半自动化Android应用逻辑漏洞挖掘工具Jandroid

该工具要求python 3.4以上版本才能运行，支持apk、dex、system.img、ext4文件解析

项目地址:github

python3 src/jandroid.py -h                                            

----------------------------
          JANDROID
----------------------------

usage: jandroid.py [-h] [-f FOLDER] [-p [{android}]] [-e [{device,ext4,img}]]
                  [-g [{neo4j,visjs,both}]]

A tool for performing pattern matching against applications.

optional arguments:
-h, --help           show this help message and exit
-f FOLDER, --folder FOLDER
                      app分析目录，所以支持应用的批量分析
-p [{android}], --platform [{android}]
                      支持的平台，目前仅支持android平台
-e [{device,ext4,img}], --extract [{device,ext4,img}]
                      支持从连接设备、ext4、system.img中提取应用
-g [{neo4j,visjs,both}], --graph [{neo4j,visjs,both}]
                      支持检测结果的图表显示

它通过定义json模板来标记污点传播路径，比如拥有android.intent.category.BROWSABLE浏览器打开权限的Activity，再查找Landroid/webkit/WebView;->addJavascriptInterface看是否存在JavaScript接口，以判断是否可能存在远程攻击的条件，但这种只能是半自动化辅助，还需要人工进一步确认。

模板示例：

{
   "METADATA": {
       "NAME": "JSbridgeBrowsable"
  },    
   "MANIFESTPARAMS": {
       "BASEPATH": "manifest->application->activity OR manifest->application->activity-alias",
       "SEARCHPATH": {
           "intent-filter": {
               "action": {
                   "LOOKFOR": {
                       "TAGVALUEMATCH": "<NAMESPACE>:name=android.intent.action.VIEW"
                  }
              },
               "category": {
                   "LOOKFOR": {
                       "TAGVALUEMATCH": "<NAMESPACE>:name=android.intent.category.BROWSABLE"
                  }
              },
               "data": {
                   "RETURN": ["<NAMESPACE>:host AS @host", "<NAMESPACE>:scheme AS @scheme"]
              }                
          }
      },
       "RETURN": ["<smali>:<NAMESPACE>:name AS @activity_name"]
  },
   "CODEPARAMS": {
       "SEARCH": {
           "SEARCHFORCALLTOMETHOD": {
               "METHOD": "Landroid/webkit/WebView;->addJavascriptInterface",
               "RETURN": "<class> AS @web_view"
          }
      },
       "TRACE": {
           "TRACEFROM": "<method>:@web_view[]->loadUrl(Ljava/lang/String;)V",
           "TRACETO": "<class>:@activity_name",
           "TRACELENGTHMAX": 10,
           "RETURN": "<tracepath> AS @tracepath_browsablejsbridge"
      }
  },
   "GRAPH": "@tracepath_browsablejsbridge WITH <method>:<desc>:<class> AS attribute=nodename"
}

各字段含义看示例就好了，这里不作详解。读者也可参考F-Secure发的文章，里面有详解。

总结起来，模板支持：

AndroidManifest.xml的匹配搜索
smali代码的匹配搜索
传播路径的图表显示，以及显示的文件格式定义
函数调用参数追踪
函数调用的起点与终点定义、追踪以及追踪深度

我直接找了个apk分析，一运行就出现以下错误：

python3 src/jandroid.py -f ./apps -g visjs
Traceback (most recent call last):File "src/jandroid.py", line 408, in <module>
  inst_jandroid.fn_main()
File "src/jandroid.py", line 227, in fn_main
  self.pull_source
File "/Volumes/Macintosh/Users/riusksk/Android-Security/工具/Jandroid/src/plugins/android/main.py", line 51, in fn_start_plugin_analysis
  app_pull_src
File "/Volumes/Macintosh/Users/riusksk/Android-Security/工具/Jandroid/src/plugins/android/requirements_checker.py", line 53, in fn_perform_initial_checks
  raise JandroidException(
NameError: name 'JandroidException' is not defined

直接在Jandroid/src/plugins/android/requirements_checker.py开头加以下代码即可解决：

from common import JandroidException

运行效果：

python3 src/jandroid.py -f ./apps -g visjs

----------------------------
          JANDROID
----------------------------

INFO     Creating template object.
INFO     1 potential template(s) found.
DEBUG   Parsing /Volumes/Macintosh/Users/riusksk/Android-Security/工具/Jandroid/templates/android/sample_basic_browsable_jsbridge.template
INFO     Initiating Android analysis.
INFO     Performing basic checks. Please wait.
INFO     Basic checks complete.
INFO     Beginning analysis...
DEBUG   1 app(s) to analyse, using 2 thread(s).
DEBUG   Created worker process 0
DEBUG   Created worker process 1
DEBUG   AnalyzeAPK
DEBUG   Analysing without session
INFO     Analysing ctrip.android.view_8.13.0_1248.apk in worker thread 0.
DEBUG   AXML contains a RESOURCE MAP
DEBUG   Start of Namespace mapping: prefix 47: 'android' --> uri 48: 'http://schemas.android.com/apk/res/android'
DEBUG   START_TAG: manifest (line=2)
DEBUG   found an attribute: {http://schemas.android.com/apk/res/android}versionCode='b'1248''
DEBUG   found an attribute: {http://schemas.android.com/apk/res/android}versionName='b'8.13.0''
DEBUG   found an attribute:
......
DEBUG   Settings basic blocks childs
DEBUG   Creating exceptions
DEBUG   Parsing instructions
DEBUG   Parsing exceptions
DEBUG   Creating basic blocks in Landroid/support/constraint/solver/LinearSystem;->createRowDimensionPercent(Landroid/support/constraint/solver/LinearSystem; Landroid/support/constraint/solver/SolverVariable; Landroid/support/constraint/solver/SolverVariable; Landroid/support/constraint/solver/SolverVariable; F Z)Landroid/support/constraint/solver/ArrayRow; [access_flags=public static] @ 0x199210
......
DEBUG   Looking for subclasses of Lctrip/business/map/SimpleOverseaMapActivity;
DEBUG   ctrip.android.view_8.13.0_1248.apk took 349 seconds to analyse.
DEBUG   Finished analysing ctrip.android.view_8.13.0_1248.apk with output {'bug_obj': {'JSbridgeBrowsable': False}, 'graph_list': []}.
INFO     Finished analysing apps.
INFO     Creating custom graph.
INFO     Custom graph can be found at /Volumes/Macintosh/Users/riusksk/Android-Security/工具/Jandroid/output/graph/jandroid.html
INFO     All done.