Package: trueseeing
READMEtrueseeing is a fast, accurate and resillient vulnerability scanner for Android apps.  We operate on the Dalvik VM level -- i.e. we don't care if the target app is obfuscated or not.CapabilityCurrently we can:Automatically scan app for vulnerabilities, reporting in HTML/JSON/text format (see below)Manipulate app for easier analysis: e.g. enabling debug bit, enabling full backup, disabling TLS pinning, manipulating target API level, etc.Examine app for general informationCopy in/out app data through debug interfaceSearch for certain calls/consts/sput/iputDeduce constants/typesets for args of opetc.InstallationContainersNOTE:As of 2.1.9, we are on ghcr.io. (Docker Hub is somewhat deprecated)Requires adbd in the host to control devices.We provide containers so you can use right away as follows; now this is also the recommended way, and the only way if you are on Windows, to run:$ docker run --rm -v $(pwd):/out -v ts2:/cache ghcr.io/alterakey/trueseeingIf you want to run statelessly you omit mounting volume onto /cache (not recommended for day-to-day use though; also see#254):$ docker run --rm -v $(pwd):/out ghcr.io/alterakey/trueseeingWith pipAlternatively, you can install our package with pip as follows. This form of installation might be useful for extensions, as it grants them the greatest freedom. Just remember you need a JRE and Android SDK (optionally; to mess with devices):$ pip install --user trueseeing
$ trueseeingUsageInteractive modeYou can interactively scan/analyze/patch/etc. apps -- making it the ideal choice for manual analysis:$ trueseeing target.apk
[+] trueseeing 2.2.1
ts[target.apk]> ?
...
ts[target.apk]> i                      # show generic information
...
ts[target.apk]> pf AndroidManifest.xml # show manifest file
...
ts[target.apk]> a                      # analyze resources too
...
ts[target.apk]> /s something           # search text
...
ts[target.apk]> as                     # scan
...
[+] done, found 6403 issues (174.94 sec.)
ts[target.apk]> gh report.htmlBatch modeWe accept an inline command (-c) or script file (-i) to run before giving you prompt, as well as quitting right away instead of prompting (-q; we don't require a tty in this mode!).You can use the features to conduct a batch scan, as follows e.g. to dump findings right onto the stderr:$ trueseeing -eqc 'as' target.apkTo generate a report file in HTML format:$ trueseeing -eqc 'as;gh report.html' target.apkTo generate a report file in JSON format:$ trueseeing -eqc 'as;gj report.json' target.apkTo get report generated in stdout, omit filename from finalg*command:$ trueseeing -eqc 'as;gh' target.apk > report.html
$ trueseeing -eqc 'as;gj' target.apk > report.jsonNon-interactive scan mode (deprecated)Traditionally, you can scan apps with the following command line to get findings listed in stderr:$ trueseeing --scan target.apkTo generate a report in HTML format:$ trueseeing --scan --scan-output report.html target.apk
$ trueseeing --scan --scan-report=html --scan-output report.html target.apkTo generate a report in JSON format:$ trueseeing --scan --scan-report=json --scan-output report.json target.apkTo get report generated in stdout, specify '-' as filename:$ trueseeing --scan --scan-output - target.apk > report.html
$ trueseeing --scan --scan-report=html --scan-output - target.apk > report.html
$ trueseeing --scan --scan-report=json --scan-output - target.apk > report.jsonAdvanced UsagesExtensionsYou can write your own commands and signatures as extensions.  Extensions are placed under/ext(containers) or~/.trueseeing2/extensions/(pip) . Alternatively you can distribute your extensions as wheels. We provide type information so you can not only type-check your extensions withmypybut also get a decent assist from IDEs. See the details section for details.BuildYou can build it as follows:$ docker build -t trueseeing https://github.com/alterakey/trueseeing.git#mainTo build wheels you can do withflit, as follows:$ flit buildTo hack it, you need to create a proper build environment. To create one, set up a venv, installflitin there, and have it pull dependencies and validating toolchains; esp.mypyandpflake8.  In short, do something like this:$ git clone https://github.com/alterakey/trueseeing.git wc
$ python3 -m venv wc/.venv
$ source wc/.venv/bin/activate
(.venv) $ pip install flit
(.venv) $ flit install --deps=develop -s
(.venv) $ (... hack ...)
