Skip to content

Commit 155e76c

Browse files
authored
Update radiocontrast documentation (#329)
1 parent d9e1c08 commit 155e76c

16 files changed

+112
-29
lines changed

README.md

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,31 @@ quark -a first.apk -a second.apk -C
140140

141141
<img src="https://i.imgur.com/ClRWOei.png"/>
142142

143+
### Radiocontrast
144+
Radiocontrast is a Quark API that quickly generates Quark rules from a specified method. It builds up 100% matched rules by using native APIs in that method. The feature lets you easily expose the behavior of a method, just like radiocontrast.
145+
146+
For example, we want to know the behavior of a method called `Lahmyth/mine/king/ahmyth/CameraManager;->startUp(I)V,` in Ahmyth.apk.
147+
Here is the simplest way for Radiocontrast usage:
148+
```python
149+
from quark.radiocontrast import RadioContrast
150+
151+
# The target APK.
152+
APK_PATH = "~/apk-malware-sample/Ahmyth.apk"
153+
154+
# The method that you want to generate rules.
155+
TARGET_METHOD = "Lahmyth/mine/king/ahmyth/CameraManager;->startUp(I)V"
156+
157+
# The output directory for generated rules.
158+
GENERATED_RULE_DIR = "~/generated_rules"
159+
160+
radiocontrast = RadioContrast(
161+
APK_PATH,
162+
TARGET_METHOD,
163+
GENERATED_RULE_DIR
164+
)
165+
radiocontrast.rule_generate()
166+
```
167+
143168
### Parallelizing Quark
144169
Now Quark supports multiprocessing for analyzing APKs parallelly. By adding the option `--multi-process`, you can set the number of processes.
145170

-17 Bytes
Binary file not shown.
-17 Bytes
Binary file not shown.
-17 Bytes
Binary file not shown.

docs/build/doctrees/dev.doctree

-17 Bytes
Binary file not shown.
-17 Bytes
Binary file not shown.
-311 Bytes
Binary file not shown.

docs/build/doctrees/index.doctree

-17 Bytes
Binary file not shown.
-17 Bytes
Binary file not shown.

docs/build/html/.buildinfo

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
# Sphinx build info version 1
22
# This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done.
3-
config: 8bd0aaf3aaf969644d5b5d0eb394df79
3+
config: c99d14db2499ef2956869462931fc195
44
tags: 645f666f9bcd5a90fca523b33c5a78b7

0 commit comments

Comments
 (0)