anais-apk-forensic 1.0.0

package/apkid/rules/dex/compilers.yara

@@ -0,0 +1,434 @@
+/*
+ * Copyright (C) 2023  RedNaga. https://rednaga.io
+ * All rights reserved. Contact: rednaga@protonmail.com
+ *
+ *
+ * This file is part of APKiD
+ *
+ *
+ * Commercial License Usage
+ * ------------------------
+ * Licensees holding valid commercial APKiD licenses may use this file
+ * in accordance with the commercial license agreement provided with the
+ * Software or, alternatively, in accordance with the terms contained in
+ * a written agreement between you and RedNaga.
+ *
+ *
+ * GNU General Public License Usage
+ * --------------------------------
+ * Alternatively, this file may be used under the terms of the GNU General
+ * Public License version 3.0 as published by the Free Software Foundation
+ * and appearing in the file LICENSE.GPL included in the packaging of this
+ * file. Please visit http://www.gnu.org/copyleft/gpl.html and review the
+ * information to ensure the GNU General Public License version 3.0
+ * requirements will be met.
+ *
+ **/
+
+import "dex"
+include "common.yara"
+
+private rule unsorted_string_pool : internal
+{
+  meta:
+    description = "String pool in non-standard order"
+
+  condition:
+    /*
+     * DEX format requires string IDs to be sorted according to the data at their offsets but the actual
+     * ordering of the string pool is undefined. Dexlib (smali/apktool) 1.x sorts strings by class and
+     * proximity. DX sorts the string pool in the same order as the string table.
+     *
+     * Note: It's probably only necessary to check the first several strings.
+     */
+    for any i in (0..dex.header.string_ids_size - 1) : (dex.string_ids[i + 1].offset < dex.string_ids[i].offset)
+}
+
+private rule dexlib2_map_type_order : internal
+{
+  meta:
+    description = "dexlib2 map_list type order"
+
+  condition:
+    (dex.map_list.map_item[7].type == 0x2002 and dex.map_list.map_item[8].type == 0x1001)
+    or (dex.map_list.map_item[6].type == 0x2002 and dex.map_list.map_item[7].type == 0x1001)
+}
+
+private rule null_interfaces : internal
+{
+  meta:
+    description = "null interfaces offset"
+
+  condition:
+    /*
+     * Dexlib2 adds a non-zero interfaces_offset to every class_def_item, even if the class doesn't implement an
+     * interface. It points to 4 null bytes right after string pool. DEX documentation says the value for
+     * interfaces_offset should be 0 if there is no interface, which is what DX does. It's enough to check
+     * if a single class has an interface which points to null bytes since no one else does this.
+     */
+    for any i in (0..dex.header.class_defs_size) : (dex.class_defs[i].interfaces_offset > 0 and uint32(dex.class_defs[i].interfaces_offset) == 0)
+}
+
+private rule dx_map_type_order : internal
+{
+  meta:
+    description = "dx map_list type order"
+
+  condition:
+    /*
+     * Different compiler families tend to order the map_list types differently.
