trueseeing 2.2.4__tar.gz → 2.2.5__tar.gz

trueseeing-2.2.5/.github/FUNDING.yml

@@ -0,0 +1,14 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+polar: # Replace with a single Polar username
+buy_me_a_coffee: alterakey
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

{trueseeing-2.2.4 → trueseeing-2.2.5}/Dockerfile

@@ -22,5 +22,6 @@ env TS2_IN_DOCKER=1
 env TS2_CACHEDIR=/cache
 env TS2_HOME=/data
 env TS2_EXTDIR=/ext
+env TS2_SWIFT_DEMANGLER_URL=http://ts2-swift-demangle
 workdir /out
 entrypoint ["trueseeing"]

{trueseeing-2.2.4 → trueseeing-2.2.5}/PKG-INFO

@@ -1,7 +1,7 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.3
 Name: trueseeing
-Version: 2.2.4
-Summary: Trueseeing is a non-decompiling Android application vulnerability scanner.
+Version: 2.2.5
+Summary: Trueseeing is a non-decompiling iOS/Android application vulnerability scanner.
 Keywords: android,security,pentest,hacking
 Author-email: Takahiro Yoshimura <alterakey@protonmail.com>
 Requires-Python: >=3.9
@@ -39,7 +39,7 @@ Provides-Extra: dev
 ![Main branch deploy status](https://github.com/alterakey/trueseeing/workflows/deploy/badge.svg)
 ![Main branch last commit](https://img.shields.io/github/last-commit/alterakey/trueseeing/main)
 
-trueseeing is a fast, accurate and resillient vulnerability scanner for Android apps.  We operate on the Dalvik VM level -- i.e. we don't care if the target app is obfuscated or not.
+trueseeing is a fast, accurate and resillient vulnerability scanner for iOS/Android apps.  We operate on the Dalvik VM level for Android -- i.e. we don't care if the target app is obfuscated or not.
 
 ## Capability
 
@@ -51,6 +51,8 @@ Currently we can:
 * Copy in/out app data through debug interface
 * Search for certain calls/consts/sput/iput
 * Deduce constants/typesets for args of op
+* Scan API/private calls for native codes (NB: you need [ts2-disasm-ghidra](https://github.com/alterakey/ts2-disasm-ghidra))
+* Scan iOS apps for basic vulnerabilities (NB: you need [ts2-disasm-ghidra](https://github.com/alterakey/ts2-disasm-ghidra))
 * etc.
 
 ## Installation
@@ -84,7 +86,7 @@ Alternatively, you can install our package with pip as follows. This form of ins
 You can interactively scan/analyze/patch/etc. apps -- making it the ideal choice for manual analysis:
 
     $ trueseeing target.apk
-    [+] trueseeing 2.2.4
+    [+] trueseeing 2.2.5
     ts[target.apk]> ?
     ...
     ts[target.apk]> i                      # show generic information

{trueseeing-2.2.4 → trueseeing-2.2.5}/README.md

@@ -5,7 +5,7 @@
 ![Main branch deploy status](https://github.com/alterakey/trueseeing/workflows/deploy/badge.svg)
 ![Main branch last commit](https://img.shields.io/github/last-commit/alterakey/trueseeing/main)
 
-trueseeing is a fast, accurate and resillient vulnerability scanner for Android apps.  We operate on the Dalvik VM level -- i.e. we don't care if the target app is obfuscated or not.
+trueseeing is a fast, accurate and resillient vulnerability scanner for iOS/Android apps.  We operate on the Dalvik VM level for Android -- i.e. we don't care if the target app is obfuscated or not.
 
 ## Capability
 
@@ -17,6 +17,8 @@ Currently we can:
 * Copy in/out app data through debug interface
 * Search for certain calls/consts/sput/iput
 * Deduce constants/typesets for args of op
+* Scan API/private calls for native codes (NB: you need [ts2-disasm-ghidra](https://github.com/alterakey/ts2-disasm-ghidra))
+* Scan iOS apps for basic vulnerabilities (NB: you need [ts2-disasm-ghidra](https://github.com/alterakey/ts2-disasm-ghidra))
 * etc.
 
