Coder Social home page Coder Social logo

alexmyg / andropytool Goto Github PK

View Code? Open in Web Editor NEW
333.0 333.0 61.0 137.06 MB

A framework for automated extraction of static and dynamic features from Android applications

Python 97.30% Shell 0.21% Dockerfile 2.49%
android-analysis android-malware-detection

andropytool's People

Contributors

alexmyg avatar fabriziopicconi avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

andropytool's Issues

Add Output Directory

Overwriting the location of the APKs is not always ideal. Do you have plans to add an output directory flag, that way we can write the results to a new directory?

Description missing for the -s argument

The -s argument description is duplicated from the -all description above so now there's no instructions on how the flag should be used.

-s SOURCE_FOLDER, --source SOURCE_FOLDER: Executes all steps of AndroPyTool (Recommended). In order to obtain a VirusTotal report, the argument -vt must be also provided followed by a VirusTotal API key. If the -all option is not provided, then only the last step is executed plus the provided arguments.

Issue with Docker run --volume on windows

Hi, everyone...
I just installed docker on my windows 11 machine. in trying to Run AndroPyTool by launching the container, i run the command below using windows cmd:
C:\Users\admin>docker run --volume=C:/apks/APKPure_v3.19.81_apkpure.com.apk/:/apks alexmyg/andropytool -s /apks/ --allsteps

the system returns an error:
Folder not found!
find the attached
myNewIssue

About Automated Process

The analysis of Droidbox is currently not automated except for installing and starting packages. Can AndroPyTool test all functions of an App or a part of them? How can it implement that?

tasks exit with error when running time too long

Hi,
My tasks always exit with error when the running time is longer than 17 minutes (about 1000 seconds) if I use the argument -dr. Is that because there's any timeout mechanism on Droidbox process? How can I solve the problem?

Csv file is not generated properly

Csv generated as a use of argument -fw is filled with only zeros in both rows and columns,whereas when argument -csv EXPORTCSV is used csv file is not generated stating that flowdroid error(screen shot added). please help me
IMG_20191001_185002

Help -docker run command error

Hi,
I am using Ubuntu 16.04.

I ran the below command

docker run --volume=/home/rev_eng/apks:/apks alexmyg/andropytool -s /apks/ -All

I am getting the below error

standard_init_linux.go:207: exec user process caused "exec format error"

Can anyone please provide me some suggestion?

Thank you,

Error feature extraction: unpack requires a string argument of length 8

Hi there,
when I run AndroPyTool in docker with docker run --volume=./test/:/apks alexmyg/andropytool -s /apks/ -fw -f -mg 127.0.0.1:27017 the container crashes at step 7.

The stack trace:

>>>> AndroPyTool -- STEP 7: Execute features extraction

[*] Number of APKs: 1
ANALYSING APKS...
  0%|          | 0/1 [00:00<?, ?it/s]
Traceback (most recent call last):
  File "/root/AndroPyTool/androPyTool.py", line 320, in <module>
    main()
    -> <function main at 0x7ff330158398>
  File "/root/AndroPyTool/androPyTool.py", line 164, in main
    virus_total_api_key=step_analyse_virus_total
                        -> None
  File "/root/AndroPyTool/androPyTool.py", line 316, in execute_andro_py_tool_steps
    export_csv=exportCSV)
  File "/root/AndroPyTool/APT_6_feat_extraction.py", line 223, in features_extractor
    static_analysis_dict['Opcodes'] = opcodes_analysis(androguard_apk_object)
    |                                 |                -> <androguard.core.bytecodes.apk.APK object at 0x7ff33008cc50>
    |                                 -> <function opcodes_analysis at 0x7ff33384ede8>
    -> OrderedDict([('Package name', u'com.android.certinstaller'), ('Permissions', ['android.permission.CHANGE_WIFI_STATE', 'android.p...
  File "/root/AndroPyTool/features_managment.py", line 14, in opcodes_analysis
    dalvik = dvm.DalvikVMFormat(androguard_apk.get_dex())
             |                  -> <androguard.core.bytecodes.apk.APK object at 0x7ff33008cc50>
             -> <module 'androguard.core.bytecodes.dvm' from '/usr/local/lib/python2.7/dist-packages/androguard/core/bytecodes/dvm.pyc'>
  File "/usr/local/lib/python2.7/dist-packages/androguard/core/bytecodes/dvm.py", line 7305, in __init__
    self._load(buff)
    |          -> ''
    -> <androguard.core.bytecodes.dvm.DalvikVMFormat object at 0x7ff33008cd90>
  File "/usr/local/lib/python2.7/dist-packages/androguard/core/bytecodes/dvm.py", line 7311, in _load
    self.__header = HeaderItem(0, self, ClassManager(None, self.config))
    |               |             |     |                  -> <androguard.core.bytecodes.dvm.DalvikVMFormat object at 0x7ff33008cd90>
    |               |             |     -> <class 'androguard.core.bytecodes.dvm.ClassManager'>
    |               |             -> <androguard.core.bytecodes.dvm.DalvikVMFormat object at 0x7ff33008cd90>
    |               -> <class 'androguard.core.bytecodes.dvm.HeaderItem'>
    -> <androguard.core.bytecodes.dvm.DalvikVMFormat object at 0x7ff33008cd90>
  File "/usr/local/lib/python2.7/dist-packages/androguard/core/bytecodes/dvm.py", line 363, in __init__
    self.magic = unpack("=Q", buff.read(8))[0]
    |            |            -> <androguard.core.bytecodes.dvm.DalvikVMFormat object at 0x7ff33008cd90>
    |            -> <built-in function unpack>
    -> <androguard.core.bytecodes.dvm.HeaderItem object at 0x7ff3300b62d0>
error: unpack requires a string argument of length 8

