dex-oracle 1.0.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: e65aeaf75e033e0ea78152e0b900016805c1442e
+  data.tar.gz: c6c43b249f3eecae4abf0db9b31de4f3c986604f
+SHA512:
+  metadata.gz: 5fd0973fec7576356a4865717d40c225c3abbba2c841e23f94a3be071fe0f8b621823663a6bd51b2651055be9d55a79aadc3963850fda92259617b76105b4e1d
+  data.tar.gz: 91287ad0c88ddd3083ac78eb09e05d5e5149ccaca2fb74bf4d2b7e84fcb6e1b541de30056737fa1c96ab4b9e8aee62cb419b2d1f7c25877d980b1a1fa2a8732b

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+gemspec name: 'dex-oracle'
+
+gem 'rubocop', require: false

data/Gemfile.lock

@@ -0,0 +1,56 @@
+PATH
+  remote: .
+  specs:
+    dex-oracle (1.0.1)
+      rubyzip (~> 1.1, >= 1.1.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    ast (2.1.0)
+    astrolabe (1.3.1)
+      parser (~> 2.2)
+    diff-lcs (1.2.5)
+    parser (2.2.3.0)
+      ast (>= 1.1, < 3.0)
+    powerpack (0.1.1)
+    rainbow (2.0.0)
+    rspec (3.4.0)
+      rspec-core (~> 3.4.0)
+      rspec-expectations (~> 3.4.0)
+      rspec-mocks (~> 3.4.0)
+    rspec-core (3.4.1)
+      rspec-support (~> 3.4.0)
+    rspec-expectations (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-its (1.2.0)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.4.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.4.0)
+    rspec-support (3.4.1)
+    rubocop (0.35.1)
+      astrolabe (~> 1.3)
+      parser (>= 2.2.3.0, < 3.0)
+      powerpack (~> 0.1)
+      rainbow (>= 1.99.1, < 3.0)
+      ruby-progressbar (~> 1.7)
+      tins (<= 1.6.0)
+    ruby-progressbar (1.7.5)
+    rubyzip (1.1.7)
+    tins (1.6.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  dex-oracle!
+  rspec (~> 3.4, >= 3.4.0)
+  rspec-its (~> 1.2, >= 1.2.0)
+  rspec-mocks (~> 3.4, >= 3.4.0)
+  rubocop
+
+BUNDLED WITH
+   1.11.2