 ## Installation
@@ -50,7 +52,7 @@ Alternatively, you can install our package with pip as follows. This form of ins
 You can interactively scan/analyze/patch/etc. apps -- making it the ideal choice for manual analysis:
 
     $ trueseeing target.apk
-    [+] trueseeing 2.2.4
+    [+] trueseeing 2.2.5
     ts[target.apk]> ?
     ...
     ts[target.apk]> i                      # show generic information

trueseeing-2.2.5/trueseeing/__init__.py

@@ -0,0 +1,2 @@
+"""Trueseeing is a non-decompiling iOS/Android application vulnerability scanner."""
+__version__ = '2.2.5'

{trueseeing-2.2.4 → trueseeing-2.2.5}/trueseeing/api.py

@@ -4,7 +4,7 @@ from abc import ABC, abstractmethod
 
 if TYPE_CHECKING:
   from collections import deque
-  from typing import Any, TypedDict, Protocol, Optional, Callable, Coroutine, Union, List, Mapping, overload, Literal
+  from typing import Any, TypedDict, Protocol, Optional, Callable, Coroutine, Union, List, Mapping, overload, Literal, Set
   from typing_extensions import deprecated
   from trueseeing.core.context import Context, ContextType
   from trueseeing.core.android.context import APKContext
@@ -25,6 +25,7 @@ if TYPE_CHECKING:
     e: CommandEntrypoint
     n: str
     d: str
+    t: Set[str]
 
   class CommandEntry(Entry):
     pass
@@ -65,6 +66,7 @@ if TYPE_CHECKING:
   class CommandHelper(Protocol):
     def get_target(self) -> Optional[str]: ...
     def require_target(self, msg: Optional[str] = None) -> str: ...
+    def get_context_type(self) -> Optional[Set[ContextType]]: ...
     @overload
     def get_context(self) -> Context: ...
     @overload

{trueseeing-2.2.4 → trueseeing-2.2.5}/trueseeing/app/cmd/__init__.py

@@ -1,10 +1,12 @@
 from __future__ import annotations
 from typing import TYPE_CHECKING
+from functools import cache
 
 if TYPE_CHECKING:
   from typing import Type, Iterator
   from trueseeing.api import Command
 
+@cache
 def discover() -> Iterator[Type[Command]]:
   from trueseeing.api import Command
   from importlib import import_module

{trueseeing-2.2.4 → trueseeing-2.2.5}/trueseeing/app/cmd/android/asm.py

@@ -23,19 +23,21 @@ class AssembleCommand(CommandMixin):
 
   def get_commands(self) -> CommandMap:
     return {
-      'ca':dict(e=self._assemble, n='ca[!] /path', d='assemble as target from path'),
-      'ca!':dict(e=self._assemble),
-      'cd':dict(e=self._disassemble, n='cd[s][!] /path', d='disassemble target into path'),
-      'cd!':dict(e=self._disassemble),
-      'cds':dict(e=self._disassemble_nodex),
-      'cds!':dict(e=self._disassemble_nodex),
-      'co':dict(e=self._export_context, n='co[!] /path [pat]', d='export codebase'),
-      'co!':dict(e=self._export_context),
+      'ca':dict(e=self._assemble, n='ca[!] /path', d='assemble as target from path', t={'apk'}),
+      'ca!':dict(e=self._assemble, t={'apk'}),
+      'cd':dict(e=self._disassemble, n='cd[s][!] /path', d='disassemble target into path', t={'apk'}),
+      'cd!':dict(e=self._disassemble, t={'apk'}),
+      'cds':dict(e=self._disassemble_nodex, t={'apk'}),
+      'cds!':dict(e=self._disassemble_nodex, t={'apk'}),
+      'cm':dict(e=self._merge, n='cm[!] [output.apk]', d='merge slices into a plain apk', t={'xapk'}),
+      'cm!':dict(e=self._merge, t={'xapk'}),
+      'co':dict(e=self._export_context, n='co[!] /path [pat]', d='export codebase', t={'apk'}),
+      'co!':dict(e=self._export_context, t={'apk'}),
     }
 
   def get_options(self) -> OptionMap:
     return {
-      'nocache':dict(n='nocache', d='do not replicate content before build [ca]')
+      'nocache':dict(n='nocache', d='do not replicate content before build [ca]', t={'apk'}),
     }
 
   async def _assemble(self, args: deque[str]) -> None:
@@ -214,7 +216,7 @@ class AssembleCommand(CommandMixin):
       if subformat in ['gz']:
         kwargs.update(dict(compresslevel=3))
 
