├── .cargo └── config ├── .github └── ISSUE_TEMPLATE │ ├── bug_report.md │ └── feature_request.md ├── .gitignore ├── .travis.yml ├── CHANGELOG.md ├── CODE_OF_CONDUCT.md ├── Cargo.lock ├── Cargo.toml ├── DCO.txt ├── LICENSE ├── PULL_REQUEST_TEMPLATE.md ├── README.md ├── build.rs ├── centos_build.sh ├── clippy.toml ├── config.toml ├── config.toml.sample ├── contributing.md ├── debian_build.sh ├── fedora_build.sh ├── rpmbuild └── super.spec ├── rules.json ├── src ├── banner.txt ├── cli.rs ├── config.rs ├── criticality.rs ├── decompilation.rs ├── error.rs ├── lib.rs ├── main.rs ├── results │ ├── handlebars_helpers.rs │ ├── mod.rs │ ├── report │ │ ├── handlebars.rs │ │ ├── json.rs │ │ └── mod.rs │ ├── sdk_number.rs │ └── utils.rs ├── static_analysis │ ├── certificate.rs │ ├── code.rs │ ├── manifest.rs │ └── mod.rs └── utils.rs ├── templates └── super │ ├── code.hbs │ ├── css │ ├── androidstudio.css │ └── style.css │ ├── img │ ├── folder.svg │ ├── java.svg │ ├── logo.svg │ ├── report.svg │ └── xml.svg │ ├── js │ ├── highlight.js.LICENSE │ ├── highlight.pack.js │ ├── jquery-3.3.1.slim.min.js │ ├── jquery.LICENSE │ └── src_nav.js │ ├── report.hbs │ ├── src.hbs │ └── vulnerability.hbs ├── travis-helper.sh ├── ubuntu_build.sh └── vendor ├── dex2jar-2.1-SNAPSHOT ├── LICENSE.txt ├── NOTICE.txt ├── bin │ ├── dex-tools │ └── dex-tools.bat ├── d2j-apk-sign.bat ├── d2j-apk-sign.sh ├── d2j-asm-verify.bat ├── d2j-asm-verify.sh ├── d2j-baksmali.bat ├── d2j-baksmali.sh ├── d2j-class-version-switch.bat ├── d2j-class-version-switch.sh ├── d2j-decrypt-string.bat ├── d2j-decrypt-string.sh ├── d2j-dex-recompute-checksum.bat ├── d2j-dex-recompute-checksum.sh ├── d2j-dex-weaver.bat ├── d2j-dex-weaver.sh ├── d2j-dex2jar.bat ├── d2j-dex2jar.sh ├── d2j-dex2smali.bat ├── d2j-dex2smali.sh ├── d2j-jar-access.bat ├── d2j-jar-access.sh ├── d2j-jar-weaver.bat ├── d2j-jar-weaver.sh ├── d2j-jar2dex.bat ├── d2j-jar2dex.sh ├── d2j-jar2jasmin.bat ├── d2j-jar2jasmin.sh ├── d2j-jasmin2jar.bat ├── d2j-jasmin2jar.sh ├── d2j-smali.bat ├── d2j-smali.sh ├── d2j-std-apk.bat ├── d2j-std-apk.sh ├── d2j_invoke.bat ├── d2j_invoke.sh └── lib │ ├── ST4-4.0.8.jar │ ├── antlr-3.5.2.jar │ ├── antlr-runtime-3.5.2.jar │ ├── antlr4-4.5.jar │ ├── antlr4-runtime-4.5.jar │ ├── asm-debug-all-5.0.3.jar │ ├── d2j-base-cmd-2.1-SNAPSHOT.jar │ ├── d2j-jasmin-2.1-SNAPSHOT.jar │ ├── d2j-smali-2.1-SNAPSHOT.jar │ ├── dex-ir-2.1-SNAPSHOT.jar │ ├── dex-reader-2.1-SNAPSHOT.jar │ ├── dex-reader-api-2.1-SNAPSHOT.jar │ ├── dex-tools-2.1-SNAPSHOT.jar │ ├── dex-translator-2.1-SNAPSHOT.jar │ ├── dex-writer-2.1-SNAPSHOT.jar │ ├── dx-23.0.0.jar │ ├── open-source-license.txt │ └── org.abego.treelayout.core-1.0.1.jar ├── jd-cmd.LICENSE.txt └── jd-cmd.jar /.cargo/config: -------------------------------------------------------------------------------- 1 | [target.x86_64-pc-windows-gnu] 2 | ar="x86_64-w64-mingw32-gcc" 3 | linker="x86_64-w64-mingw32-gcc" 4 | 5 | [target.i686-pc-windows-gnu] 6 | ar="i686-w64-mingw32-gcc" 7 | linker="i686-w64-mingw32-gcc" 8 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: Create a report to help us improve 4 | 5 | --- 6 | 7 | **Bug description** 8 | A clear and concise description of what the bug is. 9 | 10 | **To Reproduce** 11 | Steps to reproduce the behavior (example): 12 | 1. Download '...' 13 | 2. Run '...' 14 | 3. Check report at '...' 15 | 4. See error 16 | 17 | **Expected behavior** 18 | A clear and concise description of what you expected to happen. 19 | 20 | **Screenshots** 21 | If applicable, add screenshots to help explain your problem. 