dex-oracle 1.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. checksums.yaml +7 -0
  2. data/Gemfile +4 -0
  3. data/Gemfile.lock +56 -0
  4. data/LICENSE.txt +21 -0
  5. data/README.md +102 -0
  6. data/bin/dex-oracle +98 -0
  7. data/dex-oracle.gemspec +43 -0
  8. data/driver/build.gradle +52 -0
  9. data/driver/gradle/wrapper/gradle-wrapper.jar +0 -0
  10. data/driver/gradle/wrapper/gradle-wrapper.properties +6 -0
  11. data/driver/gradlew +160 -0
  12. data/driver/gradlew.bat +90 -0
  13. data/driver/src/main/java/org/cf/oracle/Driver.java +134 -0
  14. data/driver/src/main/java/org/cf/oracle/FileUtils.java +35 -0
  15. data/driver/src/main/java/org/cf/oracle/StackSpoofer.java +42 -0
  16. data/driver/src/main/java/org/cf/oracle/options/InvocationTarget.java +40 -0
  17. data/driver/src/main/java/org/cf/oracle/options/TargetParser.java +121 -0
  18. data/lib/dex-oracle/driver.rb +255 -0
  19. data/lib/dex-oracle/logging.rb +32 -0
  20. data/lib/dex-oracle/plugin.rb +87 -0
  21. data/lib/dex-oracle/plugins/string_decryptor.rb +59 -0
  22. data/lib/dex-oracle/plugins/undexguard.rb +155 -0
  23. data/lib/dex-oracle/plugins/unreflector.rb +85 -0
  24. data/lib/dex-oracle/resources.rb +13 -0
  25. data/lib/dex-oracle/smali_field.rb +21 -0
  26. data/lib/dex-oracle/smali_file.rb +64 -0
  27. data/lib/dex-oracle/smali_input.rb +81 -0
  28. data/lib/dex-oracle/smali_method.rb +33 -0
  29. data/lib/dex-oracle/utility.rb +37 -0
  30. data/lib/dex-oracle/version.rb +3 -0
  31. data/lib/oracle.rb +61 -0
  32. data/res/driver.dex +0 -0
  33. data/res/dx.jar +0 -0
  34. data/spec/data/helloworld.apk +0 -0
  35. data/spec/data/helloworld.dex +0 -0
  36. data/spec/data/plugins/bytes_decrypt.smali +18 -0
  37. data/spec/data/plugins/class_forname.smali +14 -0
  38. data/spec/data/plugins/multi_bytes_decrypt.smali +28 -0
  39. data/spec/data/plugins/string_decrypt.smali +14 -0
  40. data/spec/data/plugins/string_lookup_1int.smali +14 -0
  41. data/spec/data/plugins/string_lookup_3int.smali +18 -0
  42. data/spec/data/smali/helloworld.smali +17 -0
  43. data/spec/dex-oracle/driver_spec.rb +82 -0
  44. data/spec/dex-oracle/plugins/string_decryptor_spec.rb +25 -0
  45. data/spec/dex-oracle/plugins/undexguard_spec.rb +69 -0
  46. data/spec/dex-oracle/plugins/unreflector_spec.rb +29 -0
  47. data/spec/dex-oracle/smali_field_spec.rb +15 -0
  48. data/spec/dex-oracle/smali_file_spec.rb +41 -0
  49. data/spec/dex-oracle/smali_input_spec.rb +90 -0
  50. data/spec/dex-oracle/smali_method_spec.rb +19 -0
  51. data/spec/spec_helper.rb +9 -0
  52. data/update_driver +5 -0
  53. metadata +195 -0
@@ -0,0 +1,90 @@
1
+ @if "%DEBUG%" == "" @echo off
2
+ @rem ##########################################################################
3
+ @rem
4
+ @rem Gradle startup script for Windows
5
+ @rem
6
+ @rem ##########################################################################
7
+
8
+ @rem Set local scope for the variables with windows NT shell
9
+ if "%OS%"=="Windows_NT" setlocal
10
+
11
+ @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
12
+ set DEFAULT_JVM_OPTS=
13
+
14
+ set DIRNAME=%~dp0
15
+ if "%DIRNAME%" == "" set DIRNAME=.
