MobSF/Mobile-Security-Framework-MobSF
1
0
Fork 0
mirror of https://github.com/MobSF/Mobile-Security-Framework-MobSF.git synced 2026-10-11 22:50:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

[4.2.7] Androguard & ApkInspector Bump + Patch AXMLParsing (#2461)

Browse Source 
* Androguard 293ab2d89ab9ce011c7dbbc5df3c876172875a1c update
* AXML Parser warn "reserved must be zero!" instead of raise
* Fallback on get app name when androguard returns empty string
This commit is contained in:
Ajin Abraham
2024-11-24 22:53:21 -08:00
committed by GitHub
parent 23cbd41614
commit af49985dd1
16 changed files with 2672 additions and 1003 deletions
Download Patch File Download Diff File Expand all files Collapse all files
LICENSES/androguard.txt
+151 -49
View File
@@ -1,76 +1,178 @@
Androguard
Androguard 4
Copyright (C) 2012 - 2016, Anthony Desnos (desnos at t0t0.fr) All rights reserved.
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
http://www.apache.org/licenses/LICENSE-2.0
1. Definitions.
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
==================================================================================================================================================================================================================================================================================================================
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
DAD
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
Copyright (C) 2012 - 2016, Geoffroy Gueguen (geoffroy dot gueguen at gmail dot com) All rights reserved.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
http://www.apache.org/licenses/LICENSE-2.0
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
==================================================================================================================================================================================================================================================================================================================
Apache License
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
Version 2.0, January 2004
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
http://www.apache.org/licenses/
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
1. Definitions.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
You must give any other recipients of the Work or Derivative Works a copy of this License; and
You must cause any modified files to carry prominent notices stating that You changed the files; and
You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
mobsf/MobSF/init.py
+1 -1
View File
@@ -18,7 +18,7 @@ from mobsf.install.windows.setup import windows_config_local
logger = logging.getLogger(__name__)
VERSION = '4.2.6'
VERSION = '4.2.7'
BANNER = r"""
__ __ _ ____ _____ _ _ ____
| \/ | ___ | |__/ ___|| ___|_ _| || | |___ \
mobsf/StaticAnalyzer/tools/androguard4/apk.py
+1089 -388
View File
File diff suppressed because it is too large Load Diff
mobsf/StaticAnalyzer/tools/androguard4/apkinspector/extract.py
+106
View File
@@ -0,0 +1,106 @@
# -*- coding: utf_8 -*-
# flake8: noqa
import zlib
import os
def extract_file_based_on_header_info(apk_file, local_header_info, central_directory_info):
"""
Extracts a single file from the apk_file based on the information provided from the offset and the header_info.
It takes into account that the compression method provided might not be STORED or DEFLATED! The returned
'indicator', shows what compression method was used. Besides the standard STORED/DEFLATE it may return
'DEFLATED_TAMPERED', which means that the compression method found was not DEFLATED(8) but it should have been,
and 'STORED_TAMPERED' which means that the compression method found was not STORED(0) but should have been.
:param apk_file: The APK file e.g. with open('test.apk', 'rb') as apk_file
:type apk_file: bytesIO
:param local_header_info: The local header dictionary info for that specific filename
:type local_header_info: dict
:param central_directory_info: The central directory entry for that specific filename
:type central_directory_info: dict
:return: Returns the actual extracted data for that file along with an indication of whether a static analysis evasion technique was used or not.
:rtype: set(bytes, str)
"""
filename_length = local_header_info["file_name_length"]
if local_header_info["compressed_size"] == 0 or local_header_info["uncompressed_size"] == 0:
compressed_size = central_directory_info["compressed_size"]
uncompressed_size = central_directory_info["uncompressed_size"]
else:
compressed_size = local_header_info["compressed_size"]
uncompressed_size = local_header_info["uncompressed_size"]
extra_field_length = local_header_info["extra_field_length"]
compression_method = local_header_info["compression_method"]
# Skip the offset + local header to reach the compressed data
local_header_size = 30 # Size of the local header in bytes
offset = central_directory_info["relative_offset_of_local_file_header"]
apk_file.seek(offset + local_header_size + filename_length + extra_field_length)
if compression_method == 0: # Stored (no compression)
uncompressed_data = apk_file.read(uncompressed_size)
extracted_data = uncompressed_data
indicator = 'STORED'
elif compression_method == 8:
compressed_data = apk_file.read(compressed_size)
# -15 for windows size due to raw stream with no header or trailer
extracted_data = zlib.decompress(compressed_data, -15)
indicator = 'DEFLATED'
elif compressed_size == uncompressed_size:
compressed_data = apk_file.read(uncompressed_size)
extracted_data = compressed_data
indicator = 'STORED_TAMPERED'
else:
cur_loc = apk_file.tell()
try:
compressed_data = apk_file.read(compressed_size)
extracted_data = zlib.decompress(compressed_data, -15)
indicator = 'DEFLATED_TAMPERED'
except:
apk_file.seek(cur_loc)
compressed_data = apk_file.read(uncompressed_size)
extracted_data = compressed_data
indicator = 'STORED_TAMPERED'
return extracted_data, indicator
def extract_all_files_from_central_directory(apk_file, central_directory_entries, local_header_entries, output_dir):
"""
Extracts all files from an APK based on the entries detected in the central_directory_entries.
