Package: smalisca
Static Code Analysis for SmaliIf you ever have looked at Android applications you know to appreciate
the ability of analyzing your target at the most advanced level. Dynamic
program analysis will give you a pretty good overview of your applications
activities and general behaviour. However sometimes you’ll want to just
analyze your applicationwithoutrunning it. You’ll want to have a look
at its components, analyze how they interact and how data is tainted
from one point to another.This is was the major factor driving the development ofsmalisca. There
are indeed some good reasons for astatic code analysisbefore thedynamicone. Before interacting with the application I like to know
how the application has been build, if there is any API and generate all
sort ofcall flow graphs. In fact graphs have been very important to
me since theyvisualizethings. Instead of jumping from file to file,
from class to class, I just look at the graphs.While graph building has been an important reason for me to code such a
tool,smaliscahas some other neatfeaturesyou should read about.FeaturesAt the moment there are some few major functionalities like:parsingYou can parse a whole directory ofSmalifiles andextract:class informationclass propertiesclass methodscalls between methods of different classesYou can thenexportthe results asJSONorSQLite.Have a loot at theparsing pagefor more information.analyzingAfter exporting the results you’ll get aninteractive promptto take
a closer look at your parsed data. You cansearchfor classes, properties,
methods and even method calls. You can then apply severalfiltersto your search
criterias like:smalisca> sc -c class_name -p test -r 10 -x path -s class_typeThis command will search for10(-r 10) classes which contain the patterntest(-p)
in theirclass name(-c). Afterwards  the command will exclude the columnpath(-x path) from the results and sort them by theclass type(-s).Let’s have a look at another example:smalisca> scl -fc com/android -fm init -r 10This will search for allmethod callswhosecallingclass name contains the patterncom/android(-fc). Additionally we can look for calls originating from methods whose
name contain the patterninit(-fm).You can of course read your commands from a file and analyze your results in abatch-
like manner:$ cat cmd.txt
sc -c class_name -p com/gmail/xlibs -r 10 -x path
quit
$ ./smalisca.py analyzer -i results.sqlite -f sqlite -c cmd.txt
...Have a loot at theanalysis pagefor more information.web APIsmalisca provides a REST web service in order to easily interact with the results by just using
a web client. This way you can access data in your own (fancy) web application and have a clean
separation between backend and frontend.Read more about the available REST API at theweb API page.visualizingI think this themostvaluable feature ofsmalisca. The ability to visualize your
results in a structured way makes your life more comfortable. Depending on what you’re
interested in, this tool has several graph drawing features I’d like to promote.At first you can draw your packages including their classes, properties and methods:smalisca> dc -c class_name -p test -f dot -o /tmp/classes.dot
:: INFO       Wrote results to /tmp/classes.dot
smalisca>This will first search classes whose class name containstestand then export the
results in theGraphviz DOTlanguage. You can then manually generate a graph usingdot,neato,circoetc. Or you do that using the interactive prompt:smalisca> dc -c class_name -p test -f pdf -o /tmp/classes.pdf --prog neato
:: INFO       Wrote results to /tmp/classes.pdf
smalisca>Have a loot at thedrawing pagefor more information.ScreenshotsOutput results as table.Basic relationships between classes and modules.Have a look at thescreenshots page.InstallationRefer to theinstallation page.
Requirements:Python (2.x / 3.x)cementGraphvizSQLAlchemyHow to use itAfter installing the tool, you may want to first pick up an Android application (APK)
to play with. Useapktoolor my own toolADUSto dump the APKs content. For the sake of
simplicity I’ll be usingFakeBankerwhich I’ve analyzed in a previousblogpost.First touchBut first let’s have a look at the tools main options:$ smalisca --help

                           /\_ \    __
  ____    ___ ___      __  \//\ \  /\_\    ____    ___     __
 /',__\ /' __` __`\  /'__`\  \ \ \ \/\ \  /',__\  /'___\ /'__`\
/\__, `\/\ \/\ \/\ \/\ \L\.\_ \_\ \_\ \ \/\__, `\/\ \__//\ \L\.\_
\/\____/\ \_\ \_\ \_\ \__/.\_\/\____\\ \_\/\____/\ \____\ \__/.\_\
 \/___/  \/_/\/_/\/_/\/__/\/_/\/____/ \/_/\/___/  \/____/\/__/\/_/


--------------------------------------------------------------------------------
:: Author:       Victor <Cyneox> Dorneanu
:: Desc:         Static Code Analysis tool for Smali files
:: URL:          http://nullsecurity.net, http://{blog,www}.dornea.nu
:: Version:      0.2
--------------------------------------------------------------------------------

usage: smalisca (sub-commands ...) [options ...] {arguments ...}

[--] Static Code Analysis (SCA) tool for Baskmali (Smali) files.

commands:

  analyzer
    [--] Analyze results using an interactive prompt or on the command line.

  parser
    [--] Parse files and extract data based on Smali syntax.

  web
    [--] Analyze results using web API.

optional arguments:
  -h, --help            show this help message and exit
  --debug               toggle debug output
  --quiet               suppress all output
  --log-level {debug,info,warn,error,critical}
                        Change logging level (Default: info)
  -v, --version         show program's version number and exitParsingI’ll firstparsesome directory forSmalifiles before doing the analysis stuff:$ smalisca parser -l ~/tmp/FakeBanker2/dumped/smali -s java -f sqlite  -o fakebanker.sqlite

...

