ファイアウォールの新たなゼロデイ脆弱性が話題になっています。ファイアウォールやVPNについて不安をお持ちの場合は、Zscalerの特別オファーをご活用ください。

Zscalerのブログ

Zscalerの最新ブログ情報を受信

購読する
セキュリティリサーチ

Hey AndroGuard, I Will Crash You Or Your Python Buddy!

image
THREATLABZ
3月 13, 2013 - 2 分で読了

AndroGuard is a popular tool to be used to analyze android APK files by security professionals.
Quite a few APK analysis tools have been built based on it. They usually call Python library to unzip APK files before reverse-engineering. No wonder some android malware were trying to applied some anti-debugging tricks to crash AndroGuard or Python, just like what PC malware had done on Ollydbg and IDAPro.

I came across a few android samples, which was able to crash (not crush) AndroGuard. I would like to share some information here.  However, I'm not quite sure if codes inside these samples are on purpose for anti-debugging or just some bugs of AndroGuard.

1.  uncommon padding values for "link_size" and "link_off" fields

2. unpack function failure from Python zipfile.py

Here is one example. The sample with MD5 value 22ff8b141bc187095ded6a431073028c protected itself from unzipping by AndroGuard. VT showed it as Android/Wooboo malware family.

Image

Only 5 AV engines detected it as mailicous.

Image

This sample caused an error by leveraging python's aligning on 4-byte boundaries
"unpack('<HH', extra[:4]) error: unpack requires a string argument of length 4".

This application reads the unique device ID, i.e the IMEI for GSM and the MEID or ESN for CDMA phones. It also called 'Landroid/content/Context;->getPackageName()Ljava/lang/String;' under the tag 'Wooboo SDK'.

Kudos to new patch of zipfile.py, it resolved this problem. You can download the latest version to make this patch.

 

 

  def _decodeExtra(self):          # Try to decode the extra field.          extra = self.extra          unpack = struct.unpack          while len(extra) >= 4:              tp, ln = unpack('<HH', extra[:4])

 

 

          ..... 


3. Manipulate unexpected value from search_methods()

 For example, a malicious sample can return unexpected values from search_methods("Landroid/media/MediaRecorder","setAudioSource", ".") so that
int(get_register_value(1, registers)) cannot get the correct information and will crash.
Some malware took advantage it to hide its "voice/audio recording" risk behavior.
It is the matter of how to write codes, not directly related with AndroGuard though.

Image
Image

Anyway, if you are doing some projects based on AndroGuard, make sure to download the latest version, which was updated in Dec 2012. The authors have added some fancy features,

Good job, AndroGuard guys!

form submtited
お読みいただきありがとうございました

このブログは役に立ちましたか?

dots pattern

Zscalerの最新ブログ情報を受信

このフォームを送信することで、Zscalerのプライバシー ポリシーに同意したものとみなされます。