:param apk_file: The APK file e.g. with open('test.apk', 'rb') as apk_file
:type apk_file: bytesIO
:param central_directory_entries: The dictionary with all the entries for the central directory
:type central_directory_entries: dict
:param local_header_entries: The dictionary with all the local header entries
:type local_header_entries: dict
:param output_dir: The output directory where to save the files.
:type output_dir: str
:return: Returns 0 if no errors, 1 if an exception and 2 if the output directory already exists
:rtype: int
"""
try:
# Check if the output directory already exists
if os.path.exists(output_dir):
print("Extraction aborted. Output directory already exists.")
return 2
# Create the output directory or overwrite if it already exists
os.makedirs(output_dir, exist_ok=True)
# Iterate over central directory entries
for filename, cd_header_info in central_directory_entries.items():
if not filename:
# to account for the cases where an empty filename entry is added
continue
# Extract the file using the local header information
extracted_data = \
extract_file_based_on_header_info(
apk_file, local_header_entries[filename], cd_header_info)[0]
# Construct the output file path
output_path = os.path.join(output_dir, filename)
# Create directories if necessary
os.makedirs(os.path.dirname(output_path), exist_ok=True)
# Write the extracted data to the output file
with open(output_path, 'wb') as output_file:
output_file.write(extracted_data)
return 0
except Exception as e:
print(f"Error extracting files: {e}")
return 1
mobsf/StaticAnalyzer/tools/androguard4/zipfile.py → mobsf/StaticAnalyzer/tools/androguard4/apkinspector/headers.py
+86 -74
View File
@@ -1,64 +1,13 @@
# -*- coding: utf_8 -*-
# flake8: noqa
"""This file is from apkinspector licensed under the Apache License 2.0."""
# ApkInspector - Nov 24, 2024 - 293ab2d89ab9ce011c7dbbc5df3c876172875a1c
import io
import zlib
import os
import struct
from typing import Dict
def extract_file_based_on_header_info(apk_file, local_header_info, central_directory_info):
"""
Extracts a single file from the apk_file based on the information provided from the offset and the header_info.
It takes into account that the compression method provided might not be STORED or DEFLATED! The returned
'indicator', shows what compression method was used. Besides the standard STORED/DEFLATE it may return
'DEFLATED_TAMPERED', which means that the compression method found was not DEFLATED(8) but it should have been,
and 'STORED_TAMPERED' which means that the compression method found was not STORED(0) but should have been.
:param apk_file: The APK file e.g. with open('test.apk', 'rb') as apk_file
:type apk_file: bytesIO
:param local_header_info: The local header dictionary info for that specific filename
:type local_header_info: dict
:param central_directory_info: The central directory entry for that specific filename
:type central_directory_info: dict
:return: Returns the actual extracted data for that file along with an indication of whether a static analysis evasion technique was used or not.
