anais-apk-forensic 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (104) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +249 -0
  3. package/anais.sh +669 -0
  4. package/analysis_tools/__pycache__/apk_basic_info.cpython-313.pyc +0 -0
  5. package/analysis_tools/__pycache__/apk_basic_info.cpython-314.pyc +0 -0
  6. package/analysis_tools/__pycache__/check_zip_encryption.cpython-313.pyc +0 -0
  7. package/analysis_tools/__pycache__/check_zip_encryption.cpython-314.pyc +0 -0
  8. package/analysis_tools/__pycache__/detect_obfuscation.cpython-313.pyc +0 -0
  9. package/analysis_tools/__pycache__/detect_obfuscation.cpython-314.pyc +0 -0
  10. package/analysis_tools/__pycache__/dex_payload_hunter.cpython-314.pyc +0 -0
  11. package/analysis_tools/__pycache__/entropy_analyzer.cpython-314.pyc +0 -0
  12. package/analysis_tools/__pycache__/error_logger.cpython-313.pyc +0 -0
  13. package/analysis_tools/__pycache__/error_logger.cpython-314.pyc +0 -0
  14. package/analysis_tools/__pycache__/find_encrypted_payload.cpython-314.pyc +0 -0
  15. package/analysis_tools/__pycache__/fix_apk_headers.cpython-313.pyc +0 -0
  16. package/analysis_tools/__pycache__/fix_apk_headers.cpython-314.pyc +0 -0
  17. package/analysis_tools/__pycache__/manifest_analyzer.cpython-313.pyc +0 -0
  18. package/analysis_tools/__pycache__/manifest_analyzer.cpython-314.pyc +0 -0
  19. package/analysis_tools/__pycache__/network_analyzer.cpython-313.pyc +0 -0
  20. package/analysis_tools/__pycache__/network_analyzer.cpython-314.pyc +0 -0
  21. package/analysis_tools/__pycache__/report_generator.cpython-313.pyc +0 -0
  22. package/analysis_tools/__pycache__/report_generator.cpython-314.pyc +0 -0
  23. package/analysis_tools/__pycache__/report_generator_modular.cpython-314.pyc +0 -0
  24. package/analysis_tools/__pycache__/sast_scanner.cpython-313.pyc +0 -0
  25. package/analysis_tools/__pycache__/sast_scanner.cpython-314.pyc +0 -0
  26. package/analysis_tools/__pycache__/so_string_analyzer.cpython-314.pyc +0 -0
  27. package/analysis_tools/__pycache__/yara_enhanced_analyzer.cpython-314.pyc +0 -0
  28. package/analysis_tools/__pycache__/yara_results_processor.cpython-314.pyc +0 -0
  29. package/analysis_tools/apk_basic_info.py +85 -0
  30. package/analysis_tools/check_zip_encryption.py +142 -0
  31. package/analysis_tools/detect_obfuscation.py +650 -0
  32. package/analysis_tools/dex_payload_hunter.py +734 -0
  33. package/analysis_tools/entropy_analyzer.py +335 -0
  34. package/analysis_tools/error_logger.py +75 -0
  35. package/analysis_tools/find_encrypted_payload.py +485 -0
  36. package/analysis_tools/fix_apk_headers.py +154 -0
  37. package/analysis_tools/manifest_analyzer.py +214 -0
  38. package/analysis_tools/network_analyzer.py +287 -0
  39. package/analysis_tools/report_generator.py +506 -0
  40. package/analysis_tools/report_generator_modular.py +885 -0
  41. package/analysis_tools/sast_scanner.py +412 -0
  42. package/analysis_tools/so_string_analyzer.py +406 -0
  43. package/analysis_tools/yara_enhanced_analyzer.py +330 -0
  44. package/analysis_tools/yara_results_processor.py +368 -0
  45. package/analyzer_config.json +113 -0
  46. package/apkid/__init__.py +32 -0
  47. package/apkid/__pycache__/__init__.cpython-313.pyc +0 -0
  48. package/apkid/__pycache__/__init__.cpython-314.pyc +0 -0
