Fix build whl file error

BiteFoo · Oct 17, 2021 · 357322d · 357322d
1 parent d6ae15e
commit 357322d
Show file tree

Hide file tree

Showing 83 changed files with 10,221 additions and 38 deletions.
diff --git a/.github/workflows/androyara.yml b/.github/workflows/androyara.yml
@@ -33,6 +33,7 @@ jobs:
         python -m pip install twine
         python -m pip install -r requirements.txt
         python setup.py sdist bdist_wheel
+    
     - name: Get version
       id: get_version
       run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
@@ -48,9 +49,8 @@ jobs:
       with:
           tag_name: ${{ steps.get_version.outputs.VERSION }}
           files: |
-                androyara-release-${{ steps.get_version.outputs.VERSION }}
+                androyara-release-${{ steps.get_version.outputs.VERSION }}-py3-none-any.whl
                 androyara-release-${{ steps.get_version.outputs.VERSION }}.tar.gz
            
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.idea/.gitignore b/.idea/.gitignore
diff --git a/.idea/androyara.iml b/.idea/androyara.iml
diff --git a/.idea/inspectionProfiles/profiles_settings.xml b/.idea/inspectionProfiles/profiles_settings.xml
diff --git a/.idea/misc.xml b/.idea/misc.xml
diff --git a/.idea/modules.xml b/.idea/modules.xml
diff --git a/.idea/vcs.xml b/.idea/vcs.xml
diff --git a/androyara.egg-info/PKG-INFO b/androyara.egg-info/PKG-INFO
@@ -0,0 +1,215 @@
+Metadata-Version: 2.1
+Name: androyara
+Version: 2.0
+Summary: A tool is use to analyzer Android malware
+Home-page: https://github.com/BiteFoo/androyara
+Author: BiteFoo
+Author-email: [email protected]
+License: UNKNOWN
+Description: # Androyara
+
+        [![Androyara](https://img.shields.io/badge/androyara%20versions-2.0-blue)](https://github.com/BiteFoo/androyara)
+        [![license apach-2.0](https://img.shields.io/badge/license%20apach2.0-blue)](https://github.com/BiteFoo/androyara/blob/master/LICENSE-2.0)
+
+        `Androyara` 是基于`python3.7+`开发的`android apk` 分析的工具，主要用于`android`的病毒分析和特征提取，也包括一些其他的信息提取。
+
+        主要功能
+
+        * 读取apk基本信息
+        * 读取AndroidManifest.xml 信息
+        * 搜索Apk/Dex内的字符串，方法，指令，类型
+        * 支持yara
+        * Vt查询功能
+        * APK加固信息 `2021-06-17 add`
+
+        ```shell
+        python3 androyara.py -h
+        usage: androyara.py [options]
+
+        optional arguments:
+          -h, --help            show this help message and exit
+
+        options:
+          {query,search_dex,manifest,apkinfo,search_apk,yara_scan}
+            query               query from VT
+            search_dex          search dex string or method all instructions from dex
+            manifest            Parsing Binary AndroidManifest.xml
+            apkinfo             Apk base info
+            search_apk          search string or method instructions from apk
+            yara_scan           Using yara rule to scan
+
+        ```
+
+        ## 使用方法
+
+        ### 读取apk基本信息
+        要想获取一个apk的基本信息包括
+        * `application`
+        * `MainActivity`
+        * `fingerprint: sha256`
+        * `signed version: V1 V2 V3`
+        * `certification`
+        * `pkgname`
+        * `appName`
+
+        使用如下命令