:rtype: set(bytes, str)
"""
filename_length = local_header_info["file_name_length"]
if local_header_info["compressed_size"] == 0 or local_header_info["uncompressed_size"] == 0:
compressed_size = central_directory_info["compressed_size"]
uncompressed_size = central_directory_info["uncompressed_size"]
else:
compressed_size = local_header_info["compressed_size"]
uncompressed_size = local_header_info["uncompressed_size"]
extra_field_length = local_header_info["extra_field_length"]
compression_method = local_header_info["compression_method"]
# Skip the offset + local header to reach the compressed data
local_header_size = 30 # Size of the local header in bytes
offset = central_directory_info["relative_offset_of_local_file_header"]
apk_file.seek(offset + local_header_size + filename_length + extra_field_length)
if compression_method == 0: # Stored (no compression)
uncompressed_data = apk_file.read(uncompressed_size)
extracted_data = uncompressed_data
indicator = 'STORED'
elif compression_method == 8:
compressed_data = apk_file.read(compressed_size)
# -15 for windows size due to raw stream with no header or trailer
extracted_data = zlib.decompress(compressed_data, -15)
indicator = 'DEFLATED'
else:
try:
cur_loc = apk_file.tell()
compressed_data = apk_file.read(compressed_size)
extracted_data = zlib.decompress(compressed_data, -15)
indicator = 'DEFLATED_TAMPERED'
except:
apk_file.seek(cur_loc)
compressed_data = apk_file.read(uncompressed_size)
extracted_data = compressed_data
indicator = 'STORED_TAMPERED'
return extracted_data, indicator
from .extract import extract_file_based_on_header_info, extract_all_files_from_central_directory
from .helpers import pretty_print_header, save_to_json, save_data_to_file
class EndOfCentralDirectoryRecord:
@@ -98,19 +47,18 @@ class EndOfCentralDirectoryRecord:
signature_offset = -1
file_size = apk_file.seek(0, 2)
while offset < file_size:
position = file_size - offset - chunk_size
if position < 0:
position = 0
position = max(0, file_size - offset - chunk_size)
apk_file.seek(position)
chunk = apk_file.read(chunk_size)
if not chunk:
break
# end of Central Directory File Header signature
signature_offset = chunk.rfind(b'\x50\x4b\x05\x06')
signature_offset = chunk.rfind(b'\x50\x4b\x05\x06') # EOCD signature
if signature_offset != -1:
eo_central_directory_offset = position + signature_offset
break # Found End of central directory record (EOCD) signature
offset += chunk_size
break # Found EOCD signature
# Adjust offset to overlap by 4 bytes
offset += chunk_size - 4
if signature_offset == -1:
raise ValueError(
"End of central directory record (EOCD) signature not found")
@@ -301,11 +249,11 @@ class CentralDirectory:
relative_offset_of_local_file_header = struct.unpack('<I', apk_file.read(4))[
0]
filename = struct.unpack(f'<{file_name_length}s', apk_file.read(file_name_length))[
0].decode('utf-8')
extra_field = struct.unpack(f'<{extra_field_length}s', apk_file.read(extra_field_length))[0].decode('utf-8',
'ignore')
file_comment = struct.unpack(f'<{file_comment_length}s', apk_file.read(file_comment_length))[0].decode(
'utf-8', 'ignore')
0].decode('utf-8', 'ignore')
extra_field = struct.unpack(f'<{extra_field_length}s', apk_file.read(
extra_field_length))[0].decode('utf-8', 'ignore')
file_comment = struct.unpack(f'<{file_comment_length}s', apk_file.read(
file_comment_length))[0].decode('utf-8', 'ignore')
offset_in_central_directory = c_offset
central_directory_entry = CentralDirectoryEntry(
@@ -398,10 +346,14 @@ class LocalHeaderRecord:
uncompressed_size = struct.unpack('<I', apk_file.read(4))[0]
file_name_length = struct.unpack('<H', apk_file.read(2))[0]
extra_field_length = struct.unpack('<H', apk_file.read(2))[0]
filename = struct.unpack(f'<{file_name_length}s', apk_file.read(file_name_length))[
0].decode('utf-8')
extra_field = struct.unpack(f'<{extra_field_length}s', apk_file.read(extra_field_length))[0].decode('utf-8',
'ignore')
try:
filename = struct.unpack(f'<{file_name_length}s', apk_file.read(file_name_length))[
0].decode('utf-8', 'ignore')
extra_field = struct.unpack(f'<{extra_field_length}s', apk_file.read(
extra_field_length))[0].decode('utf-8', 'ignore')
except:
filename = entry_of_interest.filename
extra_field = entry_of_interest.extra_field
return cls(
version_needed_to_extract, general_purpose_bit_flag, compression_method,
file_last_modification_time, file_last_modification_date, crc32_of_uncompressed_data,
@@ -488,7 +440,7 @@ class ZipEntry:
Similar to parse, but instead of parsing the entire APK, it only targets the specified file.
