Skip to content

Commit 9dc3f4c

Browse files
Fuzion24Fuzion24
committed
Merge pull request #85 from Fuzion24/feature/run_test_results_from_broadcast_receiver
Run test results from broadcast receiver and serialize to user provided file path
2 parents 8e9576d + 9a5039d commit 9dc3f4c

File tree

4 files changed

+153
-42
lines changed

4 files changed

+153
-42
lines changed

‎app/src/main/AndroidManifest.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,12 @@
3636
</intent-filter>
3737
</receiver>
3838

39+
<receiver android:name="fuzion24.device.vulnerability.broadcastreceiver.ScanRunnerBroadcastReceiver">
40+
<intent-filter>
41+
<action android:name="com.android.vts.RUN_SCAN"/>
42+
</intent-filter>
43+
</receiver>
44+
3945
</application>
4046

4147
</manifest>

‎app/src/main/java/fuzion24/device/vulnerability/broadcastreceiver/ScanRunnerBroadcastReceiver.java

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
package fuzion24.device.vulnerability.broadcastreceiver;
2+
3+
import android.content.BroadcastReceiver;
4+
import android.content.Context;
5+
import android.content.Intent;
6+
import android.content.pm.ApplicationInfo;
7+
import android.os.AsyncTask;
8+
import android.os.Bundle;
9+
import android.util.Log;
10+
11+
import org.json.JSONObject;
12+
13+
import java.io.FileOutputStream;
14+
import java.util.ArrayList;
15+
import java.util.List;
16+
17+
import fuzion24.device.vulnerability.test.VulnerabilityTestResult;
18+
import fuzion24.device.vulnerability.util.DeviceInfo;
19+
import fuzion24.device.vulnerability.vulnerabilities.VulnerabilityOrganizer;
20+
import fuzion24.device.vulnerability.vulnerabilities.VulnerabilityResultSerialzier;
21+
import fuzion24.device.vulnerability.vulnerabilities.VulnerabilityTest;
22+
23+
/**
24+
* Created by fuzion24 on 11/25/15.
25+
*/
26+
public class ScanRunnerBroadcastReceiver extends BroadcastReceiver {
27+
private static final String TAG = "ScanRunnerReceiver";
28+
@Override
29+
public void onReceive(final Context context, Intent intent) {
30+
31+
Log.d(TAG, "Received broadcast for scanrunner");
32+
//Only allow this code to be ran on debug builds, since it accepts and writes to arbitrary file
33+
//paths, which would allow another app to arbitrarily write anywhere in this app's context.
34+
// http://android-developers.blogspot.com/2010/09/securing-android-lvl-applications.html
35+
boolean isDebuggable = ( 0 != ( context.getApplicationInfo().flags & ApplicationInfo.FLAG_DEBUGGABLE ) );
36+
if(!isDebuggable){
37+
Log.d(TAG, "Not running the tests because the app is not debuggable");
38+
return;
39+
}
40+
41+
Bundle intentExtras = intent.getExtras();
42+
if(intentExtras == null){
43+
Log.d(TAG, "There were no extras with the broadcast. Include RESULT_PATH");
44+
return;
45+
}
46+
47+
final String writeResultPath = intentExtras.getString("RESULT_PATH");
48+
if(writeResultPath == null || writeResultPath.equals("")){
49+
Log.d(TAG, "Result write path is null or empty");
50+
}
51+
52+
Log.d(TAG, "Results will be written to: " + writeResultPath);
53+
54+
new AsyncTask<Void,Void,Void>(){
55+
@Override
56+
protected Void doInBackground(Void... params) {
57+
List<VulnerabilityTest> tests = VulnerabilityOrganizer.getTests(context);
58+
List<VulnerabilityTestResult> results = new ArrayList<VulnerabilityTestResult>();
59+
for(VulnerabilityTest vt : tests){
60+
Log.d(TAG, "Running: " + vt.getCVEorID());
61+
boolean vulnerable = false;
62+
Exception x = null;
63+
try {
64+
vulnerable = vt.isVulnerable(context);
65+
}catch(Exception e){
66+
x = e;
67+
}
68+
results.add(new VulnerabilityTestResult(vt, vulnerable, x));
69+
}
70+
71+
try {
72+
JSONObject jobj = VulnerabilityResultSerialzier.serializeResultsToJson(results, DeviceInfo.getDeviceInfo());
73+
FileOutputStream fos = new FileOutputStream(writeResultPath);
74+
fos.write(jobj.toString(2).getBytes());
75+
fos.close();
76+
}catch(Exception e){
77+
e.printStackTrace();
78+
}
79+
80+
return null;
81+
}
82+
}.execute();
83+
84+
}
85+
}

‎app/src/main/java/fuzion24/device/vulnerability/test/ui/MainActivity.java

Lines changed: 2 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
import fuzion24.device.vulnerability.test.VulnerabilityTestRunner;
3535
import fuzion24.device.vulnerability.test.adapter.RecyclerAdapter;
3636
import fuzion24.device.vulnerability.util.DeviceInfo;
37+
import fuzion24.device.vulnerability.vulnerabilities.VulnerabilityResultSerialzier;
3738