22 | 23 | **Setup (please complete the following information):** 24 | - OS: [e.g. Windows 10] 25 | - SUPER Version: [e.g. 0.5.0] 26 | - Browser (for reports): [e.g. firefox, opera] 27 | 28 | **Additional context** 29 | Add any other context about the problem here. 30 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature request 3 | about: Suggest an idea for this project 4 | 5 | --- 6 | 7 | **Is your feature request related to a problem? Please describe.** 8 | A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] 9 | 10 | **Describe the solution you'd like** 11 | A clear and concise description of what you want to happen. 12 | 13 | **Describe alternatives you've considered** 14 | A clear and concise description of any alternative solutions or features you've considered. 15 | 16 | **Additional context** 17 | Add any other context or screenshots about the feature request here. 18 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | downloads/* 2 | dist/* 3 | results/* 4 | target/* 5 | releases/* 6 | rpmbuild/* 7 | !rpmbuild/super.spec 8 | *.bk 9 | *.apk 10 | .DS_Store 11 | *.zip 12 | *.log 13 | .vscode 14 | CHECKSUM_FILE_BEFORE -------------------------------------------------------------------------------- /.travis.yml: -------------------------------------------------------------------------------- 1 | language: rust 2 | cache: 3 | cargo: true 4 | timeout: 500 5 | dist: xenial 6 | sudo: true 7 | 8 | # Run builds in Linux, MacOS X and Windows 9 | os: 10 | - linux 11 | - osx 12 | - windows 13 | 14 | # Run builds for all the supported trains 15 | rust: 16 | - 1.31.0 17 | - stable 18 | - beta 19 | - nightly 20 | 21 | stages: 22 | - test 23 | - deploy 24 | 25 | # Extra jobs to include 26 | jobs: 27 | include: 28 | # Test package generation for multiple distributions 29 | - name: "Debian packaging" 30 | os: linux 31 | rust: stable 32 | stage: test 33 | env: CACHE_NAME=DEBIAN 34 | services: docker 35 | script: ./travis-helper.sh dist_test debian 36 | - name: "Ubuntu packaging" 37 | os: linux 38 | rust: stable 39 | stage: test 40 | env: CACHE_NAME=UBUNTU 41 | services: docker 42 | script: ./travis-helper.sh dist_test ubuntu 43 | - name: "Fedora packaging" 44 | os: linux 45 | rust: stable 46 | stage: test 47 | env: CACHE_NAME=FEDORA 48 | services: docker 49 | script: ./travis-helper.sh dist_test fedora 50 | - name: "CentOS packaging" 51 | os: linux 52 | rust: stable 53 | stage: test 54 | env: CACHE_NAME=CENTOS 55 | services: docker 56 | script: ./travis-helper.sh dist_test centos 57 | # Test unstable features 58 | - name: "Unstable features" 59 | os: linux 60 | rust: nightly 61 | stage: test 62 | env: CACHE_NAME=UNSTABLE 63 | services: docker 64 | script: ./travis-helper.sh test_unstable 65 | # Upload documentation 66 | - name: "Documentation upload" 67 | os: linux 68 | rust: stable 69 | stage: deploy 70 | env: CACHE_NAME=DOCS 71 | script: ./travis-helper.sh documentation 72 | deploy: &pages 73 | provider: pages 74 | github-token: $GH_TOKEN 75 | local-dir: target/doc/ 76 | skip_cleanup: true 77 | keep-history: true 78 | on: 79 | repo: SUPERAndroidAnalyzer/super 80 | branch: develop 81 | # Deploy the release 82 | - name: "Release deployment" 83 | os: linux 84 | rust: stable 85 | stage: deploy 86 | env: CACHE_NAME=DEPLOY 87 | script: ./travis-helper.sh deploy 88 | deploy: &releases 89 | provider: releases 90 | api_key: $GH_TOKEN 91 | file_glob: true 92 | file: releases/* 93 | skip_cleanup: true 94 | prerelease: true # TODO: remove on 1.0 95 | name: "SUPER $TRAVIS_TAG" 96 | on: 97 | repo: SUPERAndroidAnalyzer/super 98 | tags: true 99 | 100 | matrix: 101 | allow_failures: 102 | - os: windows 103 | 104 | before_script: 105 | - export PATH=$PATH:~/.cargo/bin 106 | # TODO: change tag when bumping version number. (Maintain in sync with Cargo.toml) 107 | - | 108 | if [[ $TRAVIS_TAG ]]; then 109 | export TAG=$TRAVIS_TAG; 110 | else 111 | export TAG="0.5.1"; 112 | fi 113 | 114 | # Run the multiple tests. 