@@ -23,7 +23,7 @@ Command line for analysis:
23
23
24
24
###-c option
25
25
-c must be provided as the directory for config files, including taint rules, source and sink, vulnerable API description and so on. If you do
26
- not understand the config files' content, do not modify them, leave them as it is.
26
+ not understand the config files content, do not modify them, leave them as it is.
27
27
28
28
###-p option
29
29
-p option specifies the android platform directory, which usually just points to ${ANDROID_SDK}/platforms/
@@ -34,53 +34,55 @@ not understand the config files' content, do not modify them, leave them as it i
34
34
## Output
35
35
JADE will output result to in a list to console and also writes json-ed result to output/ directory: {MD5_OF_INPUT_APK}.txt. A sample can be
36
36
find in output directory of this repo: https://github.com/flankerhqd/JADE/blob/master/output/92db77bbe1cae9004f11ef9d3d6cbf08.txt
37
-
38
37
Snippet:
39
- }, {
40
- "desc": "sensitive data flow",
41
- "sourceStmt": "$r24 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r24)",
42
- "custom": "",
43
- "vulnKind": 2,
44
- "destMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>",
45
- "paths": [ ] ,
46
- "destStmt": "virtualinvoke $r1.<android.content.Context: void sendBroadcast(android.content.Intent,java.lang.String)>($r27, $r24)",
47
- "sourceMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
48
- }, {
49
- "desc": "sensitive data flow",
50
- "sourceStmt": "$r4 = virtualinvoke $r2.<android.content.Intent: android.os.Bundle getExtras()>()",
51
- "custom": "",
52
- "vulnKind": 2,
53
- "destMethod": "<com.fugao.fxhealth.receiver.JPushReceiver: void onReceive(android.content.Context,android.content.Intent)>",
54
- "paths": [ ] ,
55
- "destStmt": "virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)",
56
- "sourceMethod": "<com.fugao.fxhealth.receiver.JPushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
57
- }, {
58
- "desc": "sensitive data flow",
59
- "sourceStmt": "$r6 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r6)",
60
- "custom": "",
61
- "vulnKind": 2,
62
- "destMethod": "<cn.jpush.android.data.x: void a(android.content.Context)>",
63
- "paths": [ ] ,
64
- "destStmt": "virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)",
65
- "sourceMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
66
- }, {
67
- "desc": "sensitive data flow",
68
- "sourceStmt": "$r9 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r9)",
69
- "custom": "",
70
- "vulnKind": 2,
71
- "destMethod": "<cn.jpush.android.data.x: void a(android.content.Context)>",
72
- "paths": [ ] ,
73
- "destStmt": "virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)",
74
- "sourceMethod": "<cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
75
- }]
76
- }
38
+
39
+ ``` json
40
+ }, {
41
+ "desc" : " sensitive data flow" ,
42
+ "sourceStmt" : " $r24 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r24)" ,
43
+ "custom" : " " ,
44
+ "vulnKind" : 2 ,
45
+ "destMethod" : " <cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>" ,
46
+ "paths" : [],
47
+ "destStmt" : " virtualinvoke $r1.<android.content.Context: void sendBroadcast(android.content.Intent,java.lang.String)>($r27, $r24)" ,
48
+ "sourceMethod" : " <cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
49
+ }, {
50
+ "desc" : " sensitive data flow" ,
51
+ "sourceStmt" : " $r4 = virtualinvoke $r2.<android.content.Intent: android.os.Bundle getExtras()>()" ,
52
+ "custom" : " " ,
53
+ "vulnKind" : 2 ,
54
+ "destMethod" : " <com.fugao.fxhealth.receiver.JPushReceiver: void onReceive(android.content.Context,android.content.Intent)>" ,
55
+ "paths" : [],
56
+ "destStmt" : " virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)" ,
57
+ "sourceMethod" : " <com.fugao.fxhealth.receiver.JPushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
58
+ }, {
59
+ "desc" : " sensitive data flow" ,
60
+ "sourceStmt" : " $r6 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r6)" ,
61
+ "custom" : " " ,
62
+ "vulnKind" : 2 ,
63
+ "destMethod" : " <cn.jpush.android.data.x: void a(android.content.Context)>" ,
64
+ "paths" : [],
65
+ "destStmt" : " virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)" ,
66
+ "sourceMethod" : " <cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
67
+ }, {
68
+ "desc" : " sensitive data flow" ,
69
+ "sourceStmt" : " $r9 = virtualinvoke $r2.<android.content.Intent: java.lang.String getStringExtra(java.lang.String)>($r9)" ,
70
+ "custom" : " " ,
71
+ "vulnKind" : 2 ,
72
+ "destMethod" : " <cn.jpush.android.data.x: void a(android.content.Context)>" ,
73
+ "paths" : [],
74
+ "destStmt" : " virtualinvoke $r1.<android.content.Context: void startActivity(android.content.Intent)>($r2)" ,
75
+ "sourceMethod" : " <cn.jpush.android.service.PushReceiver: void onReceive(android.content.Context,android.content.Intent)>"
76
+ }]}
77
+ ```
78
+
77
79
# Hint
78
80
To avoid OOM, add -Xmx option to commandline, e.g. java -jar jade-0.1.jar -Xmx8192m
79
81
80
82
# Build from source code
81
83
82
84
JADE is organized by gradle. Run ` gradle fatJar ` at the root of source directory and single-bundled jar will be generated at ./jade/build/
83
- Each directory actually represents a git submodule originally. For simplicity I'm combining them to same root directories and you can change it
85
+ Each directory actually represents a git submodule originally. For simplicity I am combining them to same root directories and you can change it
84
86
as you wish, track upstream Soot changes.
85
87
86
88
# Credits
0 commit comments