:param apk_file: The apk file expected raw
:type apk_file: io.TextIOWrapper
:type apk_file: bytesIO
:param filename: the filename of the file to be parsed
:type filename: str
:param eocd: Optionally, the instance of the end of central directory from the APK
@@ -561,8 +513,8 @@ class ZipEntry:
"""
extracted_file = extract_file_based_on_header_info(self.zip, self.get_local_header_dict(name),
self.get_central_directory_entry_dict(name))[0]
# if save:
# save_data_to_file(f"EXTRACTED_{name}", extracted_file)
if save:
save_data_to_file(f"EXTRACTED_{name}", extracted_file)
return extracted_file
def infolist(self) -> Dict[str, CentralDirectoryEntry]:
@@ -582,3 +534,63 @@ class ZipEntry:
:rtype: list
"""
return [vl for vl in self.central_directory.to_dict()]
def extract_all(self, extract_path, apk_name):
"""
Extracts all the contents of the APK.
:param extract_path: where to extract it
:type extract_path: str
:param apk_name: the name of the apk
:type apk_name: str
"""
output_path = os.path.join(extract_path, apk_name)
if not extract_all_files_from_central_directory(self.zip, self.to_dict()["central_directory"],
self.to_dict()["local_headers"], output_path):
print(f"Extraction successful for: {apk_name}")
def print_headers_of_filename(cd_h_of_file, local_header_of_file):
"""
Prints out the details for both the central directory header and the local file header. Useful for the CLI.
:param cd_h_of_file: central directory header of a filename as it may be retrieved from headers_of_filename
:type cd_h_of_file: dict
:param local_header_of_file: local header dictionary of a filename as it may be retrieved from headers_of_filename
:type local_header_of_file: dict
"""
if not cd_h_of_file or not local_header_of_file:
print("Are you sure the filename exists?")
return
pretty_print_header("CENTRAL DIRECTORY")
for k in cd_h_of_file:
if k == 'Relative offset of local file header' or k == 'Offset in the central directory header':
print(f"{k:40} : {hex(int(cd_h_of_file[k]))} | {cd_h_of_file[k]}")
else:
print(f"{k:40} : {cd_h_of_file[k]}")
pretty_print_header("LOCAL HEADER")
for k in local_header_of_file:
print(f"{k:40} : {local_header_of_file[k]}")
def show_and_save_info_of_headers(entries, apk_name, header_type: str, export: bool, show: bool):
"""
Print information for each entry for the central directory header and allow to possibly export to JSON.
:param entries: The dictionary with all the entries for the central directory
:type entries: dict
:param apk_name: String with the name of the APK, so it can be used for the export.
:type apk_name: str
:param header_type: What type of header that is, either central_directory or local, to be used for the export
:type header_type: str
:param export: Boolean for exporting or not to JSON
:type export: bool
:param show: Boolean for printing or not the entries
:type show: bool
"""
if show:
for entry in entries:
pretty_print_header(entry)
print(entries[entry])
if export:
save_to_json(f"{apk_name}_{header_type}_header.json", entries)
mobsf/StaticAnalyzer/tools/androguard4/apkinspector/helpers.py
+68
View File
@@ -0,0 +1,68 @@
# -*- coding: utf_8 -*-
# flake8: noqa
import json
def pretty_print_header(header_text, width=50, char='-'):
"""
Formatting output used for the CLI
:param header_text: The text to be displayed
:type header_text: str
:param width: total width of the display
:type width: int
:param char: which char to be used as a filler
:type char: str
"""
padding = max(0, width - len(header_text)) // 2
formatted_header = f"\n{char * padding} {header_text} {char * padding}"
print(formatted_header)
def save_data_to_file(filename, data):
"""
Write data to file
:param data: the actual data
:type data: bytes
:param filename: file to be saved in
:type filename: str
"""
try:
with open(filename, 'wb') as output_file:
output_file.write(data)
print(f"Data saved to {filename}")
except Exception as e:
print(f"Error while saving data to {filename}: {e}")
def save_to_json(filename, dictionary):
"""
Simple method to save a dictionary as JSON into the filename.
:param filename: the name of the file to be saved as
:type filename: str
:param dictionary: the dictionary to be saved as JSON
:type dictionary: dict
"""
with open(filename, "w") as h_file:
json.dump(dictionary, h_file, indent=4)
def escape_xml_entities(data):
"""
Escaping characters that cant be included within an XML file.