115 | script: 116 | - ./travis-helper.sh fmt_check 117 | - ./travis-helper.sh clippy_check 118 | - ./travis-helper.sh test 119 | - ./travis-helper.sh test_ignored 120 | 121 | # Upload code coverage report 122 | after_success: 123 | - ./travis-helper.sh upload_code_coverage 124 | 125 | notifications: 126 | email: 127 | recipients: 128 | - razican@protonmail.ch 129 | - brunoop@protonmail.ch 130 | - sergiodlo@protonmail.com 131 | - jaimesr@protonmail.ch 132 | on_success: change 133 | on_failure: always 134 | -------------------------------------------------------------------------------- /CHANGELOG.md: -------------------------------------------------------------------------------- 1 | # Changelog 2 | 3 | ## SUPER 0.5.1 4 | 5 | This release is the first SUPER release targeting Rust 2018 edition. It contains some internal 6 | improvements that will make future development easier and more efficient. It also has some 7 | internal enhancements. Additionally, we have fixed a bunch of spelling mistakes and upgraded some 8 | dependencies. 9 | 10 | ### Internal Changes 11 | 12 | - SUPER now requires Rust 1.31.0 (Rust 2018 edition) to be built. 13 | - Upgraded dependencies: 14 | - `lazy_static`: 1.1 => **1.2** 15 | - `md5`: 0.5 => **0.6** 16 | - `regex`: 1.0 => **1.1** 17 | - `abxml`: 0.6 => **0.7** 18 | - Some other minor upgrades. 19 | 20 | - Multiple syntax changes to adapt the codebase to Rust 2018. 21 | 22 | ## SUPER 0.5.0 23 | 24 | This release contains multiple improvements that have been accumulated in the last year. We also 25 | improved our repository by adding a Code of Conduct and templates for issues and pull requests. 26 | Packages for Ubuntu, Debian, Fedora and CentOS are now generated automatically in each build, and 27 | deployed in each release. Here you can find the rest of the changes for this version. 28 | 29 | ### Features 30 | 31 | - Added SDK version strings to Android versions. Reports will now show the Android version of the 32 | target and minimum SDKs. 33 | - SUPER logo is now an SVG, so that it looks great in multiple resolutions. 34 | - All icons in the source tree viewer are now SVGs too. 35 | 36 | ### Internal Changes 37 | 38 | - SUPER now requires Rust 1.30.0 to be built. 39 | - Removed `error-chain` dependency in favor of `failure`. 40 | - Upgraded dependencies: 41 | - `clap`: 2.25 => **2.32** 42 | - `xml-rs`: 0.4 => **0.8** 43 | - `serde`: 0.9 => **1.0** 44 | - `chrono`: 0.3 => **0.4** 45 | - `toml`: 0.3 => **0.4** 46 | - `regex`: 0.2 => **1.0** 47 | - `lazy_static`: 0.2 => **1.1** 48 | - `bytecount`: 0.1 => **0.4** 49 | - `log`: 0.3 => **0.4** 50 | - `env_logger`: 0.4 => **0.5** 51 | - `sha1`: 0.2 => **0.6** 52 | - `sha2`: 0.5 => **0.8** 53 | - `abxml`: 0.2 => **0.6** 54 | - `handlebars`: 0.25 => **1.1** 55 | - Some other minor upgrades. 56 | - New dependencies: 57 | - `failure`: 0.1 58 | - `semver`: 0.9 59 | - `hex`: 0.3 60 | - `num_cpus`: 1.8 61 | - Multiple documentation improvements. 62 | - Code quality improved by using new syntax. 63 | - Fixed multiple performance bottlenecks. 64 | - Switched to library/binary architechture. 65 | 66 | ### Bug Fixes 67 | 68 | - Fixed decompilation of badly formatted APK files. 69 | - Fixed strange characters in Windows Console. 