:: INFO       Parsing .java files in /home/victor/tmp/FakeBanker2/dumped/smali ...
:: INFO       Finished parsing!
:: INFO       Exporting results to SQLite
:: INFO         Extract classes ...
:: INFO         Extract class properties ...
:: INFO         Extract class methods ...
:: INFO         Extract calls ...
:: INFO         Commit changes to SQLite DB
:: INFO         Wrote results to fakebanker.sqlite
:: INFO       Finished scanningAlso have a look at theparsing pagefor further information.AnalyzingNow you’re free to do whatever you want with your generated exports. You can inspect theSQLite DBdirectly or usesmaliscasanalysisfeatures:$ smalisca analyzer -f sqlite -i fakebanker.sqlite

...


smalisca>sc -x path -r 10
+----+-----------------------------------------------------------------------------------------+--------------------+--------------------------+-------+
| id | class_name                                                                              | class_type         | class_package            | depth |
+----+-----------------------------------------------------------------------------------------+--------------------+--------------------------+-------+
| 1  | Landroid/support/v4/net/ConnectivityManagerCompat                                       | public             | Landroid.support.v4.net  | 5     |
| 2  | Landroid/support/v4/view/AccessibilityDelegateCompat$AccessibilityDelegateJellyBeanImpl |                    | Landroid.support.v4.view | 5     |
| 3  | Landroid/support/v4/view/ViewCompat$ViewCompatImpl                                      | interface abstract | Landroid.support.v4.view | 5     |
| 4  | Landroid/support/v4/app/ActivityCompatHoneycomb                                         |                    | Landroid.support.v4.app  | 5     |
| 5  | Landroid/support/v4/app/NoSaveStateFrameLayout                                          |                    | Landroid.support.v4.app  | 5     |
| 6  | Landroid/support/v4/net/ConnectivityManagerCompatHoneycombMR2                           |                    | Landroid.support.v4.net  | 5     |
| 7  | Lcom/gmail/xpack/BuildConfig                                                            | public final       | Lcom.gmail.xpack         | 4     |
| 8  | Landroid/support/v4/app/BackStackRecord$Op                                              | final              | Landroid.support.v4.app  | 5     |
| 9  | Landroid/support/v4/app/FragmentManagerImpl                                             | final              | Landroid.support.v4.app  | 5     |
| 10 | Landroid/support/v4/app/ShareCompat$ShareCompatImpl                                     | interface abstract | Landroid.support.v4.app  | 5     |
+----+-----------------------------------------------------------------------------------------+--------------------+--------------------------+-------+Also refer to theanalysis pagefor more availablecommandsand options.DrawingPlease refer to thedrawing pagefor full examples.Licensesmaliscahas been released under theMITlicense. Have a look at theLICENSE.rstfile.CreditsThis tool is dedicated toLică. Many thanks also go to:Stephen McAllisterMany thanks for all those hours full of APK debugging and great ideasMy gfThank you very much for your patience and understanding!nullsecurity.netHack the planet!Changelog0.2 (2015-06-22)BugsFixed issue #2Fixed issue #3Fixed issue described in pull #5ParsingAdded concurrency to the parserYou can specify by “-j” the number of jobs/workersHave a look at thisblog postConfigurationAdded configuration filesSpecify configuration file by “-c” parameterWeb APIAdded REST API to access the SQLite DBUsehttp://<host>:<port>/api/<table name> to access JSON dataBased onFlaskandFlask Restless0.1 (2015-04-01)GeneralMinor bugsSmall changes related to versioningCreate PyPI packageParserParse for const string (const-string) as wellAnalyzerAdded analyzer command (scs) for const stringsAdded global searchSearch for pattern(s) in tablesAdded MakefileUse make {install, uninstall, clean}0.1-RC1 (2015-03-11)Implemented basic project structureBasic CLI applicationUse cement als stable CLI frameworkAdd basic parsing functionalitiesParse classes, methods, propertiesJSONify resultsNo use of complex regexp (due to performance issues)Add filter functionalitiesSearch for classes, methods, propertiesCreate directed graphs (CFGs)Output resultsJSONDOT (Graphviz)