-      with tarfile.open(root, 'w:{}'.format(subformat), **kwargs) as tf:  # type: ignore[arg-type]
+      with tarfile.open(root, 'w:{}'.format(subformat), **kwargs) as tf:  # type: ignore[call-overload]
         now = int(time.time())
         for path,blob in q.file_enum(pat=pat, regex=True):
           target = os.path.join('files', *path.split('/'))
@@ -223,6 +225,7 @@ class AssembleCommand(CommandMixin):
 
           bf = BytesIO(blob)
           ti = tarfile.TarInfo(name=target)
+          ti.size = len(blob)
           ti.uname = 'root'
           ti.gname = 'root'
           ti.mode = 0o600
@@ -239,3 +242,38 @@ class AssembleCommand(CommandMixin):
       return 'tar:gz'
     else:
       return None
+
+  async def _merge(self, args: deque[str]) -> None:
+    target = self._helper.require_target('need target')
+
+    cmd = args.popleft()
+
+    import os
+    import time
+    from tempfile import TemporaryDirectory
+    from trueseeing.core.android.asm import APKAssembler
+    from trueseeing.core.android.tools import move_apk
+
+    if args:
+      outfn = args.popleft()
+    else:
+      outfn = target.replace('.xapk', '.apk')
+
+    origfn = outfn.replace('.apk', '.apk.orig')
+
+    if os.path.exists(origfn) and not cmd.endswith('!'):
+      ui.fatal('backup file exists; force (!) to overwrite')
+
+    ui.info('merging slices {target} -> {outfn}'.format(target=target, outfn=outfn))
+
+    at = time.time()
+
+    with TemporaryDirectory() as td:
+      apk, sig = await APKAssembler.merge_slices(target, td)
+
+      if os.path.exists(outfn):
+        move_apk(outfn, origfn)
+
+      move_apk(apk, outfn)
+
+    ui.success('done ({t:.02f} sec.)'.format(t=(time.time() - at)))

{trueseeing-2.2.4 → trueseeing-2.2.5}/trueseeing/app/cmd/android/engage.py

@@ -22,37 +22,40 @@ class EngageCommand(CommandMixin):
 