+     * DX order derrived from: https://github.com/aosp-mirror/platform_dalvik/blob/2e9d6011fe4f4d2e8c065210d0118e7b9d9f305c/dx/src/com/android/dx/dex/file/DexFile.java#L144
+     * The order starting at offset 7 is:
+     *   0x1002 = TYPE_ANNOTATION_SET_REF_LIST (optional)
+     *   0x1003 = TYPE_ANNOTATION_SET_ITEM (optional)
+     *   0x2001 = TYPE_CODE_ITEM (optional, but very common)
+     *   0x2006 = TYPE_ANNOTATIONS_DIRECTORY_ITEM (optional)
+     *   0x1001 = TYPE_TYPE_LIST (optional, but common)
+     *   0x2002 = TYPE_STRING_DATA_ITEM
+     * Also, for reference:
+     *   0x0000 = TYPE_HEADER_ITEM
+     *   0x0001 = TYPE_STRING_ID_ITEM
+     *   0x0002 = TYPE_TYPE_ID_ITEM
+     *   0x0006 = TYPE_CLASS_DEF_ITEM
+     *   0x1000 = TYPE_MAP_LIST
+     */
+    // missing all TYPE_ANNOTATION*, common case
+    (dex.map_list.map_item[7].type == 0x2001 and dex.map_list.map_item[8].type == 0x1001)
+
+    // missing all TYPE_ANNOTATION*, and TYPE_TYPE_LIST so probably very small DEX
+    or (dex.map_list.map_item[7].type == 0x2001 and dex.map_list.map_item[8].type == 0x2002)
+
+    // has all TYPE_ANNOTATION*
+    or (dex.map_list.map_item[7].type == 0x1002 and dex.map_list.map_item[8].type == 0x1003 and dex.map_list.map_item[9].type == 0x2001 and dex.map_list.map_item[10].type == 0x2006 and dex.map_list.map_item[11].type == 0x1001)
+
+    // missing TYPE_ANNOTATION_SET_REF_LIST
+    or (dex.map_list.map_item[7].type == 0x1003 and dex.map_list.map_item[8].type == 0x2001 and dex.map_list.map_item[9].type == 0x2006 and dex.map_list.map_item[10].type == 0x1001)
+
+    // missing TYPE_ANNOTATION_SET_REF_LIST and TYPE_ANNOTATION_SET_ITEM
+    or (dex.map_list.map_item[7].type == 0x2001 and dex.map_list.map_item[8].type == 0x2006 and dex.map_list.map_item[9].type == 0x1001)
+
+    // missing TYPE_ANNOTATION_SET_REF_LIST and TYPE_ANNOTATIONS_DIRECTORY_ITEM
+    or (dex.map_list.map_item[7].type == 0x1003 and dex.map_list.map_item[8].type == 0x2001 and dex.map_list.map_item[9].type == 0x1001)
+
+    // missing TYPE_ANNOTATION_SET_ITEM
+    or (dex.map_list.map_item[7].type == 0x1002 and dex.map_list.map_item[8].type == 0x2001 and dex.map_list.map_item[9].type == 0x2006 and dex.map_list.map_item[10].type == 0x1001)
+
+    // missing TYPE_ANNOTATION_SET_ITEM and TYPE_ANNOTATIONS_DIRECTORY_ITEM
+    or (dex.map_list.map_item[7].type == 0x1002 and dex.map_list.map_item[8].type == 0x2001 and dex.map_list.map_item[9].type == 0x1001)
+
+    // missing TYPE_ANNOTATIONS_DIRECTORY_ITEM
+    or (dex.map_list.map_item[7].type == 0x1002 and dex.map_list.map_item[8].type == 0x1003 and dex.map_list.map_item[9].type == 0x2001 and dex.map_list.map_item[10].type == 0x1001)
+
+    // missing almost everything, VERY tiny dex
+    or (dex.map_list.map_item[1].type == 0x0001 and dex.map_list.map_item[2].type == 0x0002 and dex.map_list.map_item[3].type == 0x0006 and dex.map_list.map_item[4].type == 0x2002 and dex.map_list.map_item[5].type == 0x1000)
+
+    // missing code and (fields | something else), likely small dex
