anais-apk-forensic 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +249 -0
- package/anais.sh +669 -0
- package/analysis_tools/__pycache__/apk_basic_info.cpython-313.pyc +0 -0
- package/analysis_tools/__pycache__/apk_basic_info.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/check_zip_encryption.cpython-313.pyc +0 -0
- package/analysis_tools/__pycache__/check_zip_encryption.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/detect_obfuscation.cpython-313.pyc +0 -0
- package/analysis_tools/__pycache__/detect_obfuscation.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/dex_payload_hunter.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/entropy_analyzer.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/error_logger.cpython-313.pyc +0 -0
- package/analysis_tools/__pycache__/error_logger.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/find_encrypted_payload.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/fix_apk_headers.cpython-313.pyc +0 -0
- package/analysis_tools/__pycache__/fix_apk_headers.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/manifest_analyzer.cpython-313.pyc +0 -0
- package/analysis_tools/__pycache__/manifest_analyzer.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/network_analyzer.cpython-313.pyc +0 -0
- package/analysis_tools/__pycache__/network_analyzer.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/report_generator.cpython-313.pyc +0 -0
- package/analysis_tools/__pycache__/report_generator.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/report_generator_modular.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/sast_scanner.cpython-313.pyc +0 -0
- package/analysis_tools/__pycache__/sast_scanner.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/so_string_analyzer.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/yara_enhanced_analyzer.cpython-314.pyc +0 -0
- package/analysis_tools/__pycache__/yara_results_processor.cpython-314.pyc +0 -0
- package/analysis_tools/apk_basic_info.py +85 -0
- package/analysis_tools/check_zip_encryption.py +142 -0
- package/analysis_tools/detect_obfuscation.py +650 -0
- package/analysis_tools/dex_payload_hunter.py +734 -0
- package/analysis_tools/entropy_analyzer.py +335 -0
- package/analysis_tools/error_logger.py +75 -0
- package/analysis_tools/find_encrypted_payload.py +485 -0
- package/analysis_tools/fix_apk_headers.py +154 -0
- package/analysis_tools/manifest_analyzer.py +214 -0
- package/analysis_tools/network_analyzer.py +287 -0
- package/analysis_tools/report_generator.py +506 -0
- package/analysis_tools/report_generator_modular.py +885 -0
- package/analysis_tools/sast_scanner.py +412 -0
- package/analysis_tools/so_string_analyzer.py +406 -0
- package/analysis_tools/yara_enhanced_analyzer.py +330 -0
- package/analysis_tools/yara_results_processor.py +368 -0
- package/analyzer_config.json +113 -0
- package/apkid/__init__.py +32 -0
- package/apkid/__pycache__/__init__.cpython-313.pyc +0 -0
- package/apkid/__pycache__/__init__.cpython-314.pyc +0 -0
- package/apkid/__pycache__/apkid.cpython-313.pyc +0 -0
- package/apkid/__pycache__/apkid.cpython-314.pyc +0 -0
- package/apkid/__pycache__/main.cpython-313.pyc +0 -0
- package/apkid/__pycache__/main.cpython-314.pyc +0 -0
- package/apkid/__pycache__/output.cpython-313.pyc +0 -0
- package/apkid/__pycache__/rules.cpython-313.pyc +0 -0
- package/apkid/apkid.py +266 -0
- package/apkid/main.py +98 -0
- package/apkid/output.py +177 -0
