androscalpel/tests/test.py

import logging

FORMAT = "[%(levelname)s] %(name)s %(filename)s:%(lineno)d: %(message)s"
logging.basicConfig(format=FORMAT)
logging.getLogger().setLevel(logging.DEBUG)

import json
import zipfile as z
import re
from pathlib import Path

from androscalpel import Apk, IdType, IdMethodType, ins, DexString, IdMethod, Code, utils  # type: ignore

RED = "\033[38:2:255:0:0m"
GREEN = "\033[38:2:0:255:0m"
ENDC = "\033[0m"

RE_CHECK_DEXFILE = re.compile(r"classes\d*.dex")


def is_dexfile(filename: str) -> bool:
    return bool(RE_CHECK_DEXFILE.fullmatch(filename))


ORIGINAL_APK = Path(__file__).parent / "origin-release.apk"
DYN_LOAD_APK = Path(__file__).parent / "ut-dyn-load-release.apk"
DEX_NAME = "classes.dex"

clazz_id = IdType("Lcom/example/ut_dyn_load/Loader;")
proto_id = IdMethodType(IdType.void(), [IdType("Landroid/content/Context;")])
method_id = IdMethod("load", proto_id, clazz_id)


def load_apk(path_apk: Path) -> Apk:
    print(f"[+] Load bytecode ")
    apk = Apk()
    with z.ZipFile(path_apk) as zipf:
        for file in filter(is_dexfile, zipf.namelist()):
            print(f"[-] {file}")
            with zipf.open(file, "r") as dex_f:
                dex = dex_f.read()
                apk.add_dex_file(dex)
    return apk


print(f"[+] Load bytecode ")
dyn_load_apk = load_apk(DYN_LOAD_APK)

clazz = dyn_load_apk.classes[clazz_id]
method = clazz.virtual_methods[method_id]
code = method.code

logging.getLogger().setLevel(logging.WARNING)


def is_evasion_method(meth: IdMethod) -> bool:
    return (
        method.class_ == IdType.from_smali("Ldalvik/system/PathClassLoader;")
        or (
            method.class_ == IdType.from_smali("Ljava/lang/Class;")
            and method.name == "newInstance"
        )
        or (
            method.class_ == IdType.from_smali("Ljava/lang/Class;")
            and method.name == "getMethod"
        )
        or method.class_ == IdType.from_smali("Ljava/lang/reflect/Method;")
    )


print(f"[+] Code of {method_id} ")
for inst in code.insns:
    match inst:
        case ins.InvokeVirtual(args=args, method=method) if is_evasion_method(method):
            print(f"    {RED}{inst}{ENDC}")
        case ins.SGetObject(to=to, field=field):
            print(f"    {inst}")
            print(
                f"        val: {GREEN}{dyn_load_apk.classes[field.class_].static_fields[field].value}{ENDC}"
            )
        case inst:
            print(f"    {inst}")

malicious_class_id = IdType("Lcom/example/ut_dyn_load/SmsReceiver;")

mal_cls_in_apk = malicious_class_id in dyn_load_apk.classes
if mal_cls_in_apk:
    color = GREEN
else:
    color = RED

print(f"[+] {malicious_class_id} in loaded apk: {color}{mal_cls_in_apk}{ENDC}")

print(f"[+] Load bytecode in assets/classes")
with z.ZipFile(DYN_LOAD_APK) as zipf:
    with zipf.open("assets/classes", "r") as dex_f:
        dex = dex_f.read()
        dyn_load_apk.add_dex_file(dex)

mal_cls_in_apk = malicious_class_id in dyn_load_apk.classes
if mal_cls_in_apk:
    color = GREEN
else:
    color = RED
print(f"[+] {malicious_class_id} in loaded apk: {color}{mal_cls_in_apk}{ENDC}")

print(
    f"[+] -- very simplified steep, see https://developer.android.com/reference/java/lang/Class#getMethod(java.lang.String,%20java.lang.Class%3C?%3E[])"
)
name = "a"
args = [
    IdType("Landroid/content/Context;"),
    IdType("Landroid/content/BroadcastReceiver;"),
]
malicious_class = dyn_load_apk.classes[malicious_class_id]

potential_meth = []
for m_id in malicious_class.direct_methods:
    if m_id.name == name and m_id.proto.get_parameters() == args:
        potential_meth.append((m_id, "direct"))
for m_id in malicious_class.virtual_methods:
    if m_id.name == name and m_id.proto.get_parameters() == args:
        potential_meth.append(m_id, "virtual")

print("[+] Potential methods:")
for m, t in potential_meth:
    print(f"    {m}({t})")

exit()
new_insns = []
for i in code.insns:
    if isinstance(i, ins.ConstString):
        if i.lit == "Hello":
            i = ins.ConstString(i.reg, DexString("Degemer Mat"))
        elif i.lit == "Bye":
            i = ins.ConstString(i.reg, DexString("Kenavo"))
    new_insns.append(i)

