forked from tuomao/android_malware_detection
-
Notifications
You must be signed in to change notification settings - Fork 0
/
get_api.py
70 lines (56 loc) · 1.84 KB
/
get_api.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
#coding: utf-8
#coding: utf-8
from androguard.misc import AnalyzeAPK
from androguard.core.bytecodes.dvm import *
import torndb
apks=[
'/home/tuomao/Desktop/anroid_security/Gen_Signature_Android1f09c7.apk',
'/home/tuomao/a5bf9ac282c6db469fb782068fb8fe08713dd1bcb5fe1e8f82647af5363a31c6'
]
db=torndb.Connection("120.27.92.166","apk",user="root",password="112112")
def insert_apis(apis):
for api in apis:
insert_sql="insert into api (name) VALUES (%s)"
try:
db.insert(insert_sql,api)
except Exception as e:
pass
def get_apis_as_str(apis):
apis_str="','".join(apis)
get_ids_sql="select id from api where name in ('%s') order by id asc"%(apis_str)
results=db.query(get_ids_sql)
results=[str(item['id']) for item in results]
results=','.join(results)
return results
def get_api(d):
'''
get apk called apis
:return:
'''
# get all methods
apis=set()
methods=d.get_methods()
for method in methods:
# get methos instructions
insts=method.get_instructions()
for inst in insts:
# get call function instruction
if(inst.get_name().startswith('invoke')):
# demo v1, Lcom/hd/dtools/Tools;->sdk_end(Landroid/content/Context;)V
out_put=inst.get_output()
left_index=out_put.index('L')
right_index=out_put.index('(')
api=out_put[left_index+1:right_index]
api=api.replace('/','.').replace(';->','.')
if(api.startswith('java') or api.startswith('android')):
apis.add(api)
return apis
def main():
for apk in apks:
a, d, dx = AnalyzeAPK(apk)
d.set_vmanalysis(dx)
apis=get_api(d)
insert_apis(apis)
str=get_apis_as_str(apis)
print(str)
main()