androguard 功能分析與定製

標籤：

0x00 前言

androguard是一款非常棒的開源Android APK靜態分析工具；使用Python開發；androguard只能在Linux環境運行，因為它使用的幾個python庫僅支援Linux平台。並且由於複雜的庫依賴，在Linux環境的安裝也較困難；好訊息是santoku已經整合了它，不用我們再折騰，androguard安裝在santoku的/usr/share/androguard目錄；下面分析其主要功能，並開發一些額外的實用功能；

相關連結：
https://github.com/androguard/androguard/
https://santoku-linux.com/

0x01 模組介紹

1.androapkinfo.py

 用來查看apk檔案資訊，該工具輸出apk檔案的包、資源、許可權、組件、方法等資訊。使用方法：

 ./androapkinfo.py -i ./demo.apk

2.androxml.py

 用來解密apk包中的AndroidManifest.xml檔案。使用方法：

 ./androxml.py -i ./demo.apk

3.androcsign.py

用於添加apk檔案的簽名資訊到一個資料庫檔案，其所有目錄為signatures/dbandroguard。使用前首先要為apk編寫一個sign檔案，這個檔案使用json格式儲存。、
 [
     {
         "SAMPLE":"apks/demo.apk"
     },
     {
         "BASE":"AndroidOS",
         "NAME":"DroidDeram",
         "SIGNATURE":[
             {
                 "TYPE":"METHSIM",
                 "CN":"Lcom/droider/demo/MainActivity$SNChecker;",
                 "MN":"isRegistered",
                 "D":"()Z"
             }
         ],
         "BF":"0"
     }
 ]

 使用方法：

 ./androcsign.py -i signatures/demo.sign -o signatures/dbandroguard

4.androdd.py

 用於產生apk檔案中，每個類的方法的調用流程圖。使用方法：

 ./androdd.py -i ./demo.apk -o ./out -d -d PNG

5.androdiff.py

 比較兩個apk檔案的差異。使用方法：

 ./androdiff.py -i ./demo.apk ./demo2.apk

6.androdump.py

 用於dump一個linux進程的資訊。使用方法：

 ./androdump.py -i pid

7.androgexf.py

 用於產生apk的gexf格式的圖形檔案，該檔案可以使用Gephi軟體查看。使用方法：

 ./androgexf.py -i ./demo.apk -o ./demo.gexf

8.androlyze.py

互動Android靜態分析程式，功能特別多。具體可以參考coreanalysis和corebytecodes下的代碼。以及Xbalien的相關使用介紹。

9.andromercury.py

andromercury.py是Mercury工具的架構。功能上是對Mercury的封裝。內網實驗室的社區網站上有8篇2013年發的Mercury的使用介紹，已經使用，功能比較豐富。