16
+ set APP_BASE_NAME=%~n0
17
+ set APP_HOME=%DIRNAME%
18
+
19
+ @rem Find java.exe
20
+ if defined JAVA_HOME goto findJavaFromJavaHome
21
+
22
+ set JAVA_EXE=java.exe
23
+ %JAVA_EXE% -version >NUL 2>&1
24
+ if "%ERRORLEVEL%" == "0" goto init
25
+
26
+ echo.
27
+ echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
28
+ echo.
29
+ echo Please set the JAVA_HOME variable in your environment to match the
30
+ echo location of your Java installation.
31
+
32
+ goto fail
33
+
34
+ :findJavaFromJavaHome
35
+ set JAVA_HOME=%JAVA_HOME:"=%
36
+ set JAVA_EXE=%JAVA_HOME%/bin/java.exe
37
+
38
+ if exist "%JAVA_EXE%" goto init
39
+
40
+ echo.
41
+ echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
42
+ echo.
43
+ echo Please set the JAVA_HOME variable in your environment to match the
44
+ echo location of your Java installation.
45
+
46
+ goto fail
47
+
48
+ :init
49
+ @rem Get command-line arguments, handling Windowz variants
50
+
51
+ if not "%OS%" == "Windows_NT" goto win9xME_args
52
+ if "%@eval[2+2]" == "4" goto 4NT_args
53
+
54
+ :win9xME_args
55
+ @rem Slurp the command line arguments.
56
+ set CMD_LINE_ARGS=
57
+ set _SKIP=2
58
+
59
+ :win9xME_args_slurp
60
+ if "x%~1" == "x" goto execute
61
+
62
+ set CMD_LINE_ARGS=%*
63
+ goto execute
64
+
65
+ :4NT_args
66
+ @rem Get arguments from the 4NT Shell from JP Software
67
+ set CMD_LINE_ARGS=%$
68
+
69
+ :execute
70
+ @rem Setup the command line
71
+
72
+ set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
73
+
74
+ @rem Execute Gradle
75
+ "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%
76
+
77
+ :end
78
+ @rem End local scope for the variables with windows NT shell
79
+ if "%ERRORLEVEL%"=="0" goto mainEnd
80
+
81
+ :fail
82
+ rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
83
+ rem the _cmd.exe /c_ return code!
84
+ if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
85
+ exit /b 1
86
+
87
+ :mainEnd
88
+ if "%OS%"=="Windows_NT" endlocal
89
+
90
+ :omega
@@ -0,0 +1,134 @@
1
+ package org.cf.oracle;
2
+
3
+ import java.io.FileNotFoundException;
4
+ import java.io.IOException;
5
+ import java.io.PrintWriter;
6
+ import java.io.StringWriter;
7
+ import java.io.UnsupportedEncodingException;
8
+ import java.lang.reflect.InvocationTargetException;
9
+ import java.lang.reflect.Method;
10
+ import java.util.HashMap;
11
+ import java.util.List;
12
+ import java.util.Map;
13
+
14
+ import org.cf.oracle.options.InvocationTarget;
15
+ import org.cf.oracle.options.TargetParser;
16
+
17
+ import com.google.gson.Gson;
18
+ import com.google.gson.GsonBuilder;
19
+
20
+ public class Driver {
21
+
22
+ private static final String DRIVER_DIR = "/data/local";
23
+
24
+ private static final String OUTPUT_HEADER = "===ORACLE DRIVER OUTPUT===\n";
25
+ private static final String EXCEPTION_LOG = DRIVER_DIR + "/od-exception.txt";
26
+ private static final String OUTPUT_FILE = DRIVER_DIR + "/od-output.json";
27
+ private static final Gson GSON = new GsonBuilder().disableHtmlEscaping().create();
28
+
29
+ private static void die(String msg, Exception exception) {
30
+ PrintWriter writer;
31
+ try {
32
+ writer = new PrintWriter(EXCEPTION_LOG, "UTF-8");
33
+ } catch (Exception e) {
34
+ return;
35
+ }
36
+ writer.println(msg);
37
+ writer.println(exception);
38
+ StringWriter sw = new StringWriter();
39
+ exception.printStackTrace(new PrintWriter(sw));
40
+ writer.println(sw.toString());
41
+ writer.close();
42
+
43
+ // app_process, dalvikvm, and dvz don't propagate exit codes, so this doesn't matter
44
+ System.exit(-1);
45
+ }
46
+
47
+ private static String invokeMethod(Method method, Object[] arguments) throws IOException, IllegalAccessException,
48
+ IllegalArgumentException, InvocationTargetException {
49
+ method.setAccessible(true);
50
+ Object returnObject = method.invoke(null, arguments);
51
+
52
+ Class<?> returnClass = method.getReturnType();
53
+ if (returnClass.getName().equals("Ljava.lang.Void;")) {
54
+ // I hear an ancient voice, whispering from the Void, and it chills my lightless heart...