# This need improving!
code = Code(code.registers_size, code.ins_size, code.outs_size, new_insns)
apk.set_method_code(method_id, code)
# apk.set_method_code(method.descriptor, code)


clazz = apk.classes[clazz_id]
method = clazz.virtual_methods[method_id]
code = method.code
print(f"[+] New code of {method_id} ")
for i in code.insns:
    print(f"    {i}")

# # Strip class for debugging
# classes = list(
#     filter(
#         lambda x: x
#         not in [
#             IdType("Lcom/example/testapplication/ui/home/HomeViewModel;"),
#             IdType("Landroidx/navigation/NavDeepLink$Builder;"),
#             IdType("Landroidx/constraintlayout/core/widgets/ConstraintWidget$1;"),
#             IdType("Landroidx/appcompat/app/ActionBar;"),
#             IdType("Landroidx/constraintlayout/core/state/WidgetFrame;"),
#             IdType("Landroidx/appcompat/app/AppCompatViewInflater;"),
#         ],
#         apk.classes.keys(),
#     )
# )
# for cls in classes:
#     apk.remove_class(cls)
#
print("[+] Recompile")

dex_raw = apk.gen_raw_dex()

new_apk = Apk()
for dex in dex_raw:
    new_apk.add_dex_file(dex)


print("[+] Repackage")

utils.replace_dex(
    APK_NAME,
    APK_NAME.parent / (APK_NAME.name.removesuffix(".apk") + "-instrumented.apk"),
    dex_raw,
    Path().parent / "my-release-key.jks",
    zipalign=Path.home() / "Android" / "Sdk" / "build-tools" / "34.0.0" / "zipalign",
    apksigner=Path.home() / "Android" / "Sdk" / "build-tools" / "34.0.0" / "apksigner",
)

last_id = None

MAX_REQ = 1


def cmp(a, b, req=0):
    if req > MAX_REQ:
        return
    if type(a) == dict:
        cmp_dict(a, b, req)
    elif type(a) == list:
        cmp_list(a, b, req)
    else:
        cmp_other(a, b, req)


def nice_bool(b) -> str:
    if b:
        return "\033[32mTrue\033[0m"
    else:
        return "\033[31mFalse\033[0m"


def cmp_other(a, b, req=0):
    ident = "  " * req
    for f in dir(a):
        if getattr(getattr(a, f), "__call__", None) is None and (
            len(f) < 2 or f[:2] != "__"
        ):
            eq = getattr(a, f) == getattr(b, f)
            print(f"{f'{ident}{f}: ':<150}{nice_bool(eq)}")
            if not eq:
                if "descriptor" in dir(a):
                    global last_id
                    last_id = a.descriptor
                cmp(getattr(a, f), getattr(b, f), req + 1)


def cmp_dict(a, b, req=0):
    ident = "  " * req
    keys_a = set(a.keys())
    keys_b = set(b.keys())
    if keys_a != keys_b:
        print(f"{ident}a.keys() != b.keys()")
    tot = 0
    nb_failed = 0
    for key in keys_a & keys_b:
        eq = a[key] == b[key]
        tot += 1
        if not eq:
            nb_failed += 1
            print(f"{f'{ident}{str(key)}: ':<150}{nice_bool(eq)}")
            global last_id
            last_id = key
            cmp(a[key], b[key], req + 1)
    print(f"\033[32m{tot-nb_failed}\033[0m + \033[31m{nb_failed}\033[0m = {tot}")


def cmp_list(a, b, req=0):
    ident = "  " * req
    la = len(a)
    lb = len(b)
    if la != lb:
        print(f"{ident}len(a) != len(b)")
    for i in range(min(la, lb)):
        eq = a[i] == b[i]
        print(f"{f'{ident}{str(i)}: ':<150}{nice_bool(eq)}")
        if not eq:
            cmp(a[i], b[i], req + 1)


# apk_eq = new_apk == apk
# print(f"[+] apk are equals: {nice_bool(apk_eq)}")
# if not apk_eq:
#    cmp(new_apk, apk)

# Landroidx/constraintlayout/core/widgets/ConstraintWidget$1;.<clinit>()V
# mid = IdMethod(
#    "<clinit>",
#    IdMethodType(
#        IdType.void(),
#        [],
#    ),
#    IdType("Landroidx/constraintlayout/core/widgets/ConstraintWidget$1;"),
# )
# m = apk.classes[mid.class_].direct_methods[mid]
# nm = new_apk.classes[mid.class_].direct_methods[mid]


# mid = IdMethod(
#    "setValue",
#    IdMethodType(
#        IdType("Z"),
#        [
#            IdType("Ljava/lang/String;"),
#            IdType("Landroidx/constraintlayout/core/parser/CLElement;"),
#        ],
#    ),
#    IdType("Landroidx/constraintlayout/core/state/WidgetFrame;"),
# )
#
# m = apk.classes[mid.class_].virtual_methods[mid]
# nm = new_apk.classes[mid.class_].virtual_methods[mid]
# c = m.code
# nc = nm.code
# cc = c.with_normalized_labels()
# ncc = nc.with_normalized_labels()