Skip to content

Commit fd053f8

Browse files
ChnMigChnMig
committed
Merge branch 'main' of github.com:TongchengOpenSource/AppScan into fix-markError
2 parents 75ea752 + 06154fb commit fd053f8

File tree

12 files changed

+831
-33
lines changed

12 files changed

+831
-33
lines changed

‎README.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,23 @@ AppScan 这款隐私合规检测工具, 它是一款基于动态分析, 可以
3535
- android: 8.x及以上
3636
- app: 64位/未加固(有时候引入的第三方sdk也会自带一些反检测功能)
3737

38+
## 模拟器
39+
根据 https://github.com/TongchengOpenSource/AppScan/discussions/29 的投票结果, 我们对MuMu和雷神进行了适配工作
40+
目前模拟器支持未完全上线, 用户可在 release 中下载pre版本进行测试
41+
目前支持的模拟器
42+
- 雷神模拟器9(需要在 设置-其他设置 中开启root权限, 设置ADB调试为'开启本地连接')
43+
44+
目前暂不支持的模拟器
45+
- MuMu模拟器12(未找到ADB开关, 导致ADB无法识别到设备)
46+
3847
## 使用文档
3948
> 使用者查看此文档即可
4049
4150
🏠[使用文档](https://github.com/TongchengOpenSource/AppScan/wiki)
4251

4352
## 开发文档
4453
> 开发者需要额外查看文档
54+
4555
### 架构
4656
👽[架构说明](./doc/architecture.md)
4757

@@ -83,3 +93,9 @@ AppScan 这款隐私合规检测工具, 它是一款基于动态分析, 可以
8393
- FW5215118
8494
- mOan1215
8595
- wxid_yrhfgzsdjoj422
96+
97+
## 404星链计划
98+
99+
<img src="https://github.com/knownsec/404StarLink-Project/raw/master/logo.png" width="30%">
100+
101+
AppScan 现已加入 [404星链计划](https://github.com/knownsec/404StarLink)

‎change-demo.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
## 🆕新功能
2+
- XXXXXX
3+
- XXXXXX
4+
## 💯优化
5+
- XXXXXX
6+
- XXXXXX
7+
## 🐛修复
8+
- XXXXXX
9+
- XXXXXX

‎doc/build.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,9 @@
44
> 务必已经布置好了开发环境
55
1. 进入 helper 文件夹
66
2. 打开命令行
7-
3. 执行 `pyinstaller ./main.spec`
8-
4. 打包完成后, 会在 helper/dist 文件夹下生成文件夹, 将文件夹内的所有文件复制备用
7+
3. 进入虚拟环境 `.\venv\Scripts\activate`
8+
4. 执行 `pyinstaller ./main.spec`
9+
5. 打包完成后, 会在 helper/dist 文件夹下生成文件夹, 将文件夹内的所有文件复制备用
910

1011
## view
1112
> 务必已经布置好了开发环境
@@ -14,4 +15,4 @@
1415
3. 打开命令行
1516
4. 执行 `corepack enable` 开启corepack
1617
5. 执行 `npx quasar build -m electron`
17-
6. 打包完成后, 会在 `dist\electron\Packaged` 文件夹下生成 `appScan Setup xx.exe` 文件, 双击安装即可
18+
6. 打包完成后, 会在 `dist\electron\Packaged` 文件夹下生成 `appScan Setup xx.exe` 文件, 双击安装即可

‎helper/custom.js‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -638,15 +638,22 @@ function useModule(moduleList) {
638638

639639
function main() {
640640
try {
641+
// Java.perform(function () {
642+
// console.log('[*] ' + get_format_time() + ' 隐私合规检测敏感接口开始监控...');
643+
// send({"type": "isHook"})
644+
// console.log('[*] ' + get_format_time() + ' 检测到安卓版本：' + Java.androidVersion);
645+
// var moduleList;
646+
// recv(function (received_json_object) {
647+
// moduleList = received_json_object.use_module;
648+
// }).wait();
649+
// useModule(moduleList);
650+
// });
651+
// TODO 模拟器适配
641652
Java.perform(function () {
642653
console.log('[*] ' + get_format_time() + ' 隐私合规检测敏感接口开始监控...');
643654
send({"type": "isHook"})
644655
console.log('[*] ' + get_format_time() + ' 检测到安卓版本：' + Java.androidVersion);
645-
var moduleList;
646-
recv(function (received_json_object) {
647-
moduleList = received_json_object.use_module;
648-
}).wait();
649-
useModule(moduleList);
656+
useModule({"type": "all"});
650657
});
651658
} catch (e) {
652659
console.log(e)