+    or (dex.map_list.map_item[6].type == 0x1003 and dex.map_list.map_item[7].type == 0x2006 and dex.map_list.map_item[8].type == 0x1001 and dex.map_list.map_item[9].type == 0x2002)
+}
+
+private rule ambiguous_tiny_dex_map_type_order : internal
+{
+  meta:
+    description = "ambiguous tiny dex map type order"
+
+  condition:
+    // missing almost everything, dexlib2 and r8 are identical here, impossible to type alone
+    (dex.map_list.map_item[1].type == 0x0001 and dex.map_list.map_item[2].type == 0x0002 and dex.map_list.map_item[3].type == 0x0006 and dex.map_list.map_item[4].type == 0x2002 and dex.map_list.map_item[5].type == 0x1003 and dex.map_list.map_item[6].type == 0x1000)
+}
+
+private rule r8_map_type_order : internal
+{
+  meta:
+    description = "r8 map_list type order"
+
+  condition:
+    /*
+     * R8 order derrived from: https://r8.googlesource.com/r8/+/refs/heads/master/src/main/java/com/android/tools/r8/dex/FileWriter.java#1215
+     * The order starting at offset 7 is:
+     *   0x0007 = TYPE_CALL_SITE_ID_ITEM (optional)
+     *   0x0008 = TYPE_METHOD_HANDLE_ITEM (optional)
+     *   0x2001 = TYPE_CODE_ITEM
+     *   0x2003 = TYPE_DEBUG_INFO_ITEM (optional)
+     *   0x1001 = TYPE_TYPE_LIST
+     *   0x2002 = TYPE_STRING_DATA_ITEM
+     */
+    // missing TYPE_CALL_SITE_ID_ITEM and TYPE_METHOD_HANDLE_ITEM, common case
+    (dex.map_list.map_item[7].type == 0x2001 and dex.map_list.map_item[8].type == 0x2003 and dex.map_list.map_item[9].type == 0x1001)
+
+    // missing TYPE_DEBUG_INFO_ITEM
+    or (dex.map_list.map_item[7].type == 0x2001 and dex.map_list.map_item[8].type == 0x1001 and dex.map_list.map_item[9].type == 0x2002)
+
+    // has everything
+    or (dex.map_list.map_item[7].type == 0x0007 and dex.map_list.map_item[8].type == 0x0008 and dex.map_list.map_item[9].type == 0x2001 and dex.map_list.map_item[10].type == 0x2003 and dex.map_list.map_item[11].type == 0x1001)
+
+    // missing TYPE_CALL_SITE_ID_ITEM
+    or (dex.map_list.map_item[7].type == 0x0008 and dex.map_list.map_item[8].type == 0x2001 and dex.map_list.map_item[9].type == 0x2003 and dex.map_list.map_item[10].type == 0x1001)
+
+    // missing TYPE_METHOD_HANDLE_ITEM
+    or (dex.map_list.map_item[7].type == 0x0007 and dex.map_list.map_item[8].type == 0x2001 and dex.map_list.map_item[9].type == 0x2003 and dex.map_list.map_item[10].type == 0x1001)
+
+    // ignore missing TYPE_CALL_SITE_ID_ITEM, TYPE_METHOD_HANDLE_ITEM, and TYPE_DEBUG_INFO_ITEM is possibly identical to dx map type order
+
+    // missing code and (fields | something else), likely small dex
+    or (dex.map_list.map_item[6].type == 0x1001 and dex.map_list.map_item[7].type == 0x2002 and dex.map_list.map_item[8].type == 0x2004 and dex.map_list.map_item[9].type == 0x2000 and dex.map_list.map_item[10].type == 0x1003)
+}
+
+private rule r8_marker : internal
+{
+  meta:
+    description = "r8 hidden marker"
+
+  strings:
+    // Example: ~~D8{"compilation-mode":"
+    // OR: ~~D8{"backend":"dex","compilation-mode":"
+    $marker = { 00 [1-2] 7E 7E ( 44 | 52 | 4C ) 38 7B 22 [0-16] 63 6F 6D 70 69 6C 61 74 69 6F 6E 2D 6D 6F 64 65 22 3A 22 }