:param data: The string to escape
:type data: str
:return: The escaped output
:rtype: str
"""
replacements = {
'<': '&lt;',
'>': '&gt;',
'&': '&amp;',
'"': '&quot;',
"'": '&apos;'
}
return ''.join(replacements.get(c, c) for c in data)
mobsf/StaticAnalyzer/tools/androguard4/axml.py
+1083 -470
View File
File diff suppressed because it is too large Load Diff
mobsf/StaticAnalyzer/tools/androguard4/resources/public.py
+5 -4
View File
@@ -21,15 +21,16 @@ if _public_res is None:
_public_res[_type][_name] = _id
else:
raise Exception(
"need to copy the sdk/platforms/android-?/data/res/values/public.xml here")
"need to copy the sdk/platforms/android-?/data/res/values/public.xml here"
)
SYSTEM_RESOURCES = {
"attributes": {
"forward": {k: v for k, v in _public_res['attr'].items()},
"inverse": {v: k for k, v in _public_res['attr'].items()}
"inverse": {v: k for k, v in _public_res['attr'].items()},
},
"styles": {
"forward": {k: v for k, v in _public_res['style'].items()},
"inverse": {v: k for k, v in _public_res['style'].items()}
}
"inverse": {v: k for k, v in _public_res['style'].items()},
},
}
mobsf/StaticAnalyzer/tools/androguard4/types.py
+7 -7
View File
@@ -37,16 +37,16 @@ TYPE_INT_HEX = 0x11
# The 'data' is either 0 or 1, for input "false" or "true" respectively.
TYPE_INT_BOOLEAN = 0x12
# Beginning of color integer flavors...
TYPE_FIRST_COLOR_INT = 0x1c
TYPE_FIRST_COLOR_INT = 0x1C
# The 'data' is a raw integer value of the form #aarrggbb.
TYPE_INT_COLOR_ARGB8 = 0x1c
TYPE_INT_COLOR_ARGB8 = 0x1C
# The 'data' is a raw integer value of the form #rrggbb.
TYPE_INT_COLOR_RGB8 = 0x1d
TYPE_INT_COLOR_RGB8 = 0x1D
# The 'data' is a raw integer value of the form #argb.
TYPE_INT_COLOR_ARGB4 = 0x1e
TYPE_INT_COLOR_ARGB4 = 0x1E
# The 'data' is a raw integer value of the form #rgb.
TYPE_INT_COLOR_RGB4 = 0x1f
TYPE_INT_COLOR_RGB4 = 0x1F
# ...end of integer flavors.
TYPE_LAST_COLOR_INT = 0x1f
TYPE_LAST_COLOR_INT = 0x1F
# ...end of integer flavors.
TYPE_LAST_INT = 0x1f
TYPE_LAST_INT = 0x1F
mobsf/StaticAnalyzer/tools/androguard4/util.py
+64
View File
@@ -0,0 +1,64 @@
# -*- coding: utf_8 -*-
# flake8: noqa
from typing import Union
from asn1crypto.x509 import Name
def get_certificate_name_string(
name: Union[dict, Name], short: bool = False, delimiter: str = ', '
) -> str:
"""
Format the Name type of a X509 Certificate in a human readable form.
:param name: Name object to return the DN from
:param short: Use short form (default: False)
:param delimiter: Delimiter string or character between two parts (default: ', ')
:type name: dict or :class:`asn1crypto.x509.Name`
:type short: boolean
:type delimiter: str
:rtype: str
"""
if isinstance(name, Name): # asn1crypto.x509.Name):
name = name.native
# For the shortform, we have a lookup table
# See RFC4514 for more details
_ = {
'business_category': ("businessCategory", "businessCategory"),
'serial_number': ("serialNumber", "serialNumber"),
'country_name': ("C", "countryName"),
'postal_code': ("postalCode", "postalCode"),
'state_or_province_name': ("ST", "stateOrProvinceName"),
'locality_name': ("L", "localityName"),
'street_address': ("street", "streetAddress"),
'organization_name': ("O", "organizationName"),
'organizational_unit_name': ("OU", "organizationalUnitName"),
'title': ("title", "title"),
'common_name': ("CN", "commonName"),
'initials': ("initials", "initials"),
'generation_qualifier': ("generationQualifier", "generationQualifier"),
'surname': ("SN", "surname"),
'given_name': ("GN", "givenName"),
'name': ("name", "name"),
'pseudonym': ("pseudonym", "pseudonym"),
'dn_qualifier': ("dnQualifier", "dnQualifier"),
'telephone_number': ("telephoneNumber", "telephoneNumber"),
'email_address': ("E", "emailAddress"),
'domain_component': ("DC", "domainComponent"),
'name_distinguisher': ("nameDistinguisher", "nameDistinguisher"),
'organization_identifier': (
"organizationIdentifier",
"organizationIdentifier",
),
}
return delimiter.join(
[
"{}={}".format(
_.get(attr, (attr, attr))[0 if short else 1], name[attr]
)
for attr in name
]
)
mobsf/StaticAnalyzer/views/android/apk.py
+1 -1
View File
@@ -173,7 +173,7 @@ def apk_analysis_task(checksum, app_dic, rescan, queue=False):
app_dic['certz'] = get_hardcoded_cert_keystore(
checksum,
app_dic['files'])
# Parse APK with Androguard
# Parse APK with Androguard4
andro_apk = parse_apk(
checksum,
app_dic['app_path'])
mobsf/StaticAnalyzer/views/android/app.py
+4 -2
View File
@@ -16,7 +16,7 @@ logger = logging.getLogger(__name__)
def parse_apk(checksum, app_path):
"""Androguard APK."""
