androguard.core.analysis package¶

The analysis module implements an abstraction layer for androguard.core.bytecodes.dvm.DalvikVMFormat objects. The the help of the androguard.core.analysis.analysis.Analsyis object, you can bundle several DEX files together. This is not only useful for multidex files, but also for a single dex, as Analysis offers many features to investigate DEX files. One of these features is crossreferencing (XREF). It allows you to build a graph of the methods inside the DEX files. You can then create callgraphs or find methods which use a specific API method.

Submodules¶

androguard.core.analysis.analysis module¶

class androguard.core.analysis.analysis.Analysis(vm=None)¶

Bases: object

add(vm)¶

Add a DalvikVMFormat to this Analysis

Parameters:	vm –

create_xref()¶

find_classes(name='.*', no_external=False)¶

Find classes by name, using regular expression This method will return all ClassAnalysis Object that match the name of the class.

Parameters:	name – regular expression for class name (default “.”) no_external* – Remove external classes from the output (default False)
Return type:	generator of ClassAnalysis

find_fields(classname='.*', fieldname='.*', fieldtype='.*', accessflags='.*')¶

find fields by regex

Parameters:	classname – regular expression of the classname fieldname – regular expression of the fieldname fieldtype – regular expression of the fieldtype accessflags – regular expression of the access flags
Return type:	generator of FieldClassAnalysis

find_methods(classname='.*', methodname='.*', descriptor='.*', accessflags='.*', no_external=False)¶

Find a method by name using regular expression. This method will return all MethodClassAnalysis objects, which match the classname, methodname, descriptor and accessflags of the method.

Parameters:	classname – regular expression for the classname methodname – regular expression for the method name descriptor – regular expression for the descriptor accessflags – regular expression for the accessflags no_external – Remove external method from the output (default False)
Return type:	generator of MethodClassAnalysis

find_strings(string='.*')¶

Find strings by regex

Parameters:	string – regular expression for the string to search for
Return type:	generator of StringAnalysis

get_class_analysis(class_name)¶

get_classes()¶

Returns a list of ClassAnalysis objects

Return type:	list of ClassAnalysis

get_external_classes()¶

Returns all external classes, that means all classes that are not defined in the given set of DalvikVMObjects.

Return type:	generator of ClassAnalysis

get_field_analysis(field)¶

get_fields()¶: Returns a list of FieldClassAnalysis objects

get_method(method)¶

Parameters:	method –
Returns:	MethodAnalysis object for the given method

get_method_analysis(method)¶

Parameters:	method –
Returns:	MethodClassAnalysis for the given method

get_method_analysis_by_name(class_name, method_name, method_descriptor)¶

get_method_by_name(class_name, method_name, method_descriptor)¶

get_methods()¶: Returns a list of MethodClassAnalysis objects

get_strings()¶

Returns a list of StringAnalysis objects

Return type:	list of StringAnalysis

get_strings_analysis()¶

is_class_present(class_name)¶

class androguard.core.analysis.analysis.BasicBlocks(_vm)¶

Bases: object

This class represents all basic blocks of a method

get()¶

Return type:	return each basic block (`DVMBasicBlock` object)

get_basic_block(idx)¶

get_basic_block_pos(idx)¶

gets()¶

Return type:	a list of basic blocks (`DVMBasicBlock` objects)

pop(idx)¶

push(bb)¶

class androguard.core.analysis.analysis.ClassAnalysis(classobj, internal=False)¶

Bases: object

AddFXrefRead(method, classobj, field)¶

AddFXrefWrite(method, classobj, field)¶

AddMXrefFrom(method1, classobj, method2, offset)¶

AddMXrefTo(method1, classobj, method2, offset)¶

AddXrefFrom(ref_kind, classobj, methodobj, offset)¶

AddXrefTo(ref_kind, classobj, methodobj, offset)¶

GetFakeMethod(name, descriptor)¶

get_field_analysis(field)¶

get_fields()¶: Return all FieldClassAnalysis objects of this class

get_method_analysis(method)¶

get_methods()¶: Return all MethodClassAnalysis objects of this class

get_nb_methods()¶: Get the number of methods in this class

get_vm_class()¶

get_xref_from()¶

get_xref_to()¶

class androguard.core.analysis.analysis.DVMBasicBlock(start, vm, method, context)¶

Bases: object

A simple basic block of a dalvik method

add_note(note)¶

clear_notes()¶

get_end()¶

get_exception_analysis()¶

get_instructions()¶

Get all instructions from a basic block.

Return type:	Return all instructions in the current basic block

get_last()¶

get_last_length()¶

get_method()¶

get_name()¶

get_nb_instructions()¶

get_next()¶

Get next basic blocks

Return type:	a list of the next basic blocks

get_notes()¶

get_prev()¶

Get previous basic blocks

Return type:	a list of the previous basic blocks

get_special_ins(idx)¶

Return the associated instruction to a specific instruction (for example a packed/sparse switch)

Parameters:	idx – the index of the instruction
Return type:	None or an Instruction

get_start()¶

push(i)¶

set_childs(values)¶

set_exception_analysis(exception_analysis)¶

set_fathers(f)¶

set_notes(value)¶

show()¶

class androguard.core.analysis.analysis.Enum(names)¶

Bases: object

tuples()¶

class androguard.core.analysis.analysis.ExceptionAnalysis(exception, bb)¶

Bases: object

get()¶

show_buff()¶

class androguard.core.analysis.analysis.Exceptions(_vm)¶

Bases: object

add(exceptions, basic_blocks)¶

get()¶

get_exception(addr_start, addr_end)¶

gets()¶

class androguard.core.analysis.analysis.ExternalClass(name)¶

Bases: object

GetMethod(name, descriptor)¶

get_methods()¶

get_name()¶: Returns the name of the ExternalClass object

class androguard.core.analysis.analysis.ExternalMethod(class_name, name, descriptor)¶