10.androrisk.py

用於評估apk的潛在風險，最後會得出一個分。ICSL_androguard中使用了這個模組的分析結果。

11.androsign.py

用於檢測apk的簽名資訊是否在資料庫裡，與androcsign.py功能恰好相反。

12.androsim.py

用於計算兩個apk檔案的相似性。是個開源的庫。網上相關資料比較少，在androguard老的google source code網站wiki裡面有介紹。

13.androxgmml.py

用於產生apk/jar/class/dex等檔案的控制流程程及功能調用圖，產生格式為xgmml。使用方法：

./androxgmml.py -i ./demo.apk -o ./demo.xgmml

14.apkviewer.py

 為apk檔案中每個類產生一個獨立的graphhml檔案，可以使用Gephi查看。使用方法：

 ./apkviewer.py -i ./demo.apk -o ./output

0x02 androguard DIY

我們接下來將開發或適配下列功能：

• 組件Activities，Services，Content Providers、Broadcast Receivers

• Permissions 及對應使用代碼

• 敏感 APIs 監控

• URL、IP、口令、加解密演算法等資訊監控

• 檢查動態註冊的 Receivers

• 檢測 AllowBackup、Debuggable、ShareUserId、使用者自訂許可權

• risk 評分

0x03 Code Show

下面記錄一些關鍵代碼實現：

一、敏感 API 呼叫

def show_Sensitive_APIs(dx):    for i in Sensitive_APIs:        print " ",i,Sensitive_APIs[i][0],Sensitive_APIs[i][1]        paths = dx.get_tainted_packages().search_methods( Sensitive_APIs[i][0],Sensitive_APIs[i][1],".")        show_Paths(dx.get_vm(), paths )Sensitive_APIs = {     #log    #0 : [ "Landroid/util/Log;","d"],    #send sms    1: ["Landroid/telephony/SmsManager;","sendTextMessage"],    #read sms    2: [".","getDisplayMessageBody"],    3: [".","getMessageBody"],    #IMEI    4: ["Landroid/telephony/TelephonyManager;","getDecicedID"],    #phone number    5: ["Landroid/telephony/TelephonyManager;","getLine1Number"],    #get Sim serial    6: ["Landroid/telephony/TelephonyManager;","getSimSerialNumber"],    #Location    7: ["Landroid/telephony/TelephonyManager;","getCellLocation"],    #GPS    8: [".","getLastKnownLocation"],    9: [".","requestLocationUpdates"],    #Recorder    10: ["Landroid/media/MediaRecorder;","prepare"],    #native_code    11: ["Ljava/lang/Runtime;","exec"],    12: ["Ljava/lang/Runtime;","load"],    13: ["Ljava/lang/System;","load"],    #file io    14: ["Llibcore/io/IoBridge;", "open"],    15: ["Llibcore/io/IoBridge;", "read"],    16: ["Llibcore/io/IoBridge;", "write"],    17: ["Ljava/io/File;", "create"],    18: ["Ljava/io/File;", "delete"],    19: ["Ljava/io/File;", "get"],    20: ["Ljava/io/File;", "mk"],    21: ["Ljava/io/File;", "set"],    #get resource    22: [".","openRawResource"],    23: [".","getAssets"],    #http    24: ["Lorg/apache/http/impl/client/AbstractHttpClient;", "execute"],    25: ["Ljava/net/HttpURLConnection;","connect"],    26: ["Ljava/net/URL;","openConnection"],    27: ["Ljava/net/URLConnection;","connect"],    28: ["Ljava/net/Socket;","."],    #ssl    29: ["Ljavax/net/ssl;","."],    #WebView    30: ["Landroid/webkit/WebView;","addJavascriptInterface"],    31: ["Landroid/webkit/WebView;","searchBoxJavaBridge_"],    #load jar    32: ["Ldalvik/system/DexClassLoader;","."],    33: ["Ljava/net/URLClassLoader;","."],    34: ["Ldalvik/system/PathClassLoader;","."],    #ReflectionCode    35: ["Ljava/lang/reflect/Method;", "."],    #encrypt or SHA    36: [".", "doFinal"],    37: [".","digest"],    #use camera    38: ["Landroid/hardware/Camera;","open"],    #query SQL(read contact\SMS)    39: ["Landroid/content/ContentResolver;","query"],    #SharedPreferences    40: ["Landroid/content/SharedPreferences;","edit" ],    #sendBroadcast    41: [".","sendBroadcast"],    42: [".","sendOrderedBroadcast"],    43: [".","sendStickyBroadcast"],    44: [".","sendStickyOrderedBroadcast"],    #start activity    45: [".","startActivity"],    46: [".","startActivityForResult"],    #Service    47: [".","startService"],    48: [".","bindService"],    #write to SD card ,add by Colbert 20150120    49: [".","getExternalStorageDirectory"],    #input check ,add by Colbert 20150120    50: [".","readLine"]}

二、關鍵字匹配

vm = dvm.DalvikVMFormat(apk.get_dex()) #dex轉DalvikVMFormatvmx = analysis.uVMAnalysis(vm)vm.get_regex_strings("(?i)password") #Key Wordsvm.get_regex_strings("AES")vm.get_regex_strings("^((https?|ftp)://[^\s/$.?#].[^\s]*)$") #urlsvm.get_regex_strings("[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+") #ip

三、動態載入的Receivers

#Dynamically Registered Receiverdef show_Register_receiver(dx):    paths = dx.get_tainted_packages().search_methods(".","registerReceiver",".")    show_Paths(dx.get_vm(), paths )

四、SharedUserId、AllowBackup、Debuggable等

self.sharedUserId = self.xml[i].documentElement.getAttribute("android:sharedUserId") for item in self.xml[i].getElementsByTagName(‘application‘):    self.allowbackup.append(str(item.getAttributeNS(NS_ANDROID_URI, "allowBackup")))

五、計算風險評分

ri = risk.RiskIndicator()ri.add_risk_analysis( risk.RedFlags() )ri.add_risk_analysis( risk.FuzzyRisk() )analyze_app( options.input, ri, a )def display_result(res) :  for i in res :    print "\t", i    for j in res[i] :      print "\t\t", j, res[i][j]def analyze_app(filename, ri, a) :    display_result( ri.with_apk( a ) )

六、掃描結果樣本

[Activities]
    com.achievo.vipshop.activity.LodingActivity
    com.tencent.tauth.AuthActivity
[Services]
    com.achievo.vipshop.manage.service.SplashAlarmService
    com.vipshop.sdk.push.MqttService
[Content Providers]