‎helper/default.js‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -166,9 +166,13 @@ function hookApplicationPackageManagerExceptSelf(targetMethod, action) {
166166
if (j === 0) {
167167
var string_to_recv;
168168
send({'type': 'app_name', 'data': arguments[j]});
169+
// recv(function (received_json_object) {
170+
// string_to_recv = received_json_object.my_data;
171+
// }).wait();
172+
// TODO 模拟器适配
169173
recv(function (received_json_object) {
170174
string_to_recv = received_json_object.my_data;
171-
}).wait();
175+
});
172176
}
173177
arg += '参数' + j + '：' + JSON.stringify(arguments[j]) + '\r\n';
174178
}
@@ -624,15 +628,22 @@ function useModule(moduleList) {
624628

625629
function main() {
626630
try {
631+
// Java.perform(function () {
632+
// console.log('[*] ' + get_format_time() + ' 隐私合规检测敏感接口开始监控...');
633+
// send({"type": "isHook"})
634+
// console.log('[*] ' + get_format_time() + ' 检测到安卓版本：' + Java.androidVersion);
635+
// var moduleList;
636+
// recv(function (received_json_object) {
637+
// moduleList = received_json_object.use_module;
638+
// }).wait();
639+
// useModule(moduleList);
640+
// });
641+
// TODO 模拟器适配
627642
Java.perform(function () {
628643
console.log('[*] ' + get_format_time() + ' 隐私合规检测敏感接口开始监控...');
629644
send({"type": "isHook"})
630645
console.log('[*] ' + get_format_time() + ' 检测到安卓版本：' + Java.androidVersion);
631-
var moduleList;
632-
recv(function (received_json_object) {
633-
moduleList = received_json_object.use_module;
634-
}).wait();
635-
useModule(moduleList);
646+
useModule({"type": "all"});
636647
});
637648
} catch (e) {
638649
console.log(e)

‎helper/internal/hook/hook.py‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
import uuid
33
import frida
44
import logging
5+
import traceback
56
from queue import Queue
67
from typing import Optional
78
from threading import Thread
@@ -81,11 +82,15 @@ def handler(level, text):
8182
if not self.is_attach:
8283
device.resume(pid)
8384
except Exception as e:
84-
self.queue.put({"type": "helper_error", "data": str(e)})
85+
data = traceback.format_exc()
86+
logging.error(data)
87+
self.queue.put({"type": "helper_error", "data": data})
8588
self.wait_time += 1
8689
self.stop()
8790
except Exception as e:
88-
self.queue.put({"type": "helper_error", "data": str(e)})
91+
data = traceback.format_exc()
92+
logging.error(data)
93+
self.queue.put({"type": "helper_error", "data": data})
8994
self.stop()
9095

9196
def start(self, join: bool = False):

‎helper/routers/adb/init.py‎

Lines changed: 99 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,12 @@
3636
+ os.sep
3737
+ "adb"
3838
) # 默认mac环境
39-
frida_server = "hluda-server-15.2.2"
39+
frida_server_arm = "hluda-server-15.2.2-arm64"
40+
frida_server_x86 = "hluda-server-15.2.2-x86"
41+
# 根据手机架构选择 frida-server, arm和x86
42+
# 兼容模拟器
43+
detecting_phone_architecture_cmd = [adb_path, "shell", "su -c 'getprop ro.product.cpu.abi'"]
44+
frida_server = ""
4045
frida_path = (
4146
os.path.abspath(os.path.join(os.path.dirname(__file__), "../.."))
4247
+ os.sep
@@ -70,6 +75,96 @@
7075
"su -c 'setprop persist.device_config.runtime_native.usap_pool_enabled false'",
7176
]
7277

