plum-umd/redexerThe Redexer binary instrumentation framework for Dalvik bytecode
Redexer is a reengineering tool that manipulates Android app binaries. This tool is able to parse a DEX file into an in-memory data structure; to infer with which parameters the app uses certain permissions (we name this feature RefineDroid); to modify and unparse that data structure to produce an output DEX file (we name these features Dr. Android, which stands for Dalvik Rewriting for Android).
This tool is tested under OCaml 4.09.0 and Ruby 1.8.6(7), so you need to install them (or higher versions of them).
To manipulate a SHA-1 signature (hash) in the DEX format, we utilize OCaml SHA library via ocamlfind/findlib, an OCaml library manager. The easiest way to install both is using OPAM, an OCaml package manager, which has both packages---OPAM ocamlfind and OPAM sha.
You can also build and/or install both packages directly. If you're using a linux machine, you can easily find distributions.
If not, e.g., using a Mac, you need to build it by yourself.
You can find the original source codes at here.
Build it by running make, and link the resulting directory into ocamlfind's
root site-lib directory; or sudo make install.
If you're using a PC, you need to install ocamlfind/findlib and FlexDLL first. Please make sure that your environment variables are set correctly as follows:
OCAMLLIB=C:\OCaml\lib
CAML_LD_LIBRARY_PATH=%OCAMLLIB%\stublibs
FLEXLINKFLAGS=-L%MinGW%\lib -L%MinGW%\lib\gcc\mingw32\N.N.N
OPAM packages:
Android SDK (or sources)
To unpack and repack apk files, we use apktool, an open source APK
reengineering tool. Since it uses aapt, Android Asset Packaging Tool,
you need to install Android SDK or sources. Besides, we use
zipalign, which also comes from Android SDK, to optimize rewritten apps.
You can set paths to Android base tools by adding the followings to your profile:
ANDROID_HOME=$HOME/android-sdk # your own path here!
export ANDROID_HOME
PATH=$PATH:$ANDROID_HOME/tools
PATH=$PATH:$ANDROID_HOME/platform-tools
PATH=$PATH:$ANDROID_HOME/build-tools/19.0.0 # installed version number
export PATH
The main scripts are written in Ruby and require RubyGems, a Ruby package manager, and Nokogiri, an XML library to manipulate manifest files.
If you want to see graphs (e.g. call graph, control-flow graph, dominator tree, etc.), you need to install graphviz dot.
To build redexer, just make! You can see redexer binary at the top level.
$ make (clean)
Before using the tool, installing the most recent platform file for apktool is up to users. For instance, you need to do like
$ java -jar tools/apktool.jar if [proper platform file]
You can generate API documents in html format as well.
$ make api
You can see all the options the tool provides:
$ ruby scripts/cmd.rb -h
$ ruby scripts/cmd.rb --help
Like dexdump at Android SDK, redexer allows you to view the internals of the given dex file in a YAML format.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd unparse [--to blah.yml]
This option dumps instructions for a specified method.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd dump_method --mtd cls.mtd
This feature is to test parsing and dumping modules of redexer. It probably generates an identical dex file.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd id [--to blah.dex]
You can also see basic statistics about the dex file, e.g., # instr.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd info
This option prints out all class names defined in the dex file.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd classes
It may be useful to search specific third-party libraries, e.g.,
$ ruby scripts/cmd.rb target.(apk|dex) --cmd classes | egrep 'apache'
This option prints out API usage in the dex file.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd api [--sdk android.]
$ ruby scripts/cmd.rb target.(apk|dex) --cmd api --sdk com.facebook.
Aren't you curious how rarely some opcodes are used in Dalvik bytecodes? It will show you the histogram of entire opcodes, or you can look up how often the exact opcode is used in the given app.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd opstat [--op opcode1,opcode2,...]
For instance,
$ ruby scripts/cmd.rb ~/apps/top24/com.whatsapp.apk --cmd opstat
$ ruby scripts/cmd.rb ~/apps/top24/com.whatsapp.apk --cmd opstat --op div-int/lit16,nop
This option conducts propagation-based Intent resolution analysis, and prints out transitions amongst Activity classes.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd intent
This option generates a pdf file that depicts a call graph of the given file. If you don't specify the pdf name, cg.pdf will be used.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd cg [--to blah.pdf] [--no-pdf]
This option generates a pdf file that shows a control-flow graph of the given method. Append a method name to a class name with dot: class_name.method_name
$ ruby scripts/cmd.rb target.(apk|dex) --cmd cfg --mtd cls.mtd [--to blah.pdf] [--no-pdf]
This option is similar to the above feature, except for that it depicts (post) dominator tree.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd (p)dom --mtd cls.mtd [--to blah.pdf] [--no-pdf]
This option performs a classic backward data-flow analysis.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd live --mtd cls.mtd
This option conducts a classic forward data-flow analysis.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd const --mtd cls.mtd
This option conducts a classic forward data-flow analysis.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd reach --mtd cls.mtd
This option finds class dependency.
$ ruby scripts/cmd.rb target.(apk|dex) --cmd dependants --mtd cls.mtd
This option prints out the launching activity name of the given apk.
$ ruby scripts/cmd.rb target.apk --cmd launcher
This option lets you know what components are exposed to outside.
$ ruby scripts/cmd.rb target.apk --cmd exported
These options print out Android basic components declared in the manifest.
$ ruby scripts/cmd.rb target.apk --cmd [activity | service | provider | receiver]