[Broadcast Receivers]
    com.vipshop.sdk.viplog.batch.VipLogReceiver
    com.vipshop.sdk.push.VipsPushReceiver
[Permissions]   
USE_CREDENTIALS :
    1 Lcom/androidquery/auth/GoogleHandle;->reauth(Lcom/androidquery/callback/AbstractAjaxCallback;)Z (0x12) ---> Landroid/accounts/AccountManager;->invalidateAuthToken(Ljava/lang/String; Ljava/lang/String;)V
READ_PHONE_STATE :
[Sensitive APIs]    
    30 Landroid/webkit/WebView; addJavascriptInterface
        1 Lbolts/WebViewAppLinkResolver$2;->then(Lbolts/Task;)Lbolts/Task; (0x56) ---> Landroid/webkit/WebView;->addJavascriptInterface(Ljava/lang/Object; Ljava/lang/String;)V
[Dynamically registered receivers]
    1 Lcom/achievo/vipshop/newactivity/CartFloatView;->registerFavoriteRecever()V (0x3e) ---> Landroid/content/Context;->registerReceiver(Landroid/content/BroadcastReceiver; Landroid/content/IntentFilter;)Landroid/content/Intent;
[SharedUserId|AllowBackup|Debuggable]
    SharedUserId:[]
    AllowBackup:[false]
    Debuggable[false]
[key words]   

    [‘PWDCHARS_ARRAY‘, ‘PWDCHARS_STRING‘, ‘pwd‘, ‘pwdWatcher‘]
    [‘UserName‘, ‘userName‘, ‘username‘, ‘username=‘, ‘username_del‘]
    [‘secretKey‘]
    [‘ENCRYPTION‘, ‘ENCRYPTION_AES‘, ‘ENCRYPT_ACTION‘, ‘encrypt‘, ‘encryption error. ‘]
    [‘imei‘, ‘imei=‘]
    [‘imsi‘]
    [‘AES‘, ‘AES/CBC/PKCS5Padding‘, ‘AES/ECB/PKCS7Padding‘, ‘AESUtils‘, ‘AESUtils.java‘]
    [‘SHA-1‘]
    []
    []
    [‘MD5‘, ‘MD5.java‘, ‘MD5PatchVerifier.java‘, ‘MD5Util.java‘, ‘MD5_INSTANCE‘, ‘MD5_SALT‘]
    [‘RSA‘, ‘RSA/ECB/PKCS1Padding‘, ‘RSA_PKCS_V15‘, ‘RSA_PKCS_V21‘, ‘RSA_PRIVATE‘, ‘RSA_PUBLIC‘]

[urls]
    ftp://anonymous:[email protected]
    http://%1$s/diagnoses/v1/report
    http://%1$s/gslb/gslb/getbucket.asp?ver=3.0
    http://10.237.12.17:9085/pass/register
    http://400.vip.com/WebChat/chat/wapchat.jsp?
    http://800.vip.com/live800/chatClient/chatbox.jsp?companyID=8900&configID=17&enterurl=APP&pagereferrer=APP&syslanguage=0
    http://a.appsimg.com
    http://a.appsimg.com/upload/brand/
    http://a.appsimg.com/upload/merchandise/
    http://ap.vip.com/coupons_rules
    http://ap.vip.com/fwxy1015
    http://ap.vip.com/index.php?m=activity&code=coupon_help2&wapid=ap_2342
    http://ap.vip.com/index.php?m=activity&code=global_rule&wapid=ap_1881
[ip]
    1.1.3.61
    1.2.2.56
    1.3.4.60
    10.0.0.172
    10.0.0.200
    10.237.12.17
    10.237.12.2
    2.3.3.61
    2.4.0.61
    223.202.68.46
    42.62.48.181
    58.68.235.106
    58.68.235.232

[risk score]
    RedFlags
        DEX {‘NATIVE‘: 1, ‘DYNAMIC‘: 1, ‘CRYPTO‘: 1, ‘REFLECTION‘: 1}
        APK {‘DEX‘: 0, ‘EXECUTABLE‘: 0, ‘ZIP‘: 0, ‘SHELL_SCRIPT‘: 0, ‘APK‘: 0, ‘SHARED LIBRARIES‘: 87}
        PERM {‘PRIVACY‘: 6, ‘NORMAL‘: 9, ‘MONEY‘: 0, ‘INTERNET‘: 1, ‘SMS‘: 2, ‘DANGEROUS‘: 13, ‘SIGNATUREORSYSTEM‘: 1, ‘CALL‘: 0, ‘SIGNATURE‘: 0, ‘GPS‘: 2}
    FuzzyRisk
        VALUE 80.0

0x04 總結

定製androguard可用於大批量APK分析工作；通過迅速給出攻擊面資訊，輔助人工分析；但在進行加固APK分析時先天不足，需使用DroidBox、Xposed、adbi、Dozer等動態分析工具或手段來補齊短板；

androguard 功能分析與定製