pxb.android.axml.AxmlVisitor Java Examples

private void checkAndAddComponent(Set<String> entryPoints, AXmlNode node) {
	AXmlAttribute<?> attrEnabled = node.getAttribute("enabled");
	if (attrEnabled == null || !attrEnabled.getValue().equals(Boolean.FALSE)) {
		AXmlAttribute<?> attr = node.getAttribute("name");
		if (attr != null)
			entryPoints.add(expandClassName((String) attr.getValue()));
		else {
			// This component does not have a name, so this might be obfuscated
			// malware. We apply a heuristic.
			for (Entry<String, AXmlAttribute<?>> a : node.getAttributes().entrySet())
				if (a.getValue().getName().isEmpty()
						&& a.getValue().getType() == AxmlVisitor.TYPE_STRING) {
					String name = (String) a.getValue().getValue();
					if (isValidComponentName(name))
						entryPoints.add(expandClassName(name));
				}
		}
	}
}
 

/**
 * Gets the permissions this application requests
 * @return The permissions requested by this application
 * @return
 */
public Set<String> getPermissions() {
	List<AXmlNode> usesPerms = this.manifest.getChildrenWithTag("uses-permission");
	Set<String> permissions = new HashSet<String>();
	for (AXmlNode perm : usesPerms) {
		AXmlAttribute<?> attr = perm.getAttribute("name");
		if (attr != null)
			permissions.add((String) attr.getValue());
		else {
			// The required "name" attribute is missing, so we collect all empty
			// attributes as a best-effort solution for broken malware apps
			for (AXmlAttribute<?> a : perm.getAttributes().values())
				if (a.getType() == AxmlVisitor.TYPE_STRING && a.getName().isEmpty())
					permissions.add((String) a.getValue());
		}
	}
	return permissions;
}
 

private void checkAndAddComponent(Set<String> entryPoints, AXmlNode node) {
	AXmlAttribute<?> attrEnabled = node.getAttribute("enabled");
	if (attrEnabled == null || !attrEnabled.getValue().equals(Boolean.FALSE)) {
		AXmlAttribute<?> attr = node.getAttribute("name");
		if (attr != null)
			entryPoints.add(expandClassName((String) attr.getValue()));
		else {
			// This component does not have a name, so this might be obfuscated
			// malware. We apply a heuristic.
			for (Entry<String, AXmlAttribute<?>> a : node.getAttributes().entrySet())
				if (a.getValue().getName().isEmpty()
						&& a.getValue().getType() == AxmlVisitor.TYPE_STRING) {
					String name = (String) a.getValue().getValue();
					if (isValidComponentName(name))
						entryPoints.add(expandClassName(name));
				}
		}
	}
}
 

/**
 * Gets the permissions this application requests
 * @return The permissions requested by this application
 * @return
 */
public Set<String> getPermissions() {
	List<AXmlNode> usesPerms = this.manifest.getChildrenWithTag("uses-permission");
	Set<String> permissions = new HashSet<String>();
	for (AXmlNode perm : usesPerms) {
		AXmlAttribute<?> attr = perm.getAttribute("name");
		if (attr != null)
			permissions.add((String) attr.getValue());
		else {
			// The required "name" attribute is missing, so we collect all empty
			// attributes as a best-effort solution for broken malware apps
			for (AXmlAttribute<?> a : perm.getAttributes().values())
				if (a.getType() == AxmlVisitor.TYPE_STRING && a.getName().isEmpty())
					permissions.add((String) a.getValue());
		}
	}
	return permissions;
}
 

@Override
public void attr(String ns, String name, int resourceId, int type, Object obj) {
    // Is this the target file attribute?
    String tname = name.trim();
    if (tname.equals("layout")) {
        if (type == AxmlVisitor.TYPE_REFERENCE && obj instanceof Integer) {
            // We need to get the target XML file from the binary manifest
            AbstractResource targetRes = resParser.findResource((Integer) obj);
            if (targetRes == null) {
                logger.trace(Utils.INDENT + "Target resource " + obj + " for layout include not found");
                return;
            }    
            if (!(targetRes instanceof StringResource)) {
                logger.trace(Utils.INDENT + "Invalid target node for include tag in layout XML, was " + targetRes.getClass().getName());
                return;
            }    
            String targetFile = ((StringResource) targetRes).getValue();

            // If we have already processed the target file, we can
            // simply copy the callbacks we have found there
            if (callbackMethods.containsKey(targetFile))
                for (String callback : callbackMethods.get(targetFile))
                    addCallbackMethod(layoutFile, callback);
            else {
                // We need to record a dependency to resolve later
                MapUtils.addToSet(includeDependencies, targetFile, layoutFile);
            }    
        }    
    }    

    super.attr(ns, name, resourceId, type, obj);
}
 

@Override
  public void attr(String ns, String name, int resourceId, int type, Object obj) {
      String tname = name.trim();
if (tname.equals("id") && type == AxmlVisitor.TYPE_REFERENCE)
	this.id = (Integer) obj;

else if ((tname.equals("name") || tname.equals("class") && type == AxmlVisitor.TYPE_STRING && obj instanceof String)) {
	String className = ((String) obj).trim();

	if (className.startsWith(".")) {
		logger.debug("Fragment attr parser::  \"" + tname + "\"  contains leading dot: " + className);
		className = className.substring(1);  // TODO: sometimes the parser adds a leading "."
	}