- package/apkid/rules/apk/common.yara +68 -0
- package/apkid/rules/apk/obfuscators.yara +118 -0
- package/apkid/rules/apk/packers.yara +1197 -0
- package/apkid/rules/apk/protectors.yara +301 -0
- package/apkid/rules/dex/abnormal.yara +104 -0
- package/apkid/rules/dex/anti-vm.yara +568 -0
- package/apkid/rules/dex/common.yara +60 -0
- package/apkid/rules/dex/compilers.yara +434 -0
- package/apkid/rules/dex/obfuscators.yara +602 -0
- package/apkid/rules/dex/packers.yara +761 -0
- package/apkid/rules/dex/protectors.yara +520 -0
- package/apkid/rules/dll/common.yara +38 -0
- package/apkid/rules/dll/obfuscators.yara +43 -0
- package/apkid/rules/elf/anti-vm.yara +43 -0
- package/apkid/rules/elf/common.yara +54 -0
- package/apkid/rules/elf/obfuscators.yara +991 -0
- package/apkid/rules/elf/packers.yara +1128 -0
- package/apkid/rules/elf/protectors.yara +794 -0
- package/apkid/rules/res/common.yara +43 -0
- package/apkid/rules/res/obfuscators.yara +46 -0
- package/apkid/rules/res/protectors.yara +46 -0
- package/apkid/rules.py +77 -0
- package/bin/anais +3 -0
- package/dist/cli.js +82 -0
- package/dist/index.js +123 -0
- package/dist/types/index.js +2 -0
- package/dist/utils/index.js +21 -0
- package/dist/utils/output.js +44 -0
- package/dist/utils/paths.js +107 -0
- package/docs/ARCHITECTURE.txt +353 -0
- package/docs/Workflow and Reference.md +445 -0
- package/package.json +70 -0
- package/rules/yara_general_rules.yar +323 -0
- package/scripts/dynamic_analysis_helper.sh +334 -0
- package/scripts/frida/dpt_dex_dumper.js +145 -0
- package/scripts/frida/frida_dex_dump.js +145 -0
- package/scripts/frida/frida_hooks.js +437 -0
- package/scripts/frida/frida_websocket_extractor.js +154 -0
- package/scripts/setup.sh +206 -0
- package/scripts/validate_framework.sh +224 -0
- package/src/cli.ts +91 -0
- package/src/index.ts +123 -0
- package/src/types/index.ts +44 -0
- package/src/utils/index.ts +6 -0
- package/src/utils/output.ts +50 -0
- package/src/utils/paths.ts +72 -0
- package/tsconfig.json +14 -0
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Output formatting utilities
|
|
3
|
+
*/
|
|
4
|
+
|
|
5
|
+
export const colors = {
|
|
6
|
+
reset: "\x1b[0m",
|
|
7
|
+
bright: "\x1b[1m",
|
|
8
|
+
dim: "\x1b[2m",
|
|
9
|
+
red: "\x1b[31m",
|
|
10
|
+
green: "\x1b[32m",
|
|
11
|
+
yellow: "\x1b[33m",
|
|
12
|
+
blue: "\x1b[34m",
|
|
13
|
+
magenta: "\x1b[35m",
|
|
14
|
+
cyan: "\x1b[36m",
|
|
15
|
+
};
|
|
16
|
+
|
|
17
|
+
export function formatSuccess(message: string): string {
|
|
18
|
+
return `${colors.green}✅ ${message}${colors.reset}`;
|
|
19
|
+
}
|
|
20
|
+
|
|
21
|
+
export function formatError(message: string): string {
|
|
22
|
+
return `${colors.red}❌ ${message}${colors.reset}`;
|
|
23
|
+
}
|
|
24
|
+
|
|
25
|
+
export function formatInfo(message: string): string {
|
|
26
|
+
return `${colors.blue}ℹ ${message}${colors.reset}`;
|
|
27
|
+
}
|
|
28
|
+
|
|
29
|
+
export function formatWarning(message: string): string {
|
|
30
|
+
return `${colors.yellow}⚠ ${message}${colors.reset}`;
|
|
31
|
+
}
|
|
32
|
+
|
|
33
|
+
export function printSeparator(length: number = 50): void {
|
|
34
|
+
console.log("═".repeat(length));
|
|
35
|
+
}
|
|
36
|
+
|
|
37
|
+
export function printBanner(): void {
|
|
38
|
+
console.log(
|
|
39
|
+
`\n${colors.cyan}╔═══════════════════════════════════════════════════════════╗${colors.reset}`,
|
|
40
|
+
);
|
|
41
|
+
console.log(
|
|
42
|
+
