Multiple Features Static Analyzer & Dynamic Analyzer (#1730)

* Improved Split APK support now supports .apks file.
* Ability to look up and download APK from apktada/apkpure/apkplz.
* Dynamic Analyzer: Get Runtime Application Third party dependencies.
* Static Analysis Rule QA and Typo Fix.
* Persist Frida Code change in session storage.
* Show Base64 strings decoded at runtime and the called class.
* Detect Trackers from Runtime Dependencies and Network Traffic
* Windows Binskim version pinning

mobsf/DynamicAnalyzer/views/android/tests_frida.py

@@ -48,6 +48,29 @@ def list_frida_scripts(request, api=False):
 # AJAX
 
 
+@require_http_methods(['POST'])
+def get_runtime_dependencies(request, api=False):
+    """Get App runtime dependencies."""
+    data = {
+        'status': 'failed',
+        'message': 'Failed to get runtime dependencies'}
+    try:
+        checksum = request.POST['hash']
+        if not is_md5(checksum):
+            return invalid_params(api)
+        package = get_package_name(checksum)
+        if not package:
+            return invalid_params(api)
+        get_dependencies(package, checksum)
+        return send_response(
+            {'status': 'ok'},
+            api)
+    except Exception:
+        pass
+    return send_response(data, api)
+# AJAX
+
+
 @require_http_methods(['POST'])
 def get_script(request, api=False):
     """Get frida scripts from others."""
@@ -240,9 +263,10 @@ def apimon_analysis(app_dir):
     """API Analysis."""
     api_details = {}
     try:
+        strings = []
         location = os.path.join(app_dir, 'mobsf_api_monitor.txt')
         if not is_file_exists(location):
-            return {}
+            return api_details, strings
         logger.info('Frida API Monitor Analysis')
         with open(location, 'r',
                   encoding='utf8',
@@ -262,6 +286,7 @@ def apimon_analysis(app_dir):
                 if to_decode:
                     api['decoded'] = decode_base64(
                         to_decode).decode('utf-8', 'ignore')
+                    strings.append((api['calledFrom'], api['decoded']))
             except Exception:
                 pass
             api['icon'] = get_icon_map(api['name'])
@@ -271,4 +296,44 @@ def apimon_analysis(app_dir):
                 api_details[api['name']] = [api]
     except Exception:
         logger.exception('API Monitor Analysis')
-    return api_details
+    return api_details, strings
+
+
+def get_dependencies(package, checksum):
+    """Get 3rd party dependencies at runtime."""
+    frd = Frida(
+        checksum,
+        package,
+        ['ssl_pinning_bypass', 'debugger_check_bypass', 'root_bypass'],
+        ['get_dependencies'],
+        None,
+        None,
+    )
+    location = Path(frd.deps)
+    if location.exists():
+        location.write_text('')
+    trd = threading.Thread(target=frd.connect)
+    trd.daemon = True
+    trd.start()
+
+
+def dependency_analysis(package, app_dir):
+    deps = set()
+    msg = 'Collecting Runtime Dependency Analysis data'
+    try:
+        ignore = (
+            package,
+            'android.', 'androidx.', 'kotlin.', 'kotlinx.', 'java.', 'javax.',
+            'sun.', 'com.android.', 'j$', 'dalvik.system.', 'libcore.',
+            'com.google.', 'org.kxml2.', 'org.apache.', 'org.json.')
+        location = Path(app_dir) / 'mobsf_app_deps.txt'
+        if not location.exists():
+            return deps
+        logger.info(msg)
+        data = location.read_text('utf-8', 'ignore').splitlines()
+        for dep in data:
+            if not dep.startswith(ignore):
+                deps.add(dep.rsplit('.', 1)[0])
+    except Exception:
+        logger.exception(msg)
+    return deps