55
+ return null;
56
+ }
57
+
58
+ String output = "";
59
+ try {
60
+ output = GSON.toJson(returnClass.cast(returnObject));
61
+ } catch (Exception ex) {
62
+ output = GSON.toJson(returnObject);
63
+ }
64
+
65
+ return output;
66
+ }
67
+
68
+ private static void showUsage() {
69
+ System.out.println("Usage: export CLASSPATH=/data/local/od.zip; app_process /system/bin org.cf.driver.OracleDriver <class> <method> [<parameter type>:<parameter value json>]");
70
+ System.out.println(" export CLASSPATH=/data/local/od.zip; app_process /system/bin org.cf.driver.OracleDriver @<json file>");
71
+ }
72
+
73
+ public static void main(String[] args) {
74
+ boolean multipleTargets = args.length < 2 && args[0].startsWith("@");
75
+ if (args.length < 1 && !multipleTargets) {
76
+ showUsage();
77
+ System.exit(-1);
78
+ }
79
+
80
+ try {
81
+ StackSpoofer.init();
82
+ } catch (NumberFormatException | IOException e) {
83
+ die("Error parsing stack spoof info", e);
84
+ }
85
+
86
+ List<InvocationTarget> targets = null;
87
+ try {
88
+ targets = TargetParser.parse(args, GSON);
89
+ } catch (ClassNotFoundException | NoSuchMethodException | SecurityException | IOException e) {
90
+ die("Unable to parse targets", e);
91
+ }
92
+
93
+ String output = null;
94
+ if (!multipleTargets) {
95
+ InvocationTarget target = targets.get(0);
96
+ try {
97
+ output = invokeMethod(target.getMethod(), target.getArguments());
98
+ } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException | IOException e) {
99
+ die("Error executing '" + target.getMethod() + "' with " + target.getArgumentsString(), e);
100
+ }
101
+
102
+ if (output != null) {
103
+ System.out.println(OUTPUT_HEADER + output);
104
+ }
105
+ } else {
106
+ Map<String, String[]> idToOutput = new HashMap<String, String[]>();
107
+ for (InvocationTarget target : targets) {
108
+ String status;
109
+ try {
110
+ output = invokeMethod(target.getMethod(), target.getArguments());
111
+ status = "success";
112
+ } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException | IOException e) {
113
+ StringBuilder sb = new StringBuilder("Error executing '");
114
+ sb.append(target.getMethod()).append("' with ").append(target.getArgumentsString()).append('\n');
115
+ StringWriter sw = new StringWriter();
116
+ e.printStackTrace(new PrintWriter(sw));
117
+ sb.append(sw.getBuffer());
118
+ output = sb.toString();
119
+ status = "failure";
120
+ }
121
+ idToOutput.put(target.getId(), new String[] { status, output });
122
+ }
123
+
124
+ String json = GSON.toJson(idToOutput);
125
+ try {
126
+ FileUtils.writeFile(OUTPUT_FILE, json);
127
+ } catch (FileNotFoundException | UnsupportedEncodingException e) {
128
+ die("Unable to write output to " + OUTPUT_FILE, e);
129
+ }
130
+
131
+ System.out.println(OUTPUT_HEADER + "success");
132
+ }
133
+ }
134
+ }
@@ -0,0 +1,35 @@
1
+ package org.cf.oracle;
2
+
3
+ import java.io.BufferedReader;
4
+ import java.io.FileInputStream;
5
+ import java.io.FileNotFoundException;
6
+ import java.io.IOException;
7
+ import java.io.InputStreamReader;
8
+ import java.io.PrintWriter;
9
+ import java.io.UnsupportedEncodingException;
10
+
11
+ public class FileUtils {
12
+
13
+ public static String readFile(String fileName) throws IOException {
14
+ FileInputStream fis = new FileInputStream(fileName);
15
+ BufferedReader in = new BufferedReader(new InputStreamReader(fis, "UTF-8"));
16
+
17
+ StringBuilder sb = new StringBuilder();
18
+ while (in.ready()) {
19
+ String line = in.readLine();
20
+ sb.append(line).append('\n');
21
+ }
22
+ in.close();
23
+ fis.close();
24
+
25
+ return sb.toString();
26
+ }
27
+
28