   def get_commands(self) -> CommandMap:
     return {
-      'xtq':dict(e=self._engage_tamper_discard, n='xtq', d='engage: discard changes'),
-      'xtx':dict(e=self._engage_tamper_apply, n='xtx[!]', d='engage: apply and rebuild apk'),
-      'xtx!':dict(e=self._engage_tamper_apply),
-      'xtf':dict(e=self._engage_tamper_inject_frida, n='xtf[!] [config]', d='engage; inject frida gadget'),
-      'xtf!':dict(e=self._engage_tamper_inject_frida),
-      'xtfs':dict(e=self._engage_tamper_inject_frida_scriptdir, n='xtfs[!] [path]', d='engage; inject frida gadget in script dir mode'),
-      'xtfs!':dict(e=self._engage_tamper_inject_frida_scriptdir),
-      'xtn':dict(e=self._engage_tamper_disable_pinning, n='xtn', d='engage: patch NSC to disable SSL/TLS pinning'),
-      'xtd':dict(e=self._engage_tamper_enable_debug, n='xtd', d='engage: make debuggable'),
-      'xtb':dict(e=self._engage_tamper_enable_backup, n='xtb', d='engage: make backupable'),
-      'xtt':dict(e=self._engage_tamper_patch_target_api_level, n='xtt[!] <api level>', d='engage: patch target api level'),
-      'xtt!':dict(e=self._engage_tamper_patch_target_api_level),
-      'xco':dict(e=self._engage_device_copyout, n='xco[!] package [data.tar]', d='engage: copy-out package data'),
-      'xco!':dict(e=self._engage_device_copyout),
-      'xci':dict(e=self._engage_device_copyin, n='xci[!] package [data.tar]', d='engage: copy-in package data'),
-      'xci!':dict(e=self._engage_device_copyin),
-      'xpd':dict(e=self._engage_deploy_package, n='xpd[!]', d='engage: deploy target package'),
-      'xpd!':dict(e=self._engage_deploy_package),
-      'xpu':dict(e=self._engage_undeploy_package, n='xpu', d='engage: remove target package'),
-      'xz':dict(e=self._engage_fuzz_intent, n='xz[!] "am-cmdline-template" [output.txt]', d='engage: fuzz intent'),
-      'xz!':dict(e=self._engage_fuzz_intent),
-      'xzr':dict(e=self._engage_fuzz_command, n='xzr[!] "cmdline-template" [output.txt]', d='engage: fuzz cmdline'),
-      'xzr!':dict(e=self._engage_fuzz_command),
-      'xg':dict(e=self._engage_grab_package, n='xg[!] package [output.apk]', d='engage: grab package'),
-      'xg!':dict(e=self._engage_grab_package),
+      'xtq':dict(e=self._engage_tamper_discard, n='xtq', d='engage: discard changes', t={'apk'}),
+      'xtx':dict(e=self._engage_tamper_apply, n='xtx[!]', d='engage: apply and rebuild apk', t={'apk'}),
+      'xtx!':dict(e=self._engage_tamper_apply, t={'apk'}),
+      'xtf':dict(e=self._engage_tamper_inject_frida, n='xtf[!] [config]', d='engage; inject frida gadget', t={'apk'}),
+      'xtf!':dict(e=self._engage_tamper_inject_frida, t={'apk'}),
+      'xtfs':dict(e=self._engage_tamper_inject_frida_scriptdir, n='xtfs[!] [path]', d='engage; inject frida gadget in script dir mode', t={'apk'}),
+      'xtfs!':dict(e=self._engage_tamper_inject_frida_scriptdir, t={'apk'}),
+      'xtn':dict(e=self._engage_tamper_disable_pinning, n='xtn', d='engage: patch NSC to disable SSL/TLS pinning', t={'apk'}),
+      'xtd':dict(e=self._engage_tamper_enable_debug, n='xtd', d='engage: make debuggable', t={'apk'}),
+      'xtb':dict(e=self._engage_tamper_enable_backup, n='xtb', d='engage: make backupable', t={'apk'}),
+      'xtt':dict(e=self._engage_tamper_patch_target_api_level, n='xtt[!] <api level>', d='engage: patch target api level', t={'apk'}),
+      'xtt!':dict(e=self._engage_tamper_patch_target_api_level, t={'apk'}),
+      'xco':dict(e=self._engage_device_copyout, n='xco[!] package [data.tar]', d='engage: copy-out package data', t={'apk'}),
+      'xco!':dict(e=self._engage_device_copyout, t={'apk'}),
+      'xci':dict(e=self._engage_device_copyin, n='xci[!] package [data.tar]', d='engage: copy-in package data', t={'apk'}),
+      'xci!':dict(e=self._engage_device_copyin, t={'apk'}),
+      'xpd':dict(e=self._engage_deploy_package, n='xpd[!]', d='engage: deploy target package', t={'apk'}),
+      'xpd!':dict(e=self._engage_deploy_package, t={'apk'}),
+      'xpu':dict(e=self._engage_undeploy_package, n='xpu', d='engage: remove target package', t={'apk'}),
+      'xz':dict(e=self._engage_fuzz_intent, n='xz[!] "am-cmdline-template" [output.txt]', d='engage: fuzz intent', t={'apk'}),
+      'xz!':dict(e=self._engage_fuzz_intent, t={'apk'}),
+      'xzr':dict(e=self._engage_fuzz_command, n='xzr[!] "cmdline-template" [output.txt]', d='engage: fuzz cmdline', t={'apk'}),
+      'xzr!':dict(e=self._engage_fuzz_command, t={'apk'}),
+      'xg':dict(e=self._engage_grab_package, n='xg[!] package [output.apk]', d='engage: grab package', t={'apk'}),
+      'xg!':dict(e=self._engage_grab_package, t={'apk'}),
+      'xs':dict(e=self._engage_frida_start_server, n='xs[!] [config]', d='engage: start frida-server (!: force)', t={'apk'}),
+      'xs!':dict(e=self._engage_frida_start_server, t={'apk'}),
+      'xk':dict(e=self._engage_frida_kill_server, n='xk', d='engage: kill frida server', t={'apk'}),
     }
 
   def get_options(self) -> OptionMap:
     return {
-      'vers':dict(n='vers=X.Y.Z', d='specify frida-gadget version to use [xf,xfs]'),
-      'w':dict(n='wNAME=FN', d='wordlist, use as {NAME} [xz]'),
+      'vers':dict(n='vers=X.Y.Z', d='specify frida-gadget version to use [xf,xfs]', t={'apk'}),
+      'w':dict(n='wNAME=FN', d='wordlist, use as {NAME} [xz]', t={'apk'}),
     }
 
   async def _engage_tamper_discard(self, args: deque[str]) -> None:
@@ -84,6 +87,10 @@ class EngageCommand(CommandMixin):
     from trueseeing.core.android.asm import APKAssembler
     from trueseeing.core.android.tools import move_apk
 
