Skip to content
This repository was archived by the owner on Aug 25, 2021. It is now read-only.

Commit 0bb41d3

Browse files
committed
Update README.md
1 parent 139434f commit 0bb41d3

File tree

1 file changed

+43
-41
lines changed

1 file changed

+43
-41
lines changed

README.md

+43-41
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Command line for analysis:
2323

2424
###-c option
2525
-c must be provided as the directory for config files, including taint rules, source and sink, vulnerable API description and so on. If you do
26-
not understand the config files' content, do not modify them, leave them as it is.
26+
not understand the config files content, do not modify them, leave them as it is.
2727

2828
###-p option
2929
-p option specifies the android platform directory, which usually just points to ${ANDROID_SDK}/platforms/
@@ -34,53 +34,55 @@ not understand the config files' content, do not modify them, leave them as it i
3434
## Output
3535
JADE will output result to in a list to console and also writes json-ed result to output/ directory: {MD5_OF_INPUT_APK}.txt. A sample can be
3636
find in output directory of this repo: https://github.com/flankerhqd/JADE/blob/master/output/92db77bbe1cae9004f11ef9d3d6cbf08.txt
37-
3837
Snippet:
39-
}, {
40-
"desc": "sensitive data flow",
41-
"sourceStmt": "$r24 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r24)",
42-
"custom": "",
43-
"vulnKind": 2,
44-
"destMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>",
45-
"paths": [],
46-
"destStmt": "virtualinvoke $r1.<android.content.Context: void sendBroadcast(android.content.Intent,java.lang.String)>($r27, $r24)",
47-
"sourceMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
48-
}, {
49-
"desc": "sensitive data flow",
50-
"sourceStmt": "$r4 = virtualinvoke $r2.<android.content.Intent: android.os.Bundle getExtras()>()",
51-
"custom": "",
52-
"vulnKind": 2,
53-
"destMethod": "<com.fugao.fxhealth.receiver.JPushReceiver: void onReceive(android.content.Context,android.content.Intent)>",
54-
"paths": [],
55-
"destStmt": "virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)",
56-
"sourceMethod": "<com.fugao.fxhealth.receiver.JPushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
57-
}, {
58-
"desc": "sensitive data flow",
59-
"sourceStmt": "$r6 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r6)",
60-
"custom": "",
61-
"vulnKind": 2,
62-
"destMethod": "<cn.jpush.android.data.x: void a(android.content.Context)>",
63-
"paths": [],
64-
"destStmt": "virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)",
65-
"sourceMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
66-
}, {
67-
"desc": "sensitive data flow",
68-
"sourceStmt": "$r9 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r9)",
69-
"custom": "",
70-
"vulnKind": 2,
71-
"destMethod": "<cn.jpush.android.data.x: void a(android.content.Context)>",
72-
"paths": [],
73-
"destStmt": "virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)",
74-
"sourceMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
75-
}]
76-
}
38+
39+
```json
40+
}, {
41+
"desc": "sensitive data flow",
42+
"sourceStmt": "$r24 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r24)",
43+
"custom": "",
44+
"vulnKind": 2,
45+
"destMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>",
46+
"paths": [],
47+
"destStmt": "virtualinvoke $r1.<android.content.Context: void sendBroadcast(android.content.Intent,java.lang.String)>($r27, $r24)",
48+
"sourceMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
49+
}, {
50+
"desc": "sensitive data flow",
51+
"sourceStmt": "$r4 = virtualinvoke $r2.<android.content.Intent: android.os.Bundle getExtras()>()",
52+
"custom": "",
53+
"vulnKind": 2,
54+
"destMethod": "<com.fugao.fxhealth.receiver.JPushReceiver: void onReceive(android.content.Context,android.content.Intent)>",
55+
"paths": [],
56+
"destStmt": "virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)",
57+
"sourceMethod": "<com.fugao.fxhealth.receiver.JPushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
58+
}, {
59+
"desc": "sensitive data flow",
60+
"sourceStmt": "$r6 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r6)",
61+
"custom": "",
62+
"vulnKind": 2,
63+
"destMethod": "<cn.jpush.android.data.x: void a(android.content.Context)>",
64+
"paths": [],
65+
"destStmt": "virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)",
66+
"sourceMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
67+
}, {
68+
"desc": "sensitive data flow",
69+
"sourceStmt": "$r9 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r9)",
70+
"custom": "",
71+
"vulnKind": 2,
72+
"destMethod": "<cn.jpush.android.data.x: void a(android.content.Context)>",
73+
"paths": [],
74+
"destStmt": "virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)",
75+
"sourceMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
76+
}]}
77+
```
78+
7779
# Hint
7880
To avoid OOM, add -Xmx option to commandline, e.g. java -jar jade-0.1.jar -Xmx8192m
7981

8082
# Build from source code
8183

8284
JADE is organized by gradle. Run `gradle fatJar` at the root of source directory and single-bundled jar will be generated at ./jade/build/
83-
Each directory actually represents a git submodule originally. For simplicity I'm combining them to same root directories and you can change it
85+
Each directory actually represents a git submodule originally. For simplicity I am combining them to same root directories and you can change it
8486
as you wish, track upstream Soot changes.
8587

8688
# Credits

0 commit comments

Comments
 (0)