+        ```shell
+        python3 androyara apkinfo -a samples/aaa.apk -i
+        ```
+        > 增加显示加固信息
+
+        ![packer_info](./img/packer_info.png)
+
+        还可以查看`apk内的文件`，使用如下命令
+        ```shell
+        python3 androyara.py apkinfo -a samples/aaa.apk --zipinfo
+        ```
+        ![apk_info_zipinfo](./img/apk_info_zipinfo.png)
+
+
+        ### 读取AndroidManifest.xml 信息
+        有时候只需要获取`AndroidManifest.xml` 的信息而不需要读取`apk`的全部信息，使用`manifest` 选项可以获取`AndroidManifest.xml`的信息。
+
+
+        **支持AndroidManifest.xml和输入apk来读取**
+        主要输出内容 `包名和四大组件信息`，如下
+
+        ```shell
+        python3 androyara.py  manifest -m samples/AndroidManifest.xml -b
+        ```
+        ![manifest](./img/manifest.png)
+        可以只选择查看`activity` 或者其他的组件信息，**还可以查看所有支持exported 属性的组件** 
+        使用帮助命令
+        ```shell
+        python3 androyara.py  manifest -h
+        ```
+        ![manifest_opt](./img/manifest_opt.png)
+
+        如果想看入口信息，可以使用如下方法
+        ```shell
+        python3 androyara.py  manifest -m samples/AndroidManifest.xml -e 
+        ```
+        ![manifest_entry](./img/manifest_entry.png)
+
+        ###  搜索Apk/Dex内的字符串，方法，指令，类
+        可以通过命令查看`apk` 或者`dex`内的方法和指令，程序内过滤了些`google`的类。
+
+        #### 获取apk内的字符串
+        > 使用正则表达式来做搜索，也可以指定某个字符串搜索
+
+
+        基本使用方式可以查看帮助命令
+        ![search_apk_cmd](./img/search_apk_cmd.png)
+
+        可以通过一个正则表达式或者字符串类搜索，例如这里的`://` 获取包含了如下的字符串
+        ```shell
+        http://
+        https://
+        content://
+        protocol://
+        ```
+        如下
+        ![search_apk_str](./img/search_apk_str.png)
+        或者可以全部输出字符串
+        ![all_str_cmd](./img/all_str_fix.png)
+        ![all_str](./img/all_str.png)
+
+        或者查找是否存在特定的字符串
+
+        ![search_string](./img/search_string.png)
+
+        #### 获取dex内的字符串
+        使用方式同`apk`类似，只需要指定`.dex`即可。
+
+        #### 获取类，方法信息
+        例如要想获取所有的方法和类，可以填入一个`-m '' `的空字符串
+        ![all_class_defs_cmd](./img/all_class_defs_cmd.png)
+        ![all_class_defs](./img/all_class_defs.png)
+        #### 获取指令信息
+        例如这里要`com.nirenr.screencapture.ScreenShot.java -> startVirtual()V`的方法指令，使用如下
+        ![method_ins1](./img/method_ins1.png)
+        有时候同名的方法很多，但是每个方法的签名和类不一样，因此可以通过`-c classname -m method(signature)` 的方式获取，如下是获取 
+        ![method_ins2](./img/method_ins2.png)
+        获取方式
+        ![method_ins4](./img/method_ins4.png)
+        使用上述方法就能获取到对应的指令信息。
+
+        ### 使用yara
+
+        **逆向分析apk**
+        在逆向分析一个`apk`之后为了能查杀出对应的家族会需要写规则来查杀，使用`androyara`可以对感兴趣的字符串和方法指令进行获取并快速写出`yara` 规则。
+
+        首先通过`字符串`的方式查询是否存在特殊的字符串，例如这里查询`://`如下
+        ![search_apk_str](./img/search_apk_str.png)
+
+        从输出的内容中可以看到比较有价值的请求地址，可以作为一个`yara` 的规则。
+
+        接着为了能更准确的查杀对应的病毒，这里逆向分析一下apk后定位一个关键函数，如下
+        ![best_for_her](./img/best_for_her_method.png)
+        这里将这个方法作为主要的特征`shellcode` ，使用如下方式获取指令信息
+        先获取方法签名信息看是否一致
+        ![malware_ins](./img/malware_ins.png)
+        接着获取指令信息
+        ![malware_ins_dump1](./img/malware_ins_dump1.png)
+        最后在`shellcode`中看到输出的结果
+        ![malware_ins_dump2](./img/malware_ins_dump2.png)
+
+        **编写yara规则**
+        ![best_for_her_yara](./img/best_for_her_yara.png)
+        扫描结果