+    if apk.endswith('.xapk'):
+      ui.warn('patching xapk as merged apk')
+      apk = apk.replace('.xapk', '.apk')
+
     origapk = apk.replace('.apk', '.apk.orig')
 
     if os.path.exists(origapk) and not cmd.endswith('!'):
@@ -509,6 +516,7 @@ class EngageCommand(CommandMixin):
     ui.info(f'copying out: {target} -> {outfn}')
 
     import time
+    from shlex import quote
     from subprocess import CalledProcessError
     from trueseeing.core.tools import invoke_passthru
     from trueseeing.core.android.device import AndroidDevice
@@ -527,7 +535,7 @@ class EngageCommand(CommandMixin):
           with toolchains() as tc:
             await invoke_passthru('java -jar {abe} unpack {outfn}.ab {outfn} 1'.format(
               abe=tc['abe'],
-              outfn=outfn,
+              outfn=quote(outfn),
             ))
         except CalledProcessError:
           ui.warn('unpack failed (did you give the correct password?); trying the next method')
@@ -556,18 +564,18 @@ class EngageCommand(CommandMixin):
 
         tfn0 = self._generate_tempfilename_for_device()
         ui.info('copying internal storage')
-        await dev.invoke_adb_passthru(f'shell "run-as {target} tar -cv . > {tfn0}"')
-        await dev.invoke_adb_passthru(f'pull {tfn0} {outfn0}')
+        await dev.invoke_adb_passthru(f"shell 'run-as {target} tar -cv . > {tfn0}'")
+        await dev.invoke_adb_passthru(f'pull {tfn0} {quote(outfn0)}')
         await dev.invoke_adb_passthru(f'shell rm -f {tfn0}')
         ui.success(f'copied out: {outfn0}')
 
         ui.info('copying external storage')
         tfn1 = self._generate_tempfilename_for_device()
         try:
-          await dev.invoke_adb_passthru(f'shell "cd /storage/emulated/0/Android/ && tar -cv data/{target} obb/{target} > {tfn1}"')
+          await dev.invoke_adb_passthru(f"shell 'cd /storage/emulated/0/Android/ && tar -cv data/{target} obb/{target} > {tfn1}'")
         except CalledProcessError:
           ui.warn('detected errors during extraction from external storage (may indicate partial extraction)')
-        await dev.invoke_adb_passthru(f'pull {tfn1} {outfn1}')
+        await dev.invoke_adb_passthru(f'pull {tfn1} {quote(outfn1)}')
         await dev.invoke_adb_passthru(f'shell rm -f {tfn1}')
         ui.success(f'copied out: {outfn1}')
 
@@ -602,6 +610,7 @@ class EngageCommand(CommandMixin):
     ui.info(f'copying in: {fn} -> {target}')
 
     import time
+    from shlex import quote
     from subprocess import CalledProcessError
     from trueseeing.core.tools import invoke_passthru
     from trueseeing.core.android.device import AndroidDevice
@@ -621,14 +630,14 @@ class EngageCommand(CommandMixin):
             with toolchains() as tc:
               await invoke_passthru('java -jar {abe} pack-kk {fn} {fn}.ab 1'.format(
                 abe=tc['abe'],
-                fn=fn,
+                fn=quote(fn),
               ))
           except CalledProcessError:
             ui.warn('pack failed; trying the next method')
           else:
             ui.success('pack success')
             ui.info('initiating a restore on device; give "1" as the password if asked')
-            await dev.invoke_adb_passthru(f'restore {fn}.ab')
+            await dev.invoke_adb_passthru(f'restore {quote(fn)}.ab')
             ui.success(f'copied in: {fn}')
             success = True
         finally:
@@ -645,21 +654,21 @@ class EngageCommand(CommandMixin):
 
         ui.info('copying internal storage')
         if not os.path.exists(fn0):
-          ui.warn('data not found: {fn0}')
+          ui.warn(f'data not found: {fn0}')
         else:
           tfn0 = self._generate_tempfilename_for_device()
-          await dev.invoke_adb_passthru(f'push {fn0} {tfn0}')
-          await dev.invoke_adb_passthru(f'shell "run-as {target} tar -xv < {tfn0}; rm -f {tfn0}"')
+          await dev.invoke_adb_passthru(f'push {quote(fn0)} {tfn0}')
+          await dev.invoke_adb_passthru(f"shell 'run-as {target} tar -xv < {tfn0}; rm -f {tfn0}'")
           ui.success(f'copied in: {fn}')
           success = True
 