	// weird we had sth. like "5apperfection.bluebox.ui.fragments.DeviceLinksFragment" although the file included the string "apperfection.bluebox.ui.fragments.DeviceLinksFragment"
	while (!className.substring(0, 1).matches("[a-zA-Z]")) {
		logger.debug("Fragment attr parser::  \"" + tname + "\"  starts with a non-letter character!:  " + className  + "   fixing..");
		className = className.substring(1);
	}
	
      	try {
      		fragmentClazz = WalaUtils.lookupClass(cha, className);
      	} catch (ClassNotFoundException e) {
      		logger.warn("Could not lookup IClass for Fragment " + className);
      	}
      }
 		
      super.attr(ns, name, resourceId, type, obj);
  }
 

@Override
public void attr(String ns, String name, int resourceId, int type, Object obj) {
	// Check that we're actually working on an android attribute
	if (!isAndroidNamespace(ns)) return;

	String tname = name.trim();
	if (tname.equals("id") && type == AxmlVisitor.TYPE_REFERENCE)
	    this.id = (Integer) obj;
	else if (tname.equals("password") && type == AxmlVisitor.TYPE_INT_BOOLEAN)
	    isSensitive = ((Integer) obj) != 0; // -1 for true, 0 for false
	else if (!isSensitive && tname.equals("inputType") && type == AxmlVisitor.TYPE_INT_HEX) {
	    int tp = (Integer) obj;
	    isSensitive = ((tp & TYPE_NUMBER_VARIATION_PASSWORD) == TYPE_NUMBER_VARIATION_PASSWORD)
	    		   || ((tp & TYPE_TEXT_VARIATION_PASSWORD) == TYPE_TEXT_VARIATION_PASSWORD)
	               || ((tp & TYPE_TEXT_VARIATION_VISIBLE_PASSWORD) == TYPE_TEXT_VARIATION_VISIBLE_PASSWORD)
	               || ((tp & TYPE_TEXT_VARIATION_WEB_PASSWORD) == TYPE_TEXT_VARIATION_WEB_PASSWORD);
	}
	else if (isActionListener(tname) && type == AxmlVisitor.TYPE_STRING && obj instanceof String) {
  			String strData = ((String) obj).trim();
  			addCallbackMethod(layoutFile, strData);
  		}
	else {
	    if (type == AxmlVisitor.TYPE_STRING)
	        logger.trace(Utils.INDENT + "Found unrecognized XML attribute:  " + tname);
	}

	super.attr(ns, name, resourceId, type, obj);
}
 

/**
 * Parses the attributes required for a layout file inclusion
 * @param layoutFile The full path and file name of the file being parsed
 * @param rootNode The AXml node containing the attributes
 */
private void parseIncludeAttributes(String layoutFile, AXmlNode rootNode) {
	for (Entry<String, AXmlAttribute<?>> entry : rootNode.getAttributes().entrySet()) {
		String attrName = entry.getKey().trim();
		AXmlAttribute<?> attr = entry.getValue();
		
   		if (attrName.equals("layout")) {
   			if ((attr.getType() == AxmlVisitor.TYPE_REFERENCE || attr.getType() == AxmlVisitor.TYPE_INT_HEX)
   					&& attr.getValue() instanceof Integer) {
   				// We need to get the target XML file from the binary manifest
   				AbstractResource targetRes = resParser.findResource((Integer) attr.getValue());
   				if (targetRes == null) {
   					System.err.println("Target resource " + attr.getValue() + " for layout include not found");
   					return;
   				}
   				if (!(targetRes instanceof StringResource)) {
   					System.err.println("Invalid target node for include tag in layout XML, was "
   							+ targetRes.getClass().getName());
   					return;
   				}
   				String targetFile = ((StringResource) targetRes).getValue();
   				
   				// If we have already processed the target file, we can
   				// simply copy the callbacks we have found there
       			if (callbackMethods.containsKey(targetFile))
       				for (String callback : callbackMethods.get(targetFile))
       					addCallbackMethod(layoutFile, callback);
       			else {
       				// We need to record a dependency to resolve later
       				addToMapSet(includeDependencies, targetFile, layoutFile);
       			}
   			}
   		}
	}
}
 

private static void modifyManifest(final String[] args) {
    try {
        String androidManifestBinXml = args[0];
        needRemoveConflict = args[1].contains("!");
        needRemoveLib = args[1].contains("%");
        newPackageFullName = args[1].replace("!", "").replace("%", "");
        InputStream is = new FileInputStream(androidManifestBinXml);
        byte[] xml = new byte[is.available()];
        is.read(xml);
        is.close();
        AxmlReader ar = new AxmlReader(xml);
        AxmlWriter aw = new AxmlWriter();
        ar.accept(new AxmlVisitor(aw) {
            @Override
            public NodeVisitor child(String ns, String name) {
                return new MyNodeVisitor(super.child(ns, name), name);
            }
        });

        if (changed) {
            byte[] modified = aw.toByteArray();
            FileOutputStream fos = new FileOutputStream(androidManifestBinXml);
            fos.write(modified);
            fos.close();
        }
    } catch (Exception e) {
        e.printStackTrace();
    }