3839
public class MainActivity extends AppCompatActivity {
3940

@@ -139,7 +140,7 @@ public void onClick(View v) {
139140

140141
Intent intent = null;
141142
try {
142-
JSONObject json = serializeResults(testResults, devInfo);
143+
JSONObject json = VulnerabilityResultSerialzier.serializeResultsToJson(testResults, devInfo);
143144
if (itemId == R.id.menu_export_results) {
144145
intent = new Intent(Intent.ACTION_SEND);
145146
intent.setType("text/plain");
@@ -165,47 +166,6 @@ public void onClick(View v) {
165166
}
166167
}
167168

168-
private JSONObject serializeResults(List<VulnerabilityTestResult> results, DeviceInfo devInfo) throws JSONException {
169-
// not sure if this is too intense to do on the main thread...
170-
JSONArray testResults = new JSONArray();
171-
JSONObject buildInfo = new JSONObject();
172-
JSONObject combinedResults = new JSONObject();
173-
174-
buildInfo.put("fingerprint", devInfo.getBuildFingerPrint());
175-
buildInfo.put("kernelVersion", devInfo.getKernelVersion());
176-
buildInfo.put("brand", devInfo.getBuildBrand());
177-
buildInfo.put("manufacturer", devInfo.getBuildManufacturer());
178-
buildInfo.put("model", devInfo.getBuildModel());
179-
buildInfo.put("release", devInfo.getBuildRelease());
180-
buildInfo.put("sdk", devInfo.getBuildSDK());
181-
buildInfo.put("builddate", devInfo.getBuildDateUTC());
182-
buildInfo.put("id", devInfo.getBuildID());
183-
buildInfo.put("cpuABI", devInfo.getBuildCpuABI());
184-
buildInfo.put("cpuABI2", devInfo.getBuildCpuABI2());
185-
186-
JSONArray supportedABIs = new JSONArray();
187-
for(String abi : devInfo.getSupportedABIS()){
188-
supportedABIs.put(abi);
189-
}
190-
191-
buildInfo.put("supportedABIs", supportedABIs);
192-
buildInfo.put("versionCode", BuildConfig.VERSION_CODE);
193-
buildInfo.put("versionName", BuildConfig.VERSION_NAME);
194-
195-
for (VulnerabilityTestResult s : results) {
196-
JSONObject res = new JSONObject();
197-
res.put("name", s.getCVEorID());
198-
res.put("isVulnerable", s.isVulnerable());
199-
res.put("exception", s.getException());
200-
testResults.put(res);
201-
}
202-
203-
combinedResults.put("buildInfo", buildInfo);
204-
combinedResults.put("results", testResults);
205-
206-
return combinedResults;
207-
}
208-
209169
private void runTestsSuit() {
210170
new VulnerabilityTestRunner(MainActivity.this, true, new ResultsCallback() {
211171
@Override

‎app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/VulnerabilityResultSerialzier.java

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
package fuzion24.device.vulnerability.vulnerabilities;
2+
3+
import com.nowsecure.android.vts.BuildConfig;
4+
5+
import org.json.JSONArray;
6+
import org.json.JSONException;
7+
import org.json.JSONObject;
8+
9+
import java.util.List;
10+
11+
import fuzion24.device.vulnerability.test.VulnerabilityTestResult;
12+
import fuzion24.device.vulnerability.util.DeviceInfo;
13+
14+
/**
15+
* Created by fuzion24 on 11/25/15.
16+
*/
17+
public class VulnerabilityResultSerialzier {
18+
19+
public static JSONObject serializeResultsToJson(List<VulnerabilityTestResult> results, DeviceInfo devInfo) throws JSONException {
20+
// not sure if this is too intense to do on the main thread...
21+
JSONArray testResults = new JSONArray();
22+
JSONObject buildInfo = new JSONObject();
23+
JSONObject combinedResults = new JSONObject();
24+
25+
buildInfo.put("fingerprint", devInfo.getBuildFingerPrint());
26+
buildInfo.put("kernelVersion", devInfo.getKernelVersion());
27+
buildInfo.put("brand", devInfo.getBuildBrand());
28+
buildInfo.put("manufacturer", devInfo.getBuildManufacturer());
29+
buildInfo.put("model", devInfo.getBuildModel());
30+
buildInfo.put("release", devInfo.getBuildRelease());
31+
buildInfo.put("sdk", devInfo.getBuildSDK());
32+
buildInfo.put("builddate", devInfo.getBuildDateUTC());
33+
buildInfo.put("id", devInfo.getBuildID());
34+
buildInfo.put("cpuABI", devInfo.getBuildCpuABI());
35+
buildInfo.put("cpuABI2", devInfo.getBuildCpuABI2());
36+
37+
JSONArray supportedABIs = new JSONArray();
38+
for(String abi : devInfo.getSupportedABIS()){
39+
supportedABIs.put(abi);
40+
}
41+
42+
buildInfo.put("supportedABIs", supportedABIs);
43+
buildInfo.put("versionCode", BuildConfig.VERSION_CODE);
44+
buildInfo.put("versionName", BuildConfig.VERSION_NAME);
45+
46+
for (VulnerabilityTestResult s : results) {
47+
JSONObject res = new JSONObject();
48+
res.put("name", s.getCVEorID());
49+
res.put("isVulnerable", s.isVulnerable());
50+
res.put("exception", s.getException());
51+
testResults.put(res);
52+
}
53+
54+
combinedResults.put("buildInfo", buildInfo);
55+
combinedResults.put("results", testResults);
56+
57+
return combinedResults;
58+
}
59+
60+
}

0 commit comments

Comments
 (0)