         ui.info('copying external storage')
         if not os.path.exists(fn1):
-          ui.warn('data not found: {fn1}')
+          ui.warn(f'data not found: {fn1}')
         else:
           tfn1 = self._generate_tempfilename_for_device()
-          await dev.invoke_adb_passthru(f'push {fn1} {tfn1}')
-          await dev.invoke_adb_passthru(f'shell "cd /storage/emulated/0/Android/ && tar -xv < {tfn1}; rm -f {tfn1}"')
+          await dev.invoke_adb_passthru(f'push {quote(fn1)} {tfn1}')
+          await dev.invoke_adb_passthru(f"shell 'cd /storage/emulated/0/Android/ && tar -xv < {tfn1}; rm -f {tfn1}'")
           ui.success(f'copied in: {fn1}')
           success = True
 
@@ -775,6 +784,7 @@ class EngageCommand(CommandMixin):
     apk = context.target
 
     from time import time
+    from shlex import quote
     from pubsub import pub
     from trueseeing.core.ui import AndroidInstallProgressReporter
     from trueseeing.core.android.device import AndroidDevice
@@ -798,7 +808,7 @@ class EngageCommand(CommandMixin):
     with AndroidInstallProgressReporter().scoped():
       pub.sendMessage('progress.android.adb.begin', what='installing ... ')
       try:
-        async for l in dev.invoke_adb_streaming(f'install --no-streaming {apk}', redir_stderr=True):
+        async for l in dev.invoke_adb_streaming(f'install --no-streaming {quote(apk)}', redir_stderr=True):
           pub.sendMessage('progress.android.adb.update')
           if b'failure' in l.lower():
             ui.stderr('')
@@ -907,7 +917,7 @@ class EngageCommand(CommandMixin):
             ui.warn('target has only one slice; using apk format')
             outfn = outfn.replace('.xapk', '.apk')
           ui.info('getting {nr} slice'.format(nr=len(splits)))
-          await dev.invoke_adb('pull {path}/base.apk {outfn}'.format(path=quote(basepath.decode()), outfn=outfn))
+          await dev.invoke_adb('pull {path}/base.apk {outfn}'.format(path=quote(basepath.decode()), outfn=quote(outfn)))
         else:
           if outfn.endswith('.apk'):
             ui.warn('target has multiple slices; using xapk format')
@@ -949,6 +959,58 @@ class EngageCommand(CommandMixin):
     assert manifest is not None
     return ET.tostring(manifest) # type: ignore[no-any-return]
 
+  async def _engage_frida_start_server(self, args: deque[str]) -> None:
+    cmd = args.popleft()
+    context: APKContext = self._helper.get_context().require_type('apk')
+
+    pkg = context.get_package_name()
+    scripts = list(args)
+
+    force = cmd.endswith('!')
+
+    ui.info("starting frida-server")
+
+    from time import time
+    from shlex import quote
+    from trueseeing.core.android.device import AndroidDevice
+    from trueseeing.core.tools import invoke_passthru
+    from pathlib import Path
+
+    at = time()
+    dev = AndroidDevice()
+
+    if force:
+      ui.warn("killing frida-server if any")
+      await dev.invoke_adb("shell 'killall frida-server || exit 0'")
+    await dev.invoke_adb("shell 'cd /data/local/tmp && ./frida-server &'")
+
+    ui.info(f"starting frida on {pkg}")
+    scripts_str = []
+    for s in scripts:
+      p = Path(s)
+      if p.is_file():
+        scripts_str.append(f"-l {quote(str(p))}")
+      elif p.is_dir():
+        scripts_str.extend([f"-l {quote(str(m))}" for m in p.rglob('*.js')])
+      else:
+        ui.warn(f"ignoring unknown path: {p}")
+    await invoke_passthru(f"frida -U {pkg} {' '.join(scripts_str)}")
+
+    ui.success("done ({t:.2f} sec.)".format(t=time() - at))
+
+  async def _engage_frida_kill_server(self, args: deque[str]) -> None:
+    from time import time
+    from trueseeing.core.android.device import AndroidDevice
+
+    ui.info("killing frida-server")
+
+    at = time()
+    dev = AndroidDevice()
+
+    await dev.invoke_adb('shell killall frida-server')
+
+    ui.success("done ({t:.2f} sec.)".format(t=time() - at))
+
 class InvalidResponseError(Exception):
   pass
 