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Caleb Fenton
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,102 @@
+# Oracle
+A pattern based Dalvik deobfuscator which uses limited execution to improve semantic analysis. Also, the inspiration for another Android deobfuscator: [Simplify](https://github.com/CalebFenton/simplify).
+
+**Before**
+![before](http://i.imgur.com/nICE4N4.png)
+
+**After**
+![after](http://i.imgur.com/aFFd9eM.png)
+
+Bitcoin: 133bmAUshC5VxntCcusWJdT8Sq3BFsaGce
+
+## Installation
+
+### Step 1. Install Smali / Baksmali
+I'm sure since you're an elite Android reverser you already have smali and baksmali on your path.
+
+### Step 2. Install Android SDK / ADB
+Make sure `adb` is on your path.
+
+### Step 3. Install the Gem
+```
+gem install dex-oracle
+```
+
+Or, if you prefer to build from source:
+```
+git clone https://github.com/CalebFenton/dex-oracle.git
+cd dex-oracle
+gem install bundler
+bundle install
+```
+
+### Step 4. Connect a Device or Emulator
+_You must have either an emulator running or a device plugged in for Oracle to work._
+
+Oracle needs to execute  methods on an live Android system. This can either be on a device or an emulator (preferred). If it's a device, _make sure you don't mind running potentially hostile code on it_.
+
+If you'd like to use an emulator, and already have the Android SDK installed, you can create and start emulator images with:
+```
+android avd
+```
+
+## Usage
+```
+Usage: dex-oracle [opts] <APK / DEX / Smali Directory>
+    -h, --help                       Display this screen
+    -s ANDROID_SERIAL,               Device ID for driver execution, default=""
+        --specific-device
+    -t, --timeout N                  ADB command execution timeout in seconds, default="120"
+    -i, --include PATTERN            Only optimize methods and classes matching the pattern, e.g. Ldune;->melange\(\)V
+    -e, --exclude PATTERN            Exclude these types from optimization; including overrides
+        --disable-plugins STRING[,STRING]*
+                                     Disable plugins, e.g. stringdecryptor,unreflector
+        --list-plugins               List available plugins
+    -v, --verbose                    Be verbose
+    -V, --vverbose                   Be very verbose
+```
+
+For example, to only deobfuscate methods in a class called `Lcom/android/system/admin/CCOIoll;` inside of an APK called `obad.apk`:
+
+```
+dex-oracle -i com/android/system/admin/CCOIoll obad.apk
+```
+
+## How it Works
+Oracle takes Android apps (APK), Dalvik executables (DEX), and Smali files as inputs. First, if the input is an APK or DEX, it is disassembled into Smali files. Then, the Smali files are passed to various plugins which perform analysis and modifications. Plugins search for patterns which can be transformed into something easier to read. In order to understand what the code is doing, some Dalvik methods are actually executed with and the output is collected. This way, some method calls can be replaced with constants. After that, all of the Smali files are updated. Finally, if the input was an APK or a DEX file, the modified Smali files are recompiled and an updated APK or DEX is created.
+
+Method execution is performed by the [Driver](driver/src/main/java/org/cf/oracle/Driver.java). The input APK, DEX, or Smali is combined with the Driver into a single DEX using dexmerge and pushed onto a device or emulator. Oracle then sends method execution information to Driver whenever a plugin requests it. Driver uses Java reflection to execute methods within its own DEX with the arguments provided by Oracle and returns any output or exceptions. This is especially useful for many string decryption methods, which usually take an encrypted string or some One limitation is that execution is limited to static methods.
+
+## Hacking
+
+### Creating Your Own Plugin
+There are three [plugins](lib/dex-oracle/plugins) which come with Oracle:
+
+1. [Undexguard](lib/dex-oracle/plugins/undexguard.rb) - removes certain types of Dexguard obfuscations
+2. [Unreflector](lib/dex-oracle/plugins/unreflector.rb) - removes some Java reflection
+3. [String Decryptor](lib/dex-oracle/plugins/string_decryptor.rb) - simple plugin which removes a common type of string encryption
+
+If you encounter a new type of obfuscation, it may be possible to deobfuscate with Oracle. Look at the Smali and figure out if the code can either be:
+
+1. rearranged
+2. understood by executing some static methods
+
+If either of these two are the case, you should try and write your own plugin. There are four steps to building your own plugin:
+
+1. identify Smali patterns
+2. figure out how to simplify the patterns
+3. figure out how to interact with driver and invoke methods
+4. figure out how to apply modifications directly
+
+The included plugins should be a good guide for understanding steps #3 and #4. Driver is designed to help with step #2.
+
+Of course, you're always welcome to share whatever obfuscation you come across and someone may eventually get to it.
+
+### Updating Driver
+First, ensure `dx` is on your path. This is part of the Android SDK, but it's probably not on your path unless you're hardcore.
+
+The [driver](driver) folder is a Java project managed by Gradle. Import it into Eclipse, IntelliJ, etc. and make any changes you like. To finish updating the driver, run `./update_driver`. This will rebuild the driver and convert the output JAR into a DEX.
+
+## More Information
+
+[TetCon 2016 Android Deobfuscation Presentation](http://www.slideshare.net/tekproxy/tetcon-2016)