"""Androguard4 APK."""
try:
msg = 'Parsing APK with androguard'
logger.info(msg)
@@ -35,7 +35,9 @@ def get_app_name(a, app_dir, is_apk):
if a:
# Parsed Androguard APK Object
try:
return a.get_app_name()
app_name = a.get_app_name()
if app_name:
return app_name
except Exception:
logger.warning('Failed to get app name from parsed APK object')
# Look for app_name in values folder.
mobsf/StaticAnalyzer/views/android/cert_analysis.py
+4 -4
View File
@@ -25,8 +25,8 @@ from mobsf.MobSF.utils import (
find_java_binary,
gen_sha256_hash,
)
from mobsf.StaticAnalyzer.tools.androguard4.apk import (
get_certificate_name_string,
from mobsf.StaticAnalyzer.tools.androguard4 import (
util,
)
logger = logging.getLogger(__name__)
@@ -77,14 +77,14 @@ def get_cert_details(data):
"""Get certificate details."""
certlist = []
x509_cert = asn1crypto.x509.Certificate.load(data)
subject = get_certificate_name_string(x509_cert.subject, short=True)
subject = util.get_certificate_name_string(x509_cert.subject, short=True)
certlist.append(f'X.509 Subject: {subject}')
certlist.append(f'Signature Algorithm: {x509_cert.signature_algo}')
valid_from = x509_cert['tbs_certificate']['validity']['not_before'].native
certlist.append(f'Valid From: {valid_from}')
valid_to = x509_cert['tbs_certificate']['validity']['not_after'].native
certlist.append(f'Valid To: {valid_to}')
issuer = get_certificate_name_string(x509_cert.issuer, short=True)
issuer = util.get_certificate_name_string(x509_cert.issuer, short=True)
certlist.append(f'Issuer: {issuer}')
certlist.append(f'Serial Number: {hex(x509_cert.serial_number)}')
certlist.append(f'Hash Algorithm: {x509_cert.hash_algo}')
mobsf/StaticAnalyzer/views/android/jar_aar.py
+1 -1
View File
@@ -101,7 +101,7 @@ def common_analysis(request, app_dic, rescan, api, analysis_type):
checksum,
app_dic['files'])
app_dic['playstore'] = {'error': True}
# Parse APK with Androguard
# Parse APK with Androguard4
apk = parse_apk(
checksum,
app_dic['app_path'])
mobsf/StaticAnalyzer/views/android/manifest_utils.py
+1 -1
View File
@@ -55,7 +55,7 @@ def get_manifest_file(app_dir, app_path, tools_dir, typ, apk):
def get_android_manifest_androguard(apk, app_dir):
"""Get AndroidManifest.xml using Androguard."""
"""Get AndroidManifest.xml using Androguard4."""
try:
logger.info('Extracting AndroidManifest.xml with Androguard')
if not apk:
pyproject.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[tool.poetry]
name = "mobsf"
version = "4.2.6"
version = "4.2.7"
description = "Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis."
keywords = ["mobsf", "mobile security framework", "mobile security", "security tool", "static analysis", "dynamic analysis", "malware analysis"]
authors = ["Ajin Abraham <[email protected]>"]