  49. package/apkid/__pycache__/apkid.cpython-313.pyc +0 -0
  50. package/apkid/__pycache__/apkid.cpython-314.pyc +0 -0
  51. package/apkid/__pycache__/main.cpython-313.pyc +0 -0
  52. package/apkid/__pycache__/main.cpython-314.pyc +0 -0
  53. package/apkid/__pycache__/output.cpython-313.pyc +0 -0
  54. package/apkid/__pycache__/rules.cpython-313.pyc +0 -0
  55. package/apkid/apkid.py +266 -0
  56. package/apkid/main.py +98 -0
  57. package/apkid/output.py +177 -0
  58. package/apkid/rules/apk/common.yara +68 -0
  59. package/apkid/rules/apk/obfuscators.yara +118 -0
  60. package/apkid/rules/apk/packers.yara +1197 -0
  61. package/apkid/rules/apk/protectors.yara +301 -0
  62. package/apkid/rules/dex/abnormal.yara +104 -0
  63. package/apkid/rules/dex/anti-vm.yara +568 -0
  64. package/apkid/rules/dex/common.yara +60 -0
  65. package/apkid/rules/dex/compilers.yara +434 -0
  66. package/apkid/rules/dex/obfuscators.yara +602 -0
  67. package/apkid/rules/dex/packers.yara +761 -0
  68. package/apkid/rules/dex/protectors.yara +520 -0
  69. package/apkid/rules/dll/common.yara +38 -0
  70. package/apkid/rules/dll/obfuscators.yara +43 -0
  71. package/apkid/rules/elf/anti-vm.yara +43 -0
  72. package/apkid/rules/elf/common.yara +54 -0
  73. package/apkid/rules/elf/obfuscators.yara +991 -0
  74. package/apkid/rules/elf/packers.yara +1128 -0
  75. package/apkid/rules/elf/protectors.yara +794 -0
  76. package/apkid/rules/res/common.yara +43 -0
  77. package/apkid/rules/res/obfuscators.yara +46 -0
  78. package/apkid/rules/res/protectors.yara +46 -0
  79. package/apkid/rules.py +77 -0
  80. package/bin/anais +3 -0
  81. package/dist/cli.js +82 -0
  82. package/dist/index.js +123 -0
  83. package/dist/types/index.js +2 -0
  84. package/dist/utils/index.js +21 -0
  85. package/dist/utils/output.js +44 -0
  86. package/dist/utils/paths.js +107 -0
  87. package/docs/ARCHITECTURE.txt +353 -0
  88. package/docs/Workflow and Reference.md +445 -0
  89. package/package.json +70 -0
  90. package/rules/yara_general_rules.yar +323 -0
  91. package/scripts/dynamic_analysis_helper.sh +334 -0
  92. package/scripts/frida/dpt_dex_dumper.js +145 -0
  93. package/scripts/frida/frida_dex_dump.js +145 -0
  94. package/scripts/frida/frida_hooks.js +437 -0
  95. package/scripts/frida/frida_websocket_extractor.js +154 -0
  96. package/scripts/setup.sh +206 -0
  97. package/scripts/validate_framework.sh +224 -0
  98. package/src/cli.ts +91 -0
  99. package/src/index.ts +123 -0
  100. package/src/types/index.ts +44 -0
  101. package/src/utils/index.ts +6 -0
  102. package/src/utils/output.ts +50 -0
  103. package/src/utils/paths.ts +72 -0
  104. package/tsconfig.json +14 -0
@@ -0,0 +1,50 @@
1
+ /**
2
+ * Output formatting utilities
3
+ */
4
+
5
+ export const colors = {
6
+ reset: "\x1b[0m",
7
+ bright: "\x1b[1m",
8
+ dim: "\x1b[2m",
9
+ red: "\x1b[31m",
10
+ green: "\x1b[32m",
11
+ yellow: "\x1b[33m",
12
+ blue: "\x1b[34m",
13
+ magenta: "\x1b[35m",
14
+ cyan: "\x1b[36m",
15
+ };
16
+
17
+ export function formatSuccess(message: string): string {
18
+ return `${colors.green}✅ ${message}${colors.reset}`;
19
+ }
20
+
21
+ export function formatError(message: string): string {
22
+ return `${colors.red}❌ ${message}${colors.reset}`;
23
+ }
24
+
25
+ export function formatInfo(message: string): string {
26