`${colors.cyan}║ Anais APK Forensic Automation - CLI v1.0.0 ║${colors.reset}`,
|
|
43
|
+
);
|
|
44
|
+
console.log(
|
|
45
|
+
`${colors.cyan}║ Comprehensive APK Security Analysis & SAST ║${colors.reset}`,
|
|
46
|
+
);
|
|
47
|
+
console.log(
|
|
48
|
+
`${colors.cyan}╚═══════════════════════════════════════════════════════════╝${colors.reset}\n`,
|
|
49
|
+
);
|
|
50
|
+
}
|
|
@@ -0,0 +1,72 @@
|
|
|
1
|
+
import * as fs from "fs";
|
|
2
|
+
import * as os from "os";
|
|
3
|
+
import * as path from "path";
|
|
4
|
+
|
|
5
|
+
/**
|
|
6
|
+
* Get the user's Documents folder path
|
|
7
|
+
*/
|
|
8
|
+
export function getUserDocumentsPath(): string {
|
|
9
|
+
const homeDir = os.homedir();
|
|
10
|
+
return path.join(homeDir, "Documents");
|
|
11
|
+
}
|
|
12
|
+
|
|
13
|
+
/**
|
|
14
|
+
* Get the default analysis workspace path (Documents/Anais-Reports)
|
|
15
|
+
*/
|
|
16
|
+
export function getDefaultWorkspacePath(): string {
|
|
17
|
+
return path.join(getUserDocumentsPath(), "Anais-Reports");
|
|
18
|
+
}
|
|
19
|
+
|
|
20
|
+
/**
|
|
21
|
+
* Ensure the analysis workspace directory exists
|
|
22
|
+
*/
|
|
23
|
+
export function ensureWorkspaceExists(): void {
|
|
24
|
+
const workspacePath = getDefaultWorkspacePath();
|
|
25
|
+
if (!fs.existsSync(workspacePath)) {
|
|
26
|
+
fs.mkdirSync(workspacePath, { recursive: true });
|
|
27
|
+
}
|
|
28
|
+
}
|
|
29
|
+
|
|
30
|
+
/**
|
|
31
|
+
* Get the project root directory (where package is installed)
|
|
32
|
+
* When installed via npm, __dirname will be in node_modules/anais-apk-forensic/dist/utils
|
|
33
|
+
* We need to go up to the package root
|
|
34
|
+
*/
|
|
35
|
+
export function getProjectRoot(): string {
|
|
36
|
+
// Check if we're in node_modules (installed via npm)
|
|
37
|
+
const currentDir = path.resolve(__dirname, "../..");
|
|
38
|
+
if (currentDir.includes("node_modules")) {
|
|
39
|
+
// Go up to node_modules/anais-apk-forensic/
|
|
40
|
+
return path.resolve(__dirname, "../..");
|
|
41
|
+
}
|
|
42
|
+
// Otherwise we're in development mode (dist/utils -> root)
|
|
43
|
+
return path.resolve(__dirname, "../..");
|
|
44
|
+
}
|
|
45
|
+
|
|
46
|
+
/**
|
|
47
|
+
* Get the path to anais.sh script
|
|
48
|
+
*/
|
|
49
|
+
export function getAnaisScriptPath(): string {
|
|
50
|
+
return path.join(getProjectRoot(), "anais.sh");
|
|
51
|
+
}
|
|
52
|
+
|
|
53
|
+
/**
|
|
54
|
+
* Check if a file exists
|
|
55
|
+
*/
|
|
56
|
+
export function fileExists(filePath: string): boolean {
|
|
57
|
+
return fs.existsSync(filePath);
|
|
58
|
+
}
|
|
59
|
+
|
|
60
|
+
/**
|
|
61
|
+
* Resolve absolute path
|
|
62
|
+
*/
|
|
63
|
+
export function resolveAbsolutePath(filePath: string): string {
|
|
64
|
+
return path.resolve(filePath);
|
|
65
|
+
}
|
|
66
|
+
|
|
67
|
+
/**
|
|
68
|
+
* Get basename of a file
|
|
69
|
+
*/
|
|
70
|
+
export function getBasename(filePath: string): string {
|
|
71
|
+
return path.basename(filePath);
|
|
72
|
+
}
|
package/tsconfig.json
ADDED
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
{
|
|
2
|
+
"compilerOptions": {
|
|
3
|
+
"target": "es6",
|
|
4
|
+
"module": "commonjs",
|
|
5
|
+
"strict": true,
|
|
6
|
+
"esModuleInterop": true,
|
|
7
|
+
"skipLibCheck": true,
|
|
8
|
+
"forceConsistentCasingInFileNames": true,
|
|
9
|
+
"outDir": "./dist",
|
|
10
|
+
"rootDir": "./src"
|
|
11
|
+
},
|
|
12
|
+
"include": ["src/**/*"],
|
|
13
|
+
"exclude": ["node_modules", "**/*.spec.ts"]
|
|
14
|
+
}
|