}
 

/**
 * Parses the layout file with the given root node
 * @param layoutFile The full path and file name of the file being parsed
 * @param rootNode The root node from where to start parsing
 */
private void parseLayoutNode(String layoutFile, AXmlNode rootNode) {
	if (rootNode.getTag() == null || rootNode.getTag().isEmpty()) {
		System.err.println("Encountered a null or empty node name "
				+ "in file " + layoutFile + ", skipping node...");
		return;
	}
	
	String tname = rootNode.getTag().trim();
	if (tname.equals("dummy")) {
		// dummy root node, ignore it
	}
	// Check for inclusions
	else if (tname.equals("include")) {
		parseIncludeAttributes(layoutFile, rootNode);
	}
	// The "merge" tag merges the next hierarchy level into the current
	// one for flattening hierarchies.
	else if (tname.equals("merge"))  {
		// do not consider any attributes of this elements, just
		// continue with the children
	}
	else if (tname.equals("fragment"))  {
		final AXmlAttribute<?> attr = rootNode.getAttribute("name");
		if (attr == null)
			System.err.println("Fragment without class name detected");
		else {
			if (attr.getType() != AxmlVisitor.TYPE_STRING)
				System.err.println("Invalid targer resource "+attr.getValue()+"for fragment class value");
			getLayoutClass(attr.getValue().toString());
		}
	}
	else {
		final SootClass childClass = getLayoutClass(tname);
		if (childClass != null && (isLayoutClass(childClass) || isViewClass(childClass)))
			parseLayoutAttributes(layoutFile, childClass, rootNode);
	}

	// Parse the child nodes
	for (AXmlNode childNode : rootNode.getChildren())
		parseLayoutNode(layoutFile, childNode);
}
 

/**
 * Parses the layout attributes in the given AXml node 
 * @param layoutFile The full path and file name of the file being parsed
 * @param layoutClass The class for the attributes are parsed
 * @param rootNode The AXml node containing the attributes
 */
private void parseLayoutAttributes(String layoutFile, SootClass layoutClass, AXmlNode rootNode) {
	boolean isSensitive = false;
	int id = -1;
	
	for (Entry<String, AXmlAttribute<?>> entry : rootNode.getAttributes().entrySet()) {
		String attrName = entry.getKey().trim();
		AXmlAttribute<?> attr = entry.getValue();
		
		// On obfuscated Android malware, the attribute name may be empty
		if (attrName.isEmpty())
			continue;
		
		// Check that we're actually working on an android attribute
		if (!isAndroidNamespace(attr.getNamespace()))
			continue;
		
		// Read out the field data
		if (attrName.equals("id")
				&& (attr.getType() == AxmlVisitor.TYPE_REFERENCE || attr.getType() == AxmlVisitor.TYPE_INT_HEX))
			id = (Integer) attr.getValue();
		else if (attrName.equals("password")) {
			if (attr.getType() == AxmlVisitor.TYPE_INT_HEX)
				isSensitive = ((Integer) attr.getValue()) != 0; // -1 for true, 0 for false
			else if (attr.getType() == AxmlVisitor.TYPE_INT_BOOLEAN)
				isSensitive = (Boolean) attr.getValue();
			else
				throw new RuntimeException("Unknown representation of boolean data type");
		}
		else if (!isSensitive && attrName.equals("inputType") && attr.getType() == AxmlVisitor.TYPE_INT_HEX) {
			int tp = (Integer) attr.getValue();
			isSensitive = ((tp & TYPE_NUMBER_VARIATION_PASSWORD) == TYPE_NUMBER_VARIATION_PASSWORD)
					|| ((tp & TYPE_TEXT_VARIATION_PASSWORD) == TYPE_TEXT_VARIATION_PASSWORD)
					|| ((tp & TYPE_TEXT_VARIATION_VISIBLE_PASSWORD) == TYPE_TEXT_VARIATION_VISIBLE_PASSWORD)
					|| ((tp & TYPE_TEXT_VARIATION_WEB_PASSWORD) == TYPE_TEXT_VARIATION_WEB_PASSWORD);
		}
		else if (isActionListener(attrName)
				&& attr.getType() == AxmlVisitor.TYPE_STRING
				&& attr.getValue() instanceof String) {
			String strData = ((String) attr.getValue()).trim();
			addCallbackMethod(layoutFile, strData);
		}
		else if (attr.getType() == AxmlVisitor.TYPE_STRING && attrName.equals("text")) {
			// To avoid unrecognized attribute for "text" field
		}
		else if (DEBUG && attr.getType() == AxmlVisitor.TYPE_STRING) {
			System.out.println("Found unrecognized XML attribute:  " + attrName);
		}
	}
	
	// Register the new user control
	addToMapSet(this.userControls, layoutFile, new LayoutControl(id, layoutClass, isSensitive));
}