+ return `${colors.blue}ℹ ${message}${colors.reset}`;
27
+ }
28
+
29
+ export function formatWarning(message: string): string {
30
+ return `${colors.yellow}⚠ ${message}${colors.reset}`;
31
+ }
32
+
33
+ export function printSeparator(length: number = 50): void {
34
+ console.log("═".repeat(length));
35
+ }
36
+
37
+ export function printBanner(): void {
38
+ console.log(
39
+ `\n${colors.cyan}╔═══════════════════════════════════════════════════════════╗${colors.reset}`,
40
+ );
41
+ console.log(
42
+ `${colors.cyan}║ Anais APK Forensic Automation - CLI v1.0.0 ║${colors.reset}`,
43
+ );
44
+ console.log(
45
+ `${colors.cyan}║ Comprehensive APK Security Analysis & SAST ║${colors.reset}`,
46
+ );
47
+ console.log(
48
+ `${colors.cyan}╚═══════════════════════════════════════════════════════════╝${colors.reset}\n`,
49
+ );
50
+ }
@@ -0,0 +1,72 @@
1
+ import * as fs from "fs";
2
+ import * as os from "os";
3
+ import * as path from "path";
4
+
5
+ /**
6
+ * Get the user's Documents folder path
7
+ */
8
+ export function getUserDocumentsPath(): string {
9
+ const homeDir = os.homedir();
10
+ return path.join(homeDir, "Documents");
11
+ }
12
+
13
+ /**
14
+ * Get the default analysis workspace path (Documents/Anais-Reports)
15
+ */
16
+ export function getDefaultWorkspacePath(): string {
17
+ return path.join(getUserDocumentsPath(), "Anais-Reports");
18
+ }
19
+
20
+ /**
21
+ * Ensure the analysis workspace directory exists
22
+ */
23
+ export function ensureWorkspaceExists(): void {
24
+ const workspacePath = getDefaultWorkspacePath();
25
+ if (!fs.existsSync(workspacePath)) {
26
+ fs.mkdirSync(workspacePath, { recursive: true });
27
+ }
28
+ }
29
+
30
+ /**
31
+ * Get the project root directory (where package is installed)
32
+ * When installed via npm, __dirname will be in node_modules/anais-apk-forensic/dist/utils
33
+ * We need to go up to the package root
34
+ */
35
+ export function getProjectRoot(): string {
36
+ // Check if we're in node_modules (installed via npm)
37
+ const currentDir = path.resolve(__dirname, "../..");
38
+ if (currentDir.includes("node_modules")) {
39
+ // Go up to node_modules/anais-apk-forensic/
40
+ return path.resolve(__dirname, "../..");
41
+ }
42
+ // Otherwise we're in development mode (dist/utils -> root)
43
+ return path.resolve(__dirname, "../..");
44
+ }
45
+
46
+ /**
47
+ * Get the path to anais.sh script
48
+ */
49
+ export function getAnaisScriptPath(): string {
50
+ return path.join(getProjectRoot(), "anais.sh");
51
+ }
52
+
53
+ /**
54
+ * Check if a file exists
55
+ */
56
+ export function fileExists(filePath: string): boolean {
57
+ return fs.existsSync(filePath);
58
+ }
59
+
60
+ /**
61
+ * Resolve absolute path
62
+ */
63
+ export function resolveAbsolutePath(filePath: string): string {
64
+ return path.resolve(filePath);
65
+ }
66
+
67
+ /**
68
+ * Get basename of a file
69
+ */
70
+ export function getBasename(filePath: string): string {
71
+ return path.basename(filePath);
72
+ }
package/tsconfig.json ADDED
@@ -0,0 +1,14 @@
1
+ {
2
+ "compilerOptions": {
3
+ "target": "es6",
4
+ "module": "commonjs",
5
+ "strict": true,
6
+ "esModuleInterop": true,
7
+ "skipLibCheck": true,
8
+ "forceConsistentCasingInFileNames": true,
9
+ "outDir": "./dist",
10
+ "rootDir": "./src"
11
+ },
12
+ "include": ["src/**/*"],
13
+ "exclude": ["node_modules", "**/*.spec.ts"]
14
+ }