{trueseeing-2.2.4 → trueseeing-2.2.5}/trueseeing/app/cmd/android/recon.py

@@ -44,7 +44,9 @@ class ReconCommand(CommandMixin):
       'rwl!':dict(e=self._recon_watch_logcat),
       'rwf':dict(e=self._recon_watch_fs, n='rwf', d='recon: watch filesystem'),
       'rwt':dict(e=self._recon_watch_intent, n='rwt[!] [pat]', d='recon: watch intent'),
+      'rwt!':dict(e=self._recon_watch_intent),
       'rwu':dict(e=self._recon_watch_ui, n='rwu[!] [pat|xp:xpath] [output.xml]', d='recon: watch device UI'),
+      'rwu!':dict(e=self._recon_watch_ui),
       'rwx':dict(e=self._recon_watch_start, n='rwx', d='recon: start watching'),
       'rp':dict(e=self._recon_list_packages, n='rp', d='recon: list installed packages'),
       'ru':dict(e=self._recon_dump_ui, n='ru [output.xml]', d='recon: dump device UI'),
@@ -140,13 +142,15 @@ class ReconCommand(CommandMixin):
       ui.fatal('nothing to watch (try d* beforehand)')
 
     dev = AndroidDevice()
-    ctx = self._get_apk_context()
-    pkg = ctx.get_package_name()
+    pkg: Optional[str] = None
+    if self._target_only:
+      ctx = self._get_apk_context()
+      pkg = ctx.get_package_name()
 
     async def _log() -> None:
       pid: Optional[int] = None
       if self._watch_logcat or self._watch_intent:
-        if not pid:
+        if pkg and not pid:
           d = await dev.invoke_adb('shell ps')
           m = re.search(r'^[0-9a-zA-Z_]+ +([0-9]+) .*{}$'.format(pkg).encode(), d.encode(), re.MULTILINE)
           if m:
@@ -155,7 +159,7 @@ class ReconCommand(CommandMixin):
 
         async for l in dev.invoke_adb_streaming('logcat -T1'):
           l = l.rstrip()
-          if not pid:
+          if pkg and not pid:
             m = re.search(r' ([0-9]+):{}'.format(pkg).encode(), l)
             if m:
               pid = int(m.group(1))
@@ -264,7 +268,7 @@ class ReconCommand(CommandMixin):
       if not m:
         raise DumpFailedError(msg)
       tmpfn = m.group(1)
-      return await dev.invoke_adb(f'shell "cat {tmpfn}; rm {tmpfn}"')
+      return await dev.invoke_adb(f"shell 'cat {tmpfn}; rm {tmpfn}'")
     except CalledProcessError as e:
       raise DumpFailedError(e)
 
@@ -272,11 +276,11 @@ class ReconCommand(CommandMixin):
     from subprocess import CalledProcessError
     dev = AndroidDevice()
     try:
-      async for msg in dev.invoke_adb_streaming(r'shell "while (true) do uiautomator dump /sdcard/dump-\$(date +%s).xml; sleep {delay}; done"'.format(delay=delay)):
+      async for msg in dev.invoke_adb_streaming(r"shell 'while (true) do uiautomator dump /sdcard/dump-$(date +%s).xml; sleep {delay}; done'".format(delay=delay)):
         m = re.search(r'dumped to: (/.*)', msg.decode())
         if m:
           tmpfn = m.group(1)
-          yield await dev.invoke_adb(f'shell "cat {tmpfn}; rm {tmpfn}"')
+          yield await dev.invoke_adb(f"shell 'cat {tmpfn}; rm {tmpfn}'")
     except CalledProcessError as e:
       raise DumpFailedError(e)
 
@@ -288,7 +292,7 @@ class ReconCommand(CommandMixin):
 
     dev = AndroidDevice()
     try:
-      async for msg in dev.invoke_adb_streaming(r'shell "while (true) do (find -H /storage -mtime -{thres}s -print0 | xargs -0 ls -nlld); echo \"*\"; sleep {delay}; done"'.format(delay=delay, thres=int(delay*3.))):
+      async for msg in dev.invoke_adb_streaming(r"shell 'while (true) do (find -H /storage -mtime -{thres}s -print0 | xargs -0 ls -nlld); echo \"*\"; sleep {delay}; done'".format(delay=delay, thres=int(delay*3.))):
         msg = msg.rstrip()
         if not msg.startswith(b'*'):
           m = re.fullmatch(r'(.*00) (.+?)'.encode('latin1'), msg)