Is there a way to skip this step?

droidbox error

Droidbox analysing error
ANALYSING APKS...
11%|#1 | 1/9 [01:05<08:41, 65.22s/it]Incorrect API calls transcription
Incorrect API calls transcription
Incorrect API calls transcription
Traceback (most recent call last):
File "/root/AndroPyTool/androPyTool.py", line 320, in
main()
-> <function main at 0x7f4659bcd1d0>
File "/root/AndroPyTool/androPyTool.py", line 164, in main
virus_total_api_key=step_analyse_virus_total
-> None
File "/root/AndroPyTool/androPyTool.py", line 316, in execute_andro_py_tool_steps
export_csv=exportCSV)
File "/root/AndroPyTool/APT_6_feat_extraction.py", line 346, in features_extractor
dynamic_analysis_dict[dynamic_tool_name] = json.load(open(dynamic_file_name))
| | | -> '/apks/Dynamic/Droidbox/00001B280911A2CB409F2D9A8799E115D96360E05065E33B2E8415E308AD0EAE.json'
| | -> <module 'json' from '/usr/lib/python2.7/json/init.pyc'>
| -> 'Droidbox'
-> OrderedDict()
File "/usr/lib/python2.7/json/init.py", line 291, in load
**kw)
File "/usr/lib/python2.7/json/init.py", line 339, in loads
return _default_decoder.decode(s)
| -> ''
-> <json.decoder.JSONDecoder object at 0x7f4678cece10>
File "/usr/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
| | | -> ''
| | -> <built-in method match of _sre.SRE_Pattern object at 0x7f4678ce60d0>
| -> ''
-> <json.decoder.JSONDecoder object at 0x7f4678cece10>
File "/usr/lib/python2.7/json/decoder.py", line 382, in raw_decode
raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded

Boot not completed

Hello, I have been trying to run AndroPyTool for over a month now, on and off.
But whenever I reach step 6 which involves DroidBox, it just keeps changing errors, everytime i think it is fixed it still doesnt work, so far it is stuck on boot not completed
image

I am sure that the emulator is working and online, it is also using the port specified in the droidox scripts which is 5554, I have no idea how to fix this.

flowdroid_fields empty

I get an issue when I try to run this framework for feature extraction. Why flowdroid_fields is empty?

flowdroid_fields = apk_dict_example["Static_analysis"]["FlowDroid"].keys()

|						└ OrderedDict([('Pre_static_analysis', OrderedDict([('Filename', 'a.envisionmobile.caa.apk'), ('md5', '31bf2eb9555403d764d8741c9cb...

└ []

	KeyError: 'FlowDroid'

Folder not found.

I cannot get it running :(

Either it says folder not found or 0 apks.

404

Issuse in requirements.txt

please update the version of numpy, pandas and subprocess32. because these libreries are creating issuse during the installation of ruquirements.txt.

Step 6 Problem

image

Hey I need help with step 6

I used the following:
C:\Users\Ali Al-Zaabi>docker run --volume=Y:\benign\apks:/apks alexmyg/andropytool -s /apks -all -vt key

failed to start daemon

When I use command -dr , I encounter a error like following:

  • failed to start daemon *
  • failed to start daemon *
    error: cannot connect to daemon: Connection refused
    error: cannot connect to daemon: Connection refused
    error: cannot connect to daemon: Connection refused
    Waiting until boot is completed
    Boot not completed
    error: device '(null)' not found
    Boot not completed
    error: device '(null)' not found
    Boot not completed
    error: device '(null)' not found
    Boot not completed
    error: device offline
    Boot not completed
    error: device offline

Did I miss something?

"NO JSON object could be decoded" in droidbox

File "/usr/lib/python2.7/json/decoder.py", line 382, in raw_decode
raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded

I am using method_A: docker

boot not completed

getting boot not completed message continuoesly after "Starting emulator
STARTING EMULATOR IN NON GUI MODE...
ADB DEVICE RUNNING " step

The command is not working in windows

I am having docker in my windows 10.It works fine for other docker images (say whalesay) but when it comes to this (alexmyg) image whenever I run it I get an error called 'invalid mode: apks'
1584088804002913738054
.I think it might usage of colon(:) right after the drive name (C:).How can I rectify this problem?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.