data/bin/dex-oracle

@@ -0,0 +1,98 @@
+#!/usr/bin/env ruby
+require 'optparse'
+
+require_relative '../lib/oracle'
+require_relative '../lib/dex-oracle/smali_input'
+require_relative '../lib/dex-oracle/driver'
+require_relative '../lib/dex-oracle/utility'
+require_relative '../lib/dex-oracle/logging'
+
+include Logging
+
+options = {
+  device_id: ENV['ANDROID_SERIAL'] || '',
+  timeout: 60 * 2,
+  include_types: nil,
+  exclude_types: nil,
+  disable_plugins: [],
+}
+
+optparse = OptionParser.new do |opts|
+  opts.banner = "Usage: #{File.basename(__FILE__)} [opts] <APK / DEX / Smali Directory>"
+  opts.on('-h', '--help', 'Display this screen') do
+    puts opts
+    exit
+  end
+
+  opts.on('-s', '--specific-device ANDROID_SERIAL',
+          "Device ID for driver execution, default=\"#{options[:device_id]}\"") do |id|
+    options[:device_id] = id
+  end
+
+  opts.on('-t', '--timeout N',
+          "ADB command execution timeout in seconds, default=\"#{options[:timeout]}\"") do |id|
+    options[:timeout] = id
+  end
+
+  opts.on('-i', '--include PATTERN', Regexp,
+          'Only optimize methods and classes matching the pattern, e.g. Ldune;->melange\(\)V') do |regex|
+    options[:include_types] = regex
+  end
+
+  opts.on('-e', '--exclude PATTERN', Regexp,
+          'Exclude these types from optimization; including overrides') do |regex|
+    options[:exclude_types] = regex
+  end
+
+  opts.on('--disable-plugins STRING[,STRING]*', String,
+          'Disable plugins, e.g. stringdecryptor,unreflector') do |str|
+    options[:disable_plugins] = str.downcase.delete(' ').split(',')
+  end
+
+  opts.on('--list-plugins', 'List available plugins') do
+    require_relative '../lib/dex-oracle/plugin'
+    puts 'Available plugins:'
+    Plugin.plugin_classes.each { |c| puts "  #{c}" }
+    exit
+  end
+
+  opts.on('-v', '--verbose', 'Be verbose') do
+    logger.level = Logger::INFO
+  end
+
+  opts.on('-V', '--vverbose', 'Be very verbose') do
+    logger.level = Logger::DEBUG
+  end
+end
+optparse.parse!
+
+if ARGV.size < 1
+  puts optparse.help
+  exit(-1)
+end
+
+unless Utility.which('adb')
+  logger.error 'Unable to find adb command on path. Please make sure you have adb installed and setup.'
+  exit(-1)
+end
+
+unless `adb devices`.strip != 'List of devices attached'
+  logger.error 'It appears you have no devices running. Please start an emulator or plug in a test device.'
+  exit(-1)
+end
+
+start = Time.now
+input = ARGV[0]
+smali_input = SmaliInput.new(input)
+
+driver = Driver.new(options[:device_id], options[:timeout])
+driver.install(smali_input.out_dex)
+
+oracle = Oracle.new(
+  smali_input.dir, driver, options[:include_types], options[:exclude_types], options[:disable_plugins]
+)
+oracle.divine
+
+smali_input.finish
+
+puts "Time elapsed #{Time.now - start} seconds"

data/dex-oracle.gemspec

@@ -0,0 +1,43 @@
+# -*- encoding: utf-8 -*-
+$LOAD_PATH.push('lib')
+require 'dex-oracle/version'
+
+Gem::Specification.new do |s|
+  s.name     = 'dex-oracle'
+  s.version  = DexOracle::VERSION.dup
+  s.date     = '2015-11-28'
+  s.license = 'MIT'
+  s.summary  = 'Pattern based Dalvik deobfuscator'
+  s.email    = 'calebjfenton@gmail.com'
+  s.homepage = 'https://github.com/CalebFenton/dex-oracle'
+  s.authors  = ['Caleb Fenton']
+  s.description = <<-EOF
+A pattern based Dalvik deobfuscator which uses limited execution to improve semantic analysis.
+EOF
+
+  dependencies = [
+    [:runtime, 'rubyzip', '~> 1.1', '>= 1.1.0'],
+    [:development, 'rspec', '~> 3.4', '>= 3.4.0'],
+    [:development, 'rspec-its', '~> 1.2', '>= 1.2.0'],
+    [:development, 'rspec-mocks', '~> 3.4', '>= 3.4.0'],
+  ]
+
+  exclude_files = Dir['driver/build/**/*'] + Dir['driver/bin/**/*'] + Dir['sandbox/**/*'] + ['driver/build', 'driver/bin', 'sandbox']
+  s.files         = Dir['**/*'] - exclude_files
+  s.test_files    = Dir['test/**/*'] + Dir['spec/**/*']
+  s.executables   = Dir['bin/*'].map { |f| File.basename(f) }
+  s.require_paths = %w(lib res)
+
+  ## Make sure you can build the gem on older versions of RubyGems too:
+  s.rubygems_version = '2.2'
+  s.required_rubygems_version = Gem::Requirement.new('>= 0') if s.respond_to? :required_rubygems_version=
+  s.specification_version = 3 if s.respond_to? :specification_version
+
+  dependencies.each do |type, name, pversion, version|
+    if s.respond_to?("add_#{type}_dependency")
+      s.send("add_#{type}_dependency", name, pversion, version)
+    else
+      s.add_dependency(name, pversion, version)
+    end
+  end
+end