(.venv) $ trueseeing ...                         # to run
(.venv) $ mypy trueseeing && pflake8 trueseeing  # to validate
Success: no issues found in XX source files
(.venv) $ flit build                             # to build (wheel)
(.venv) $ docker build -t trueseeing .           # to build (container)DetailsVulnerability ClassesCurrently we can detect the following class of vulnerabilities, largely ones covered in OWASP Mobile Top 10 - 2016:Improper Platform Usage (M1)DebuggableInadvent publishing of Activities, Services, ContentProviders, BroadcastReceiversInsecure Data (M2)Backupable (i.e. suspectible to the backup attack)Insecure file permissionsLoggingInsecure Commnications (M3)Lack of pinning (i.e. suspictible to the TLS interception attack)Use of cleartext HTTPTamperable WebViewsInsufficient Cryptography (M5)Hardcoded passphrase/secret keysVernum ciphers with static keysUse of the ECB modeClient Code Quality Issues (M7)Reflectable WebViews (i.e. XSSs in such views should be escalatable to remote code executions via JS reflection)Usage of insecure policy on mixed contentsCode Tampering (M8)Hardcoded certificatesReverse Engineering (M9)Lack of obfuscationExtension APIOur extension API lays under thetrueseeing.apipackage. As we provide type information with it, your IDE will assist you when writing your extensions.CommandsTo define new commands, implementtrueseeing.api.Commandand advertise them.The following class will provide a sample command ast, for example:fromtypingimportTYPE_CHECKINGfromtrueseeing.apiimportCommandfromtruseeing.core.uiimportuiifTYPE_CHECKING:fromtrueseeing.apiimportCommandMap,CommandPatternMap,ModifierMap,OptionMap,ConfigMapclassMyCommand(Command):@staticmethoddefcreate()->Command:returnMyCommand()defget_commands(self)->CommandMap:return{'t':dict(e=self._test,n='t',d='sample command')}defget_command_patterns(self)->CommandPatternMap:returndict()defget_modifiers(self)->ModifierMap:returndict()defget_options(self)->OptionMap:returndict()defget_configs(self)->ConfigMap:returndict()asyncdef_test(self)->None:ui.info('hello world')SignaturesTo define new signatures, implementtrueseeing.api.Signatureand advertise them.The following class will provide a sample detector asmy-sig, for example:fromtypingimportTYPE_CHECKINGfromtrueseeing.apiimportSignatureifTYPE_CHECKING:fromtrueseeing.apiimportSignatureMap,ConfigMapclassMySignature(Signature):@staticmethoddefcreate()->Signature:returnMySignature()defget_sigs(self)->SignatureMap:return{'my-sig':dict(e=self._detect,d='sample signature')}defget_configs(self)->ConfigMap:returndict()asyncdef_detect(self)->None:self._helper.raise_issue(self._helper.build_issue(sigid='my-sig',title='hello world',cvss='CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N/',))File FormatsTo define new file formats, firstly implementContexts (ABC) for your formats, then implementtrueseeing.api.FileFormatHandlerto create and return their instances, and advertise them.The following class will provide APK file support under the type namedapk2, for example:fromtypingimportTYPE_CHECKINGfromtrueseeing.apiimportFileFormatHandlerfromtrueseeing.core.android.contextimportAPKContextifTYPE_CHECKING:fromtypingimportOptional,Setfromtrueseeing.apiimportFormatMap,ConfigMapfromtrueseeing.core.contextimportContext,ContextTypeclassMyAPKContext(APKContext):# Use a different context typedef_get_type(self)->Set[ContextType]:return{'apk2'}classAPKFileFormatHandler(FileFormatHandler):@staticmethoddefcreate()->FileFormatHandler:returnAPKFileFormatHandler()defget_formats(self)->FormatMap:return{r'\.apk$':dict(e=self._handle,d='sample file format')}defget_configs(self)->ConfigMap:returndict()def_handle(self,path:str)->Optional[Context]:returnMyAPKContext(path)Then make sure you check for the type of the context in your signatures, making them ignored on unsupported contexts:context=self._helper.get_context().require_type('apk2')Upon successful check,require_type(...)will try to downcast them to appropriate types for your convenience.But by design it works only for known types (currently, theapk).  So if you are defining some detailed interface in your new context classes as we do for theapktype, you need to do a downcast here i.e.:context:MyAPKContext=self._helper.get_context().require_type('apk2')# type:ignore[assignment]Package requirementsExtensions can be either: a) any package placed under/ext(container) or~/.truseeing2/extensions(pip), or b) any installed module named with the prefix oftrueseeing_ext0_.Origin of Project Name?The D&D spell,True Seeing.