78+
def generation_cmd():
79+
# 重新生成cmd
80+
global adb_path
81+
global frida_server
82+
global frida_path
83+
global colse_SELinux_cmd
84+
global kill_cmd
85+
global clean_cmd
86+
global push_cmd
87+
global mv_cmd
88+
global chmod_cmd
89+
global run_cmd
90+
global devices_cmd
91+
global root_cmd
92+
global stop_adb_cmd
93+
global start_adb_cmd
94+
global close_usap_cmd
95+
global detecting_phone_architecture_cmd
96+
global frida_server_arm
97+
global frida_server_x86
98+
adb_path = (
99+
os.path.abspath(os.path.join(os.path.dirname(__file__), "../.."))
100+
+ os.sep
101+
+ "static"
102+
+ os.sep
103+
+ "windows"
104+
+ os.sep
105+
+ "adb.exe"
106+
) # default windows
107+
if platform.system().lower() == "darwin":
108+
# mac 环境
109+
adb_path = (
110+
os.path.abspath(os.path.join(os.path.dirname(__file__), "../.."))
111+
+ os.sep
112+
+ "static"
113+
+ os.sep
114+
+ "darwin"
115+
+ os.sep
116+
+ "adb"
117+
) # 默认mac环境
118+
frida_server_arm = "hluda-server-15.2.2-arm64"
119+
frida_server_x86 = "hluda-server-15.2.2-x86"
120+
# 根据手机架构选择 frida-server, arm和x86
121+
# 兼容模拟器
122+
detecting_phone_architecture_cmd = [adb_path, "shell", "su -c 'getprop ro.product.cpu.abi'"]
123+
frida_path = (
124+
os.path.abspath(os.path.join(os.path.dirname(__file__), "../.."))
125+
+ os.sep
126+
+ "static"
127+
+ os.sep
128+
+ frida_server
129+
)
130+
colse_SELinux_cmd = [adb_path, "shell", "su -c 'setenforce 0'"]
131+
kill_cmd = [adb_path, "shell", "su -c 'pkill -9 hluda'"]
132+
clean_cmd = [adb_path, "shell", "su -c 'rm -rf /data/local/tmp/*'"]
133+
push_cmd = [adb_path, "push", frida_path, "/storage/emulated/0/{}".format(frida_server)]
134+
mv_cmd = [
135+
adb_path,
136+
"shell",
137+
"su -c 'mv /storage/emulated/0/{} /data/local/tmp/'".format(frida_server),
138+
]
139+
chmod_cmd = [
140+
adb_path,
141+
"shell",
142+
"su -c 'chmod 777 /data/local/tmp/{}'".format(frida_server),
143+
]
144+
run_cmd = [adb_path, "shell", "su -c 'nohup /data/local/tmp/{} &'".format(frida_server)]
145+
devices_cmd = [adb_path, "devices"]
146+
root_cmd = [adb_path, "shell", "su -c 'exit'"]
147+
stop_adb_cmd = [adb_path, "kill-server"]
148+
start_adb_cmd = [adb_path, "start-server"]
149+
# https://github.com/frida/frida/issues/1788
150+
close_usap_cmd = [
151+
adb_path,
152+
"shell",
153+
"su -c 'setprop persist.device_config.runtime_native.usap_pool_enabled false'",
154+
]
155+
156+
def detecting_phone_architecture():
157+
# 检测手机架构
158+
global frida_server
159+
result = subprocess.Popen(detecting_phone_architecture_cmd, stdout=subprocess.PIPE).communicate()
160+
outdata = result[0].decode("utf-8")
161+
if "arm" in outdata:
162+
frida_server = frida_server_arm
163+
elif "x86" in outdata:
164+
frida_server = frida_server_x86
165+
else:
166+
raise Exception("手机架构不支持", outdata)
167+
return frida_server
73168

74169
@router.post("", response_model=ApiBaseResponse, response_model_exclude_unset=False)
75170
async def init():
@@ -91,6 +186,9 @@ async def init():
91186
# kill 可能残留的进程
92187
subprocess.call(kill_cmd)
93188
time.sleep(2)
189+
# 获取手机架构
190+
detecting_phone_architecture()
191+
generation_cmd()
94192
# 清理数据
95193
subprocess.call(clean_cmd)
96194
# 推送 frida-server 到设备

0 commit comments

Comments
 (0)