data/driver/build.gradle

@@ -0,0 +1,52 @@
+project.version = '1.0.0'
+version = '1.0.0'
+def jarVersion = version
+
+apply plugin: 'application'
+mainClassName = 'org.cf.driver.OracleDriver'
+
+repositories {
+    mavenCentral()
+}
+
+dependencies {
+    compile 'com.google.code.gson:gson:2.5'
+    // testCompile 'junit:junit:4.12-beta-3'
+}
+
+gradle.projectsEvaluated {
+    tasks.withType(JavaCompile) {
+        options.compilerArgs << "-Xlint:unchecked" << "-Xlint:deprecation"
+    }
+}
+
+apply plugin: 'java'
+apply plugin: 'eclipse'
+apply plugin: 'idea'
+
+group = 'org.cf'
+sourceCompatibility = 1.7
+
+jar {
+    version = jarVersion
+}
+
+// Build a separate jar that contains all dependencies
+task fatJar(type: Jar) {
+    from sourceSets.main.output
+    from { configurations.compile.collect { it.isDirectory() ? it : zipTree(it) } }
+
+    manifest {
+        attributes('Main-Class': mainClassName)
+    }
+
+    doLast {
+        if (!System.getProperty('os.name').toLowerCase().contains('windows')) {
+            ant.symlink(link: file("${destinationDir}/driver.jar"), resource: archivePath, overwrite: true)
+        }
+    }
+}
+
+task wrapper(type: Wrapper) {
+    gradleVersion = '2.7'
+}

data/driver/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,6 @@
+#Sun Nov 29 17:30:49 PST 2015
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-2.7-bin.zip

data/driver/gradlew

@@ -0,0 +1,160 @@
+#!/usr/bin/env bash
+
+##############################################################################
+##
+##  Gradle start up script for UN*X
+##
+##############################################################################
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS=""
+
+APP_NAME="Gradle"
+APP_BASE_NAME=`basename "$0"`
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD="maximum"
+
+warn ( ) {
+    echo "$*"
+}
+
+die ( ) {
+    echo
+    echo "$*"
+    echo
+    exit 1
+}
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+case "`uname`" in
+  CYGWIN* )
+    cygwin=true
+    ;;
+  Darwin* )
+    darwin=true
+    ;;
+  MINGW* )
+    msys=true
+    ;;
+esac
+
+# Attempt to set APP_HOME
+# Resolve links: $0 may be a link
+PRG="$0"
+# Need this for relative symlinks.
+while [ -h "$PRG" ] ; do
+    ls=`ls -ld "$PRG"`
+    link=`expr "$ls" : '.*-> \(.*\)$'`
+    if expr "$link" : '/.*' > /dev/null; then
+        PRG="$link"
+    else
+        PRG=`dirname "$PRG"`"/$link"
+    fi
+done
+SAVED="`pwd`"
+cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME="`pwd -P`"
+cd "$SAVED" >/dev/null
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD="$JAVA_HOME/jre/sh/java"
+    else
+        JAVACMD="$JAVA_HOME/bin/java"
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD="java"
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if [ "$cygwin" = "false" -a "$darwin" = "false" ] ; then
+    MAX_FD_LIMIT=`ulimit -H -n`
+    if [ $? -eq 0 ] ; then
+        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+            MAX_FD="$MAX_FD_LIMIT"
+        fi
+        ulimit -n $MAX_FD
+        if [ $? -ne 0 ] ; then
+            warn "Could not set maximum file descriptor limit: $MAX_FD"
+        fi
+    else
+        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
+    fi
+fi
+
+# For Darwin, add options to specify how the application appears in the dock
+if $darwin; then
+    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
+fi
+
+# For Cygwin, switch paths to Windows format before running java
+if $cygwin ; then
+    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
+    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
+    JAVACMD=`cygpath --unix "$JAVACMD"`
+
+    # We build the pattern for arguments to be converted via cygpath
+    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
+    SEP=""
+    for dir in $ROOTDIRSRAW ; do
+        ROOTDIRS="$ROOTDIRS$SEP$dir"
+        SEP="|"
+    done
+    OURCYGPATTERN="(^($ROOTDIRS))"
+    # Add a user-defined pattern to the cygpath arguments
+    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
+        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
+    fi
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    i=0
+    for arg in "$@" ; do
+        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
+        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
+
+        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
+            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
+        else
+            eval `echo args$i`="\"$arg\""
+        fi
+        i=$((i+1))
+    done
+    case $i in
+        (0) set -- ;;
+        (1) set -- "$args0" ;;
+        (2) set -- "$args0" "$args1" ;;
+        (3) set -- "$args0" "$args1" "$args2" ;;
+        (4) set -- "$args0" "$args1" "$args2" "$args3" ;;
+        (5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
+        (6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
+        (7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
+        (8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
+        (9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+    esac
+fi
+
+# Split up the JVM_OPTS And GRADLE_OPTS values into an array, following the shell quoting and substitution rules
+function splitJvmOpts() {
+    JVM_OPTS=("$@")
+}
+eval splitJvmOpts $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS
+JVM_OPTS[${#JVM_OPTS[*]}]="-Dorg.gradle.appname=$APP_BASE_NAME"
+
+exec "$JAVACMD" "${JVM_OPTS[@]}" -classpath "$CLASSPATH" org.gradle.wrapper.GradleWrapperMain "$@"