Bases: object

get_access_flags_string()¶

get_class_name()¶

get_descriptor()¶

get_name()¶

class androguard.core.analysis.analysis.FieldClassAnalysis(field)¶

Bases: object

AddXrefRead(classobj, methodobj)¶

AddXrefWrite(classobj, methodobj)¶

get_field()¶

get_xref_read()¶

get_xref_write()¶

class androguard.core.analysis.analysis.MethodAnalysis(vm, method)¶

Bases: object

get_basic_blocks()¶

Return type:	a `BasicBlocks` object

get_length()¶

Return type:	an integer which is the length of the code

get_method()¶

get_vm()¶

show()¶

Prints the content of this method to stdout.

This will print the method signature and the decompiled code.

class androguard.core.analysis.analysis.MethodClassAnalysis(method)¶

Bases: object

AddXrefFrom(classobj, methodobj, offset)¶

AddXrefTo(classobj, methodobj, offset)¶

get_method()¶: Return the EncodedMethod object that relates to this object :return: dvm.EncodedMethod

get_xref_from()¶

get_xref_to()¶

class androguard.core.analysis.analysis.StringAnalysis(value)¶

Bases: object

AddXrefFrom(classobj, methodobj)¶

get_orig_value()¶

get_value()¶

get_xref_from()¶

set_value(value)¶

class androguard.core.analysis.analysis.Tags(patterns={0: [0, 'Landroid'], 1: [0, 'Landroid/telephony'], 2: [0, 'Landroid/telephony/SmsManager'], 3: [0, 'Landroid/telephony/SmsMessage'], 4: [0, 'Landroid/accessibilityservice'], 5: [0, 'Landroid/accounts'], 6: [0, 'Landroid/animation'], 7: [0, 'Landroid/app'], 8: [0, 'Landroid/bluetooth'], 9: [0, 'Landroid/content'], 10: [0, 'Landroid/database'], 11: [0, 'Landroid/os/Debug'], 12: [0, 'Landroid/drm'], 13: [0, 'Landroid/gesture'], 14: [0, 'Landroid/graphics'], 15: [0, 'Landroid/hardware'], 16: [0, 'Landroid/inputmethodservice'], 17: [0, 'Landroid/location'], 18: [0, 'Landroid/media'], 19: [0, 'Landroid/mtp'], 20: [0, 'Landroid/net'], 21: [0, 'Landroid/nfc'], 22: [0, 'Landroid/opengl'], 23: [0, 'Landroid/os'], 24: [0, 'Landroid/preference'], 25: [0, 'Landroid/provider'], 26: [0, 'Landroid/renderscript'], 27: [0, 'Landroid/sax'], 28: [0, 'Landroid/security'], 29: [0, 'Landroid/service'], 30: [0, 'Landroid/speech'], 31: [0, 'Landroid/support'], 32: [0, 'Landroid/test'], 33: [0, 'Landroid/text'], 34: [0, 'Landroid/util'], 35: [0, 'Landroid/view'], 36: [0, 'Landroid/webkit'], 37: [0, 'Landroid/widget'], 38: [0, 'Ldalvik/bytecode'], 39: [0, 'Ldalvik/system'], 40: [0, 'Ljava/lang/reflect']}, reverse={0: 'ANDROID', 1: 'TELEPHONY', 2: 'SMS', 3: 'SMSMESSAGE', 4: 'ACCESSIBILITYSERVICE', 5: 'ACCOUNTS', 6: 'ANIMATION', 7: 'APP', 8: 'BLUETOOTH', 9: 'CONTENT', 10: 'DATABASE', 11: 'DEBUG', 12: 'DRM', 13: 'GESTURE', 14: 'GRAPHICS', 15: 'HARDWARE', 16: 'INPUTMETHODSERVICE', 17: 'LOCATION', 18: 'MEDIA', 19: 'MTP', 20: 'NET', 21: 'NFC', 22: 'OPENGL', 23: 'OS', 24: 'PREFERENCE', 25: 'PROVIDER', 26: 'RENDERSCRIPT', 27: 'SAX', 28: 'SECURITY', 29: 'SERVICE', 30: 'SPEECH', 31: 'SUPPORT', 32: 'TEST', 33: 'TEXT', 34: 'UTIL', 35: 'VIEW', 36: 'WEBKIT', 37: 'WIDGET', 38: 'DALVIK_BYTECODE', 39: 'DALVIK_SYSTEM', 40: 'JAVA_REFLECTION'})¶

Bases: object

Handle specific tags

Parameters:	patterns –
Params reverse:

emit(method)¶

emit_by_classname(classname)¶

empty()¶

get_list()¶

androguard.core.analysis.analysis.is_ascii_obfuscation(vm)¶

Tests if any class inside a DalvikVMObject uses ASCII Obfuscation (e.g. UTF-8 Chars in Classnames)

Parameters:	vm – DalvikVMObject
Returns:	True if ascii obfuscation otherwise False

androguard.core.analysis.auto module¶

class androguard.core.analysis.auto.AndroAuto(settings)¶

Bases: object

The main class which analyse automatically android apps by calling methods from a specific object :param settings: the settings of the analysis :type settings: dict

dump()¶: Dump the analysis

dump_file(filename)¶: Dump the analysis in a filename

go()¶: Launch the analysis

class androguard.core.analysis.auto.DefaultAndroAnalysis¶

Bases: object

This class can be used as a template in order to analyse apps

analysis_adex(log, adexobj)¶