+ public static void writeFile(String fileName, String contents) throws FileNotFoundException,
29
+ UnsupportedEncodingException {
30
+ PrintWriter out = new PrintWriter(fileName, "UTF-8");
31
+ out.write(contents);
32
+ out.close();
33
+ }
34
+
35
+ }
@@ -0,0 +1,42 @@
1
+ package org.cf.oracle;
2
+
3
+ import java.io.BufferedReader;
4
+ import java.io.File;
5
+ import java.io.FileReader;
6
+ import java.io.IOException;
7
+ import java.util.LinkedList;
8
+ import java.util.List;
9
+
10
+ public class StackSpoofer {
11
+
12
+ private static List<StackTraceElement> stack = new LinkedList<StackTraceElement>();
13
+
14
+ private static void addElement(String declaringClass, String methodName, String fileName, int lineNumber) {
15
+ stack.add(new StackTraceElement(declaringClass, methodName, fileName, lineNumber));
16
+ }
17
+
18
+ static void init() throws NumberFormatException, IOException {
19
+ // <declaring class> <method name> <filename> <line number>
20
+ File f = new File("stackspoof.cfg");
21
+ if (!f.exists()) {
22
+ return;
23
+ }
24
+
25
+ BufferedReader in = new BufferedReader(new FileReader(f));
26
+ while (in.ready()) {
27
+ String s = in.readLine().trim();
28
+ if (s.startsWith("//") || s.startsWith("#")) {
29
+ // Comment
30
+ continue;
31
+ }
32
+ String[] params = s.split(" ");
33
+ addElement(params[0], params[1], params[2], Integer.parseInt(params[3]));
34
+ }
35
+ in.close();
36
+ }
37
+
38
+ public static StackTraceElement[] getStackTrace() {
39
+ return stack.toArray(new StackTraceElement[stack.size()]);
40
+ }
41
+
42
+ }
@@ -0,0 +1,40 @@
1
+ package org.cf.oracle.options;
2
+
3
+ import java.lang.reflect.Method;
4
+
5
+ public class InvocationTarget {
6
+
7
+ private final Object[] arguments;
8
+ private final String[] argumentStrings;
9
+ private final String id;
10
+ private final Method method;
11
+
12
+ InvocationTarget(String id, String[] argumentStrings, Object[] arguments, Method method) {
13
+ this.id = id;
14
+ this.argumentStrings = argumentStrings;
15
+ this.arguments = arguments;
16
+ this.method = method;
17
+ }
18
+
19
+ public Object[] getArguments() {
20
+ return arguments;
21
+ }
22
+
23
+ public String getArgumentsString() {
24
+ StringBuilder sb = new StringBuilder();
25
+ for (String argumentString : argumentStrings) {
26
+ sb.append('\'').append(argumentString).append("' ");
27
+ }
28
+
29
+ return sb.toString().trim();
30
+ }
31
+
32
+ public String getId() {
33
+ return id;
34
+ }
35
+
36
+ public Method getMethod() {
37
+ return method;
38
+ }
39
+
40
+ }
@@ -0,0 +1,121 @@
1
+ package org.cf.oracle.options;
2
+
3
+ import java.io.IOException;
4
+ import java.lang.reflect.Method;
5
+ import java.util.Arrays;
6
+ import java.util.LinkedList;
7
+ import java.util.List;
8
+
9
+ import org.cf.oracle.FileUtils;
10
+
11
+ import com.google.gson.Gson;
12
+ import com.google.gson.JsonArray;
13
+ import com.google.gson.JsonElement;
14
+ import com.google.gson.JsonObject;
15
+ import com.google.gson.JsonParser;
16
+ import com.google.gson.JsonSyntaxException;
17
+
18
+ public class TargetParser {
19
+
20
+ private static InvocationTarget buildTarget(Gson gson, String className, String methodName, String... args)
21
+ throws ClassNotFoundException, NoSuchMethodException, SecurityException {
22
+ return buildTarget(gson, "", className, methodName, args);
23
+ }
24
+
25
+ private static InvocationTarget buildTarget(Gson gson, String id, String className, String methodName,
26
+ String... args) throws ClassNotFoundException, NoSuchMethodException, SecurityException {
27
+ Class<?>[] parameterTypes = new Class[args.length];
28