+
+  condition:
+    /*
+     * Marker logic from: https://r8.googlesource.com/r8/+/refs/heads/master/src/main/java/com/android/tools/r8/dex/Marker.java#18
+     */
+    $marker
+}
+
+private rule dexmerge_map_type_order : internal
+{
+  meta:
+    description = "dexmerge map_list type order"
+
+  condition:
+    /*
+     * DexMerge order derrived from: https://github.com/aosp-mirror/platform_dalvik/blob/2e9d6011fe4f4d2e8c065210d0118e7b9d9f305c/dx/src/com/android/dx/merge/DexMerger.java#L110
+     */
+    dex.map_list.map_item[7].type == 0x1000 // TYPE_MAP_LIST
+}
+
+rule jack_4_12 : compiler
+{
+  meta:
+    description = "Jack 4.12"
+    sample      = "b6a92aec55ab93f2254f12a2ab42f6c53a1b4ba1fbae62623193262e7dc31f26"
+
+  strings:
+    $jack_emitter = {00 12 65 6D 69 74 74 65 72 3A 20 6A 61 63 6B 2D 34 2E 31 32 00}
+
+  condition:
+    is_dex and $jack_emitter
+}
+
+rule jack_3x : compiler
+{
+  meta:
+    description = "Jack 3.x"
+
+  strings:
+    //\0<len>emitter: jack-3.??\0
+    $jack_emitter = {00 1? 65 6D 69 74 74 65 72 3A 20 6A 61 63 6B 2D 33 2E [1-3] 00}
+
+  condition:
+    is_dex and $jack_emitter
+}
+
+rule jack_4x : compiler
+{
+  meta:
+    description = "Jack 4.x"
+
+  strings:
+    //\0<len>emitter: jack-4.??\0
+    $jack_emitter = {00 1? 65 6D 69 74 74 65 72 3A 20 6A 61 63 6B 2D 34 2E [1-3] 00}
+
+  condition:
+    is_dex and not jack_4_12 and $jack_emitter
+}
+
+rule jack_5x : compiler
+{
+  meta:
+    description = "Jack 5.x"
+
+  strings:
+    //\0<len>emitter: jack-5.??\0
+    $jack_emitter = {00 1? 65 6D 69 74 74 65 72 3A 20 6A 61 63 6B 2D 35 2E [1-3] 00}
+
+  condition:
+    is_dex and $jack_emitter
+}
+
+private rule has_jack_anon_methods : internal
+{
+  meta:
+    description = "has Jack compiler anonymous methods"
+    url = "https://calebfenton.github.io/2016/12/01/building-with-and-detecting-jack/"
+
+  strings:
+    $anon_set = {00 05 2D 73 65 74 30 00} // -set0
+    $anon_get = {00 05 2D 67 65 74 30 00} // -get0
+    $anon_wrap = {00 06 2D 77 72 61 70 30 00} // -wrap0
+
+  condition:
+    2 of ($anon_*)
+}
+
+private rule jack_emitter : internal
+{
+  meta:
+    description = "has Jack compiler emitter string"
+
+  strings:
+    // "\0<len>emitter: jack-?.?\0"
+    $jack_emitter = {00 1? 65 6D 69 74 74 65 72 3A 20 6A 61 63 6B 2D ?? 2E [1-3] 00}
+
+  condition:
+    $jack_emitter or has_jack_anon_methods
+}
+
+private rule has_javac_anon_methods : internal
+{
+  meta:
+    description = "has Javac compiler anonymous methods"
+    url = "https://calebfenton.github.io/2016/12/01/building-with-and-detecting-jack/"
+
+  strings:
+    $anon_set = {00 0A 61 63 63 65 73 73 24 30 30 32 00} // access$002
+    $anon_get = {00 0A 61 63 63 65 73 73 24 30 30 30 00} // access$000
+    $anon_wrap = {00 0A 61 63 63 65 73 73 24 31 30 30 00} // access$100
+
+  condition:
+    2 of ($anon_*)
+}
+
+rule jack_generic : compiler
+{
+  // New Android compiler: http://tools.android.com/tech-docs/jackandjill
+  meta:
+    description = "Jack (unknown version)"
