1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
|
#!/usr/bin/env vpython3
# Copyright 2018 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
"""A helper script to list class verification errors.
This is a wrapper around the device's oatdump executable, parsing desired output
and accommodating API-level-specific details, such as file paths.
"""
import argparse
import logging
import os
import re
import devil_chromium
from devil.android import device_errors
from devil.android import device_temp_file
from devil.android import device_utils
from devil.android.ndk import abis
from devil.android.sdk import version_codes
from devil.android.tools import script_common
from devil.utils import logging_common
from py_utils import tempfile_ext
STATUSES = [
'NotReady',
'RetryVerificationAtRuntime',
'Verified',
'Initialized',
'SuperclassValidated',
]
def DetermineDeviceToUse(devices):
"""Like DeviceUtils.HealthyDevices(), but only allow a single device.
Args:
devices: A (possibly empty) list of serial numbers, such as from the
--device flag.
Returns:
A single device_utils.DeviceUtils instance.
Raises:
device_errors.NoDevicesError: Raised when no non-denylisted devices exist.
device_errors.MultipleDevicesError: Raise when multiple devices exist, but
|devices| does not distinguish which to use.
"""
if not devices:
# If the user did not specify which device, we let HealthyDevices raise
# MultipleDevicesError.
devices = None
usable_devices = device_utils.DeviceUtils.HealthyDevices(device_arg=devices)
# If the user specified more than one device, we still only want to support a
# single device, so we explicitly raise MultipleDevicesError.
if len(usable_devices) > 1:
raise device_errors.MultipleDevicesError(usable_devices)
return usable_devices[0]
class DeviceOSError(Exception):
"""Raised when a file is missing from the device, or something similar."""
pass
class UnsupportedDeviceError(Exception):
"""Raised when the device is not supported by this script."""
pass
def _GetFormattedArch(device):
abi = device.product_cpu_abi
# Some architectures don't map 1:1 with the folder names.
return {abis.ARM_64: 'arm64', abis.ARM: 'arm'}.get(abi, abi)
def PathToDexForPlatformVersion(device, package_name):
"""Gets the full path to the dex file on the device."""
sdk_level = device.build_version_sdk
paths_to_apk = device.GetApplicationPaths(package_name)
if not paths_to_apk:
raise DeviceOSError(
'Could not find data directory for {}. Is it installed?'.format(
package_name))
if len(paths_to_apk) != 1:
raise DeviceOSError(
'Expected exactly one path for {} but found {}'.format(
package_name,
paths_to_apk))
path_to_apk = paths_to_apk[0]
if version_codes.LOLLIPOP <= sdk_level <= version_codes.LOLLIPOP_MR1:
# Of the form "com.example.foo-\d", where \d is some digit (usually 1 or 2)
package_with_suffix = os.path.basename(os.path.dirname(path_to_apk))
arch = _GetFormattedArch(device)
dalvik_prefix = '/data/dalvik-cache/{arch}'.format(arch=arch)
odex_file = '{prefix}/data@app@{package}@base.apk@classes.dex'.format(
prefix=dalvik_prefix,
package=package_with_suffix)
elif sdk_level >= version_codes.MARSHMALLOW:
arch = _GetFormattedArch(device)
odex_file = '{data_dir}/oat/{arch}/base.odex'.format(
data_dir=os.path.dirname(path_to_apk), arch=arch)
else:
raise UnsupportedDeviceError('Unsupported API level: {}'.format(sdk_level))
odex_file_exists = device.FileExists(odex_file)
if odex_file_exists:
return odex_file
elif sdk_level >= version_codes.PIE:
raise DeviceOSError(
'Unable to find odex file: you must run dex2oat on debuggable apps '
'on >= P after installation.')
raise DeviceOSError('Unable to find odex file ' + odex_file)
def _AdbOatDumpForPackage(device, package_name, out_file):
"""Runs oatdump on the device."""
