if extension: if DEBUG: print "Detected filename..." return False if checkConsecutiveASCII(extract): if DEBUG: print "Detected consecutive letters... not random key" return False if checkIncrementingASCII(extract): if DEBUG: print "Detected consecutive letters... not random key" return False ## THE REGEX ring #Searches for Format word_numbers if re.findall(r'[\w]*_[\d]*', extract): if DEBUG: print "" return #Searches for Format numbers_word if re.findall(r'[\d]*_[\w]*', extract): if DEBUG: print "" return False mi = ModelInterface.get_instance() if mi.does_entry_exist_for_key(inputString): if DEBUG: print "entry already exists" return False #we know that this must at least be a password of some type if numbers == len(extract): if DEBUG: print "All numbers detected... Most likely password or key" return True; if unique_upperCase == unique_letters and numbers > 2: if DEBUG: print "All upper case letters and numbers detected... Most likely a key" return True; if (unique_letters > 6 and symbols > 0 and unique_upperCase > 0 and unique_lowerCase > 0 and numbers > 2): if DEBUG: print "Detected: Symbols, numbers, random upper case and lower case chars...Most likely a key or token" return True; if (symbols>0 and unique_letters > 6 and unique_upperCase == 0 and unique_lowerCase > 0 and numbers > 2): if DEBUG: print "Detected: Symbols, numbers, and random lower case chars... Most likely a key" return True; if (unique_letters > 6 and unique_upperCase == 0 and unique_lowerCase > 0 and numbers > 2): if DEBUG: print "Detected: numbers, and random lower case chars... Most likely a key" return True; return False;