+    sample      = "aaa4aed09a3a014c6e045566b86708f964088a0f9c712f02191cdcf61ff06fe8"
+
+  condition:
+    is_dex
+    and not jack_3x and not jack_4x and not jack_5x
+    and not jack_4_12
+    and (jack_emitter or has_jack_anon_methods)
+}
+
+rule dexlib1 : compiler
+{
+  meta:
+    description = "dexlib 1.x"
+    sample      = "cf7b06bd339ee68224420dfcaba84a88e51ae6cd07d504fc8b4f2db6c6889971"
+
+  condition:
+    unsorted_string_pool
+}
+
+rule dexlib2beta : compiler
+{
+  meta:
+    description = "dexlib 2.x beta"
+    sample      = "8fd8c1e2337a4d2ac8f8f64c13a4fb304589ecf165e41de27ebc656a7475a008"
+
+  condition:
+    not dexlib1
+    and null_interfaces
+}
+
+rule dexlib2 : compiler
+{
+  meta:
+    description = "dexlib 2.x"
+    sample      = "c7c566b1b185c99e338a77865eaf2eed6dc9b2b97793e262208c0b7f38bbf947"
+
+  condition:
+    not dexlib1
+    and dexlib2_map_type_order
+    and not dexlib2beta
+}
+
+rule dx : compiler
+{
+  meta:
+    description = "dx"
+    sample      = "6ef06bcc9712ec2ef3b71c5c8454af3abdafa628406b4f5629815995470da878"
+
+  condition:
+    dx_map_type_order
+    and not dexlib1
+    and not dexlib2
+    and not dexlib2beta
+    and not r8_marker
+}
+
+rule dx_merged : compiler
+{
+  meta:
+    description = "dx (possible dexmerge)"
+    sample      = "6c31ccd3b10ff2b0fa428e6efa954c37c0d2e641814f63c524c4f8fec9d11e22"
+
+  condition:
+    dexmerge_map_type_order
+    and not dexlib1
+    and not dexlib2
+    and not dexlib2beta
+    and not r8_marker
+}
+
+rule r8 : compiler
+{
+  meta:
+    description = "r8"
+    sample      = "e45ea01eedfc7bede77669412cce07b7d41b284bc6ffc9dfa27a519270bbe99a"
+    sample2     = "bae4c7c1974fa317ecc8fbbcf7bafa3b1a0d5903fdd3040412c628277cf45258"
+
+  condition:
+    r8_marker
+    and (r8_map_type_order or ambiguous_tiny_dex_map_type_order)
+}
+
+rule r8_merged : compiler
+{
+  meta:
+    description = "r8 (possible dexmerge)"
+    sample      = "ee1e901bb862835b227f7e9cfbaaa357402992ee9760b630a05f9b3423520526"
+
+  condition:
+    r8_marker
+    and dexmerge_map_type_order
+}
+
+rule r8_no_marker : compiler
+{
+  meta:
+    // Hiding the marker is easier than hiding the map type order.
+    description = "r8 without marker (suspicious)"
+    sample      = "f399d833ff54a798d609279bb8a51222c75be9b7fb7b3ab9cc8cb628f7d76257"
+    sample2     = "d8a5545eb3c76d8078d778eb5962398d9f2fefab34f971b19beda35e0e76f6ef"
+
+  condition:
+    not r8_marker
+    and r8_map_type_order
+}
+
+rule dexmerge : manipulator
+{
+  meta:
+    description = "dexmerge"
+    sample      = "6c31ccd3b10ff2b0fa428e6efa954c37c0d2e641814f63c524c4f8fec9d11e22"
+
+  condition:
+    dexmerge_map_type_order
+}
+
+rule unknown_compiler : compiler {
+  meta:
+    description = "unknown (please file detection issue!)"
+
+  condition:
+    is_dex
+    and not (
+      (dexlib1 or dexlib2 or dexlib2beta)
+      or (dx or dx_merged)
+      or (r8 or r8_merged or r8_no_marker)
+      or (jack_generic or jack_3x or jack_4x or jack_4_12 or jack_5x)
+      or (dexmerge)
+    )
+}