+ Object[] methodArguments = new Object[parameterTypes.length];
29
+ for (int i = 0; i < parameterTypes.length; i++) {
30
+ String[] parts = args[i].split(":", 2);
31
+ parameterTypes[i] = smaliToJavaClass(parts[0]);
32
+ if (parts.length == 1) {
33
+ methodArguments[i] = null;
34
+ } else {
35
+ String jsonValue = parts[1];
36
+ if (parameterTypes[i] == String.class) {
37
+ try {
38
+ // Normalizing strings to byte[] avoids escaping ruby, bash, adb shell, and java
39
+ byte[] stringBytes = (byte[]) gson.fromJson(jsonValue, Class.forName("[B"));
40
+ methodArguments[i] = new String(stringBytes);
41
+ } catch (JsonSyntaxException ex) {
42
+ // Possibly not using byte array format for string (good luck)
43
+ methodArguments[i] = jsonValue;
44
+ }
45
+ } else {
46
+ // System.out.println("Parsing: " + itemJson + " as " + paramTypes[i]);
47
+ methodArguments[i] = gson.fromJson(jsonValue, parameterTypes[i]);
48
+ }
49
+ }
50
+ }
51
+
52
+ Class<?> methodClass = Class.forName(className);
53
+ Method method = methodClass.getDeclaredMethod(methodName, parameterTypes);
54
+
55
+ return new InvocationTarget(id, args, methodArguments, method);
56
+ }
57
+
58
+ private static List<InvocationTarget> loadTargetsFromFile(Gson gson, String fileName) throws IOException,
59
+ ClassNotFoundException, NoSuchMethodException, SecurityException {
60
+ String targetJson = FileUtils.readFile(fileName);
61
+ JsonArray targetItems = new JsonParser().parse(targetJson).getAsJsonArray();
62
+ // JsonArray targetItems = json.getAsJsonArray();
63
+ List<InvocationTarget> targets = new LinkedList<InvocationTarget>();
64
+ for (JsonElement element : targetItems) {
65
+ JsonObject targetItem = element.getAsJsonObject();
66
+ String id = targetItem.get("id").getAsString();
67
+ String className = targetItem.get("className").getAsString();
68
+ String methodName = targetItem.get("methodName").getAsString();
69
+ JsonArray argumentsJson = targetItem.get("arguments").getAsJsonArray();
70
+ String[] arguments = new String[argumentsJson.size()];
71
+ for (int i = 0; i < arguments.length; i++) {
72
+ arguments[i] = argumentsJson.get(i).getAsString();
73
+ }
74
+
75
+ InvocationTarget target = buildTarget(gson, id, className, methodName, arguments);
76
+ targets.add(target);
77
+ }
78
+
79
+ return targets;
80
+ }
81
+
82
+ private static Class<?> smaliToJavaClass(String className) throws ClassNotFoundException {
83
+ if (className.equals("I")) {
84
+ return int.class;
85
+ } else if (className.equals("V")) {
86
+ return void.class;
87
+ } else if (className.equals("Z")) {
88
+ return boolean.class;
89
+ } else if (className.equals("B")) {
90
+ return byte.class;
91
+ } else if (className.equals("S")) {
92
+ return short.class;
93
+ } else if (className.equals("J")) {
94
+ return long.class;
95
+ } else if (className.equals("C")) {
96
+ return char.class;
97
+ } else if (className.equals("F")) {
98
+ return float.class;
99
+ } else if (className.equals("D")) {
100
+ return double.class;
101
+ } else {
102
+ return Class.forName(className);
103
+ }
104
+ }
105
+
106
+ public static List<InvocationTarget> parse(String[] args, Gson gson) throws ClassNotFoundException,
107
+ NoSuchMethodException, SecurityException, IOException {
108
+ if (args[0].startsWith("@")) {
109
+ String fileName = args[0].substring(1);
110
+
111
+ return loadTargetsFromFile(gson, fileName);
112
+ } else {
113
+ InvocationTarget target = buildTarget(gson, args[0], args[1], Arrays.copyOfRange(args, 2, args.length));
114
+ List<InvocationTarget> targets = new LinkedList<InvocationTarget>();
115
+ targets.add(target);
116
+
117
+ return targets;
118
+ }
119
+ }
120
+
121
+ }