+        ![yara_result](./img/yara_result.png)
+
+        为了能更体现准确性，在测试目录放了`200+`的apk，如下
+        ![samples](./img/samples.png)
+
+        再次扫描后如下
+        ![all_samples](./img/all_samples.png)
+        可以看到准确率还是很好。
+
+        还可以支持`.dex`的方式检测，目的是有些`apk`是加固的，可以通过脱壳后进行查杀，具体查看帮助命令
+        ```shell
+         python androyara.py yara_scan -h
+        ```
+
+        ### VT查询
+        **请将USR_CONFIG_INI设置为指定到user.conf的环境变量**
+        ```shell
+        # windows 
+        set USR_CONFIG_INI=D:\\user.config
+        # Unix 
+        export USR_CONFIG_INI=$HOME/user.config
+        ```
+
+        需要在user.conf 内填写api key
+
+        可以通过命令行查询`vt`结果，如下
+
+        ```shell
+        python3 androyara.py query -s ee70eda8a7f6b209c6bb4780bf2a8a96730c19a78300eb5ec3c25a48e557cb2e
+        ```
+        ![vt_query](./img/vt_query.png)
+
+
+        ## build
+        ```shell
+        pip3 install -r requirements.txt
+        python3 setup.py bdist_wheel
+        pip3 install dist\androyara-version-py3-none-any.whl
+        ```
+
+
+        ## 感谢
+        [androguard](https://github.com/androguard/androguard)
+
+        [malwoverview](https://github.com/alexandreborges/malwoverview/tree/master/malwoverview)
+
+        [yara documents](https://buildmedia.readthedocs.org/media/pdf/yara/latest/yara.pdf)
+
+        [yara python](https://github.com/VirusTotal/yara-python)
+
+Platform: UNKNOWN
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: Apache-2.0
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown

diff --git a/androyara.egg-info/SOURCES.txt b/androyara.egg-info/SOURCES.txt
@@ -0,0 +1,41 @@
+setup.py
+androyara/__init__.py
+androyara/__main__.py
+androyara.egg-info/PKG-INFO
+androyara.egg-info/SOURCES.txt
+androyara.egg-info/dependency_links.txt
+androyara.egg-info/requires.txt
+androyara.egg-info/top_level.txt
+androyara/core/__init__.py
+androyara/core/analysis_apk.py
+androyara/core/apk_packer.py
+androyara/core/apk_parser.py
+androyara/core/axml_parser.py
+androyara/core/dex_parser.py
+androyara/core/yara_matcher.py
+androyara/dex/__init__.py
+androyara/dex/dex_code.py
+androyara/dex/dex_header.py
+androyara/dex/dex_method.py
+androyara/dex/dex_vm.py
+androyara/parser/__init__.py
+androyara/parser/base_parser.py
+androyara/typeinfo/__init__.py
+androyara/typeinfo/public.xml
+androyara/typeinfo/publics.py
+androyara/typeinfo/types.py
+androyara/utils/__init__.py
+androyara/utils/buffer.py
+androyara/utils/mcolor.py
+androyara/utils/utility.py
+androyara/vsbox/__init__.py
+androyara/vsbox/hybird.py
+androyara/vsbox/threatbook.py
+androyara/vsbox/vsbox.py
+androyara/vsbox/vt.py
+test/__init__.py
+test/test_apk.py
+test/test_axml.py
+test/test_dex.py
+test/test_vbox.py
+test/test_virus.py
diff --git a/androyara.egg-info/dependency_links.txt b/androyara.egg-info/dependency_links.txt
@@ -0,0 +1 @@
+
diff --git a/androyara.egg-info/requires.txt b/androyara.egg-info/requires.txt
@@ -0,0 +1,6 @@
+termcolor>=1.1.0
+lxml>=4.6.2
+requests>=2.25.1
+yara>=1.7.7
+asn1crypto>=1.4.0
+androguard>=3.3.5
diff --git a/androyara.egg-info/top_level.txt b/androyara.egg-info/top_level.txt
@@ -0,0 +1,2 @@
+androyara
+test