{trueseeing-2.2.4 → trueseeing-2.2.5}/trueseeing/app/cmd/android/search.py

@@ -20,14 +20,14 @@ class SearchCommand(CommandMixin):
 
   def get_commands(self) -> CommandMap:
     return {
-      '/c':dict(e=self._search_call, n='/c [pat]', d='search call for pattern'),
-      '/k':dict(e=self._search_const, n='/k insn [pat]', d='search consts for pattern'),
-      '/p':dict(e=self._search_put, n='/p[i] [pat]', d='search s/iputs for pattern'),
-      '/dp':dict(e=self._search_defined_package, n='/dp [pat]', d='search packages matching pattern'),
-      '/dc':dict(e=self._search_defined_class, n='/dc [pat]', d='search classes matching pattern'),
-      '/dcx':dict(e=self._search_derived_class, n='/dcx classpat [methpat]', d='search classes defining methods and extending ones matching patterns'),
-      '/dci':dict(e=self._search_implementing_class, n='/dci ifacepat [methpat]', d='search classes defining methods and implementing interfaces matching patterns'),
-      '/dm':dict(e=self._search_defined_method, n='/dm pat', d='search classes defining methods matching pattern'),
+      '/c':dict(e=self._search_call, n='/c [pat]', d='search call for pattern', t={'apk'}),
+      '/k':dict(e=self._search_const, n='/k insn [pat]', d='search consts for pattern', t={'apk'}),
+      '/p':dict(e=self._search_put, n='/p[i] [pat]', d='search s/iputs for pattern', t={'apk'}),
+      '/dp':dict(e=self._search_defined_package, n='/dp [pat]', d='search packages matching pattern', t={'apk'}),
+      '/dc':dict(e=self._search_defined_class, n='/dc [pat]', d='search classes matching pattern', t={'apk'}),
+      '/dcx':dict(e=self._search_derived_class, n='/dcx classpat [methpat]', d='search classes defining methods and extending ones matching patterns', t={'apk'}),
+      '/dci':dict(e=self._search_implementing_class, n='/dci ifacepat [methpat]', d='search classes defining methods and implementing interfaces matching patterns', t={'apk'}),
+      '/dm':dict(e=self._search_defined_method, n='/dm pat', d='search classes defining methods matching pattern', t={'apk'}),
     }
 
   async def _search_call(self, args: deque[str]) -> None:

{trueseeing-2.2.4 → trueseeing-2.2.5}/trueseeing/app/cmd/android/show.py

@@ -26,10 +26,10 @@ class ShowCommand(CommandMixin):
 
   def get_commands(self) -> CommandMap:
     return {
-      'pd':dict(e=self._show_disasm, n='pd qualname', d='show disassembled class/method'),
-      'pk':dict(e=self._show_solved_constant, n='pk[!] 0xaddr index', d='guess and show what constant would flow into the index-th arg of op (!: try harder)'),
-      'pk!':dict(e=self._show_solved_constant),
-      'pt':dict(e=self._show_solved_typeset, n='pt 0xaddr index', d='guess and show what type would flow into the index-th arg of op'),
+      'pd':dict(e=self._show_disasm, n='pd qualname', d='show disassembled class/method', t={'apk'}),
+      'pk':dict(e=self._show_solved_constant, n='pk[!] 0xaddr index', d='guess and show what constant would flow into the index-th arg of op (!: try harder)', t={'apk'}),
+      'pk!':dict(e=self._show_solved_constant, t={'apk'}),
+      'pt':dict(e=self._show_solved_typeset, n='pt 0xaddr index', d='guess and show what type would flow into the index-th arg of op', t={'apk'}),
     }
 
   async def _show_disasm(self, args: deque[str]) -> None:
@@ -75,7 +75,7 @@ class ShowCommand(CommandMixin):
 
     limit = self._helper.get_graph_size_limit(self._helper.get_modifiers(args))
 
-    from trueseeing.core.android.analysis.flow import DataFlow
+    from trueseeing.core.android.analyze.flow import DataFlow
     with DataFlow.apply_max_graph_size(limit):
       context = await self._helper.get_context().require_type('apk').analyze()
       store = context.store()
@@ -112,7 +112,7 @@ class ShowCommand(CommandMixin):
 
     limit = self._helper.get_graph_size_limit(self._helper.get_modifiers(args))
 
-    from trueseeing.core.android.analysis.flow import DataFlow
+    from trueseeing.core.android.analyze.flow import DataFlow
     with DataFlow.apply_max_graph_size(limit):
       context = await self._helper.get_context().require_type('apk').analyze()
       store = context.store()