# Get the path to the odex file.
odex_file = PathToDexForPlatformVersion(device, package_name)
device.RunShellCommand(
['oatdump', '--oat-file=' + odex_file, '--output=' + out_file],
timeout=420,
shell=True,
check_return=True)
class JavaClass(object):
"""This represents a Java Class and its ART Class Verification status."""
def __init__(self, name, verification_status):
self.name = name
self.verification_status = verification_status
def _ParseMappingFile(proguard_map_file):
"""Creates a map of obfuscated names to deobfuscated names."""
mappings = {}
with open(proguard_map_file, 'r') as f:
pattern = re.compile(r'^(\S+) -> (\S+):')
for line in f:
m = pattern.match(line)
if m is not None:
deobfuscated_name = m.group(1)
obfuscated_name = m.group(2)
mappings[obfuscated_name] = deobfuscated_name
return mappings
def _DeobfuscateJavaClassName(dex_code_name, proguard_mappings):
return proguard_mappings.get(dex_code_name, dex_code_name)
def FormatJavaClassName(dex_code_name, proguard_mappings):
obfuscated_name = dex_code_name.replace('/', '.')
if proguard_mappings is not None:
return _DeobfuscateJavaClassName(obfuscated_name, proguard_mappings)
else:
return obfuscated_name
def ListClassesAndVerificationStatus(oatdump_output, proguard_mappings):
"""Lists all Java classes in the dex along with verification status."""
java_classes = []
pattern = re.compile(r'\d+: L([^;]+).*\(type_idx=[^(]+\((\w+)\).*')
for line in oatdump_output:
m = pattern.match(line)
if m is not None:
name = FormatJavaClassName(m.group(1), proguard_mappings)
# Some platform levels prefix this with "Status" while other levels do
# not. Strip this for consistency.
verification_status = m.group(2).replace('Status', '')
java_classes.append(JavaClass(name, verification_status))
return java_classes
def _PrintVerificationResults(target_status, java_classes, show_summary):
"""Prints results for user output."""
# Sort to keep output consistent between runs.
java_classes.sort(key=lambda c: c.name)
d = {}
for status in STATUSES:
d[status] = 0
for java_class in java_classes:
if java_class.verification_status == target_status:
print(java_class.name)
if java_class.verification_status not in d:
raise RuntimeError('Unexpected status: {0}'.format(
java_class.verification_status))
else:
d[java_class.verification_status] += 1
if show_summary:
for status in d:
count = d[status]
print('Total {status} classes: {num}'.format(
status=status, num=count))
print('Total number of classes: {num}'.format(
num=len(java_classes)))
def RealMain(mapping, device_arg, package, status, hide_summary, workdir):
if mapping is None:
logging.warn('Skipping deobfuscation because no map file was provided.')
device = DetermineDeviceToUse(device_arg)
device.EnableRoot()
with device_temp_file.DeviceTempFile(
device.adb) as file_on_device:
_AdbOatDumpForPackage(device, package, file_on_device.name)
file_on_host = os.path.join(workdir, 'out.dump')
device.PullFile(file_on_device.name, file_on_host, timeout=220)
proguard_mappings = (_ParseMappingFile(mapping) if mapping else None)
with open(file_on_host, 'r') as f:
java_classes = ListClassesAndVerificationStatus(f, proguard_mappings)
_PrintVerificationResults(status, java_classes, not hide_summary)
def main():
parser = argparse.ArgumentParser(description="""
List Java classes in an APK which fail ART class verification.
""")
parser.add_argument(
'--package',
'-P',
type=str,
default=None,
required=True,
help='Specify the full application package name')
parser.add_argument(
'--mapping',
'-m',
type=os.path.realpath,
default=None,
help='Mapping file for the desired APK to deobfuscate class names')
parser.add_argument(
'--hide-summary',
default=False,
action='store_true',
help='Do not output the total number of classes in each Status.')
parser.add_argument(
'--status',
type=str,
default='RetryVerificationAtRuntime',
choices=STATUSES,
help='Which category of classes to list at the end of the script')
parser.add_argument(
'--workdir',
'-w',
type=os.path.realpath,
default=None,
help=('Work directory for oatdump output (default = temporary '
'directory). If specified, this will not be cleaned up at the end '
'of the script (useful if you want to inspect oatdump output '
'manually)'))
script_common.AddEnvironmentArguments(parser)
script_common.AddDeviceArguments(parser)
logging_common.AddLoggingArguments(parser)
args = parser.parse_args()
devil_chromium.Initialize(adb_path=args.adb_path)
logging_common.InitializeLogging(args)
if args.workdir:
if not os.path.isdir(args.workdir):
raise RuntimeError('Specified working directory does not exist')
RealMain(args.mapping, args.devices, args.package, args.status,
args.hide_summary, args.workdir)
# Assume the user wants the workdir to persist (useful for debugging).
logging.warn('Not cleaning up explicitly-specified workdir: %s',
args.workdir)
else:
with tempfile_ext.NamedTemporaryDirectory() as workdir:
RealMain(args.mapping, args.devices, args.package, args.status,
args.hide_summary, workdir)
if __name__ == '__main__':
main()
|