diff --git a/androyara/__pycache__/__init__.cpython-37.pyc b/androyara/__pycache__/__init__.cpython-37.pyc
diff --git a/androyara/__pycache__/__main__.cpython-37.pyc b/androyara/__pycache__/__main__.cpython-37.pyc
diff --git a/androyara/core/__pycache__/__init__.cpython-37.pyc b/androyara/core/__pycache__/__init__.cpython-37.pyc
diff --git a/androyara/core/__pycache__/apk_packer.cpython-37.pyc b/androyara/core/__pycache__/apk_packer.cpython-37.pyc
diff --git a/androyara/core/__pycache__/apk_parser.cpython-37.pyc b/androyara/core/__pycache__/apk_parser.cpython-37.pyc
diff --git a/androyara/core/__pycache__/axml_parser.cpython-37.pyc b/androyara/core/__pycache__/axml_parser.cpython-37.pyc
diff --git a/androyara/core/__pycache__/yara_matcher.cpython-37.pyc b/androyara/core/__pycache__/yara_matcher.cpython-37.pyc
diff --git a/androyara/dex/__pycache__/__init__.cpython-37.pyc b/androyara/dex/__pycache__/__init__.cpython-37.pyc
diff --git a/androyara/dex/__pycache__/dex_header.cpython-37.pyc b/androyara/dex/__pycache__/dex_header.cpython-37.pyc
diff --git a/androyara/dex/__pycache__/dex_method.cpython-37.pyc b/androyara/dex/__pycache__/dex_method.cpython-37.pyc
diff --git a/androyara/dex/__pycache__/dex_vm.cpython-37.pyc b/androyara/dex/__pycache__/dex_vm.cpython-37.pyc
diff --git a/androyara/parser/__pycache__/__init__.cpython-37.pyc b/androyara/parser/__pycache__/__init__.cpython-37.pyc
diff --git a/androyara/parser/__pycache__/base_parser.cpython-37.pyc b/androyara/parser/__pycache__/base_parser.cpython-37.pyc
diff --git a/androyara/typeinfo/__pycache__/__init__.cpython-37.pyc b/androyara/typeinfo/__pycache__/__init__.cpython-37.pyc
diff --git a/androyara/typeinfo/__pycache__/publics.cpython-37.pyc b/androyara/typeinfo/__pycache__/publics.cpython-37.pyc
diff --git a/androyara/typeinfo/__pycache__/types.cpython-37.pyc b/androyara/typeinfo/__pycache__/types.cpython-37.pyc
diff --git a/androyara/types/public.xml → androyara/typeinfo/public.xml b/androyara/types/public.xml → androyara/typeinfo/public.xml
diff --git a/androyara/utils/__pycache__/__init__.cpython-37.pyc b/androyara/utils/__pycache__/__init__.cpython-37.pyc
diff --git a/androyara/utils/__pycache__/buffer.cpython-37.pyc b/androyara/utils/__pycache__/buffer.cpython-37.pyc
diff --git a/androyara/utils/__pycache__/mcolor.cpython-37.pyc b/androyara/utils/__pycache__/mcolor.cpython-37.pyc
diff --git a/androyara/utils/__pycache__/utility.cpython-37.pyc b/androyara/utils/__pycache__/utility.cpython-37.pyc
diff --git a/androyara/vsbox/__pycache__/__init__.cpython-37.pyc b/androyara/vsbox/__pycache__/__init__.cpython-37.pyc
diff --git a/androyara/vsbox/__pycache__/hybird.cpython-37.pyc b/androyara/vsbox/__pycache__/hybird.cpython-37.pyc
diff --git a/androyara/vsbox/__pycache__/threatbook.cpython-37.pyc b/androyara/vsbox/__pycache__/threatbook.cpython-37.pyc
diff --git a/androyara/vsbox/__pycache__/vsbox.cpython-37.pyc b/androyara/vsbox/__pycache__/vsbox.cpython-37.pyc
diff --git a/androyara/vsbox/__pycache__/vt.cpython-37.pyc b/androyara/vsbox/__pycache__/vt.cpython-37.pyc
diff --git a/androyara/types/__init__py → build/lib/androyara/__init__.py b/androyara/types/__init__py → build/lib/androyara/__init__.py