70 | 71 | ## SUPER 0.4.1 72 | 73 | ### Internal Changes 74 | 75 | - Upgraded `abxml` to **0.2.0**. 76 | 77 | ### Bug Fixes 78 | 79 | - SUPER now properly creates `dist` and `results` directories if they do not exist. 80 | 81 | ## SUPER 0.4.0 82 | 83 | ### Features 84 | 85 | - Removed ApkTool dependency, analysis are now about 20% - 50% faster. 86 | - Removed all ApkTool related configuration and CLI directives. 87 | - The `--force` flag is now less aggressive. It won't remove a JSON report if only the HTML report 88 | is being generated, and the othey way around: it won't remove the HTML report if only the JSON 89 | report is being generated. 90 | 91 | ### Internal Changes 92 | 93 | - SUPER now requires Rust 1.16.0 to be built. 94 | - Errors moved to their own module. 95 | - Upgraded dependencies: 96 | - `clap`: 2.20 => **2.23** 97 | - `xml-rs`: 0.3 => **0.4** 98 | - And some other minor upgrades. 99 | - Dependency in `yaml-rust` has been removed. 100 | - Dependency in `error-chain` 0.10 has been added. 101 | - Dependency in `rust-crypto` has been removed and dependencies in `md5`, `sha1` and `sha2` have 102 | been added. 103 | - Dependency in `abxml` has been added to remove the ApkTool dependency. 104 | - Added more documentation for some modules. 105 | 106 | ### Bug Fixes 107 | 108 | - Fixed error when adding `--open` flag on JSON-only reports. 109 | 110 | ## SUPER 0.3.1 111 | 112 | ### Bug Fixes 113 | 114 | - SUPER will now have `super-analyzer` as package name. This avoids conflicts with Debian 115 | repositories. 116 | 117 | ## SUPER 0.3.0 118 | 119 | ### Features 120 | 121 | - You can now specify the minimum criticality of a vulnerability for being reported. Using the 122 | `--min-criticality` CLI option, you can specify if the minimum reported criticality should be 123 | *warning*, *low*, *medium*, *high* or *critical*. 124 | - Optional JSON and HTML reports: By default, SUPER will generate an HTML report, but no JSON 125 | report. This behaviour can be changed either by changing two configuration options in the 126 | *config.toml* file (`html_report` and `json_report`) or by invoking the script with `--json` or 127 | `--html` parameters. By default, if `--json` is used, the HTML report won't get generated, but if 128 | you want both, you can specify so by using both options: `--json --html`. 129 | - Tab completions: If you now install SUPER using one of the provided packages for UNIX, you will 130 | get tab completions. So, anytime you don't exactly know the command, you can simply press TAB and 131 | you will get suggestions or even command completions. This works for Bash, Fish and ZSH. 132 | 133 | ### Internal Changes 134 | 135 | - SUPER now requires Rust 1.15.1. 136 | - Converted all `try!()` statements to use the new `?` Rust operator. 137 | - Reduced cyclomatic complexity of Config::load_from_file() (#78): This makes configuration loading 138 | faster and easily maintainable. 139 | - Improved logging using the `log` crate. 140 | - Upgraded dependencies: 141 | - `clap`: 2.18 => **2.20** 142 | - `colored`: 1.3 => **1.4** 143 | - `serde`: 0.8 => **0.9** 144 | - `handlebars`: 0.22 => **0.25** 145 | - `chrono`: 0.2 => **0.3** 146 | - `regex`: 0.1 => **0.2** 147 | And some other minor upgrades. Both the `regex` and the `serde` dependencies have been the major 148 | upgrades and should improve our future releases. 149 | 150 | ### Changes in Rules 151 | 152 | - Changed some regexes to match the new `regex` crate classes. 153 | - The files to be searched with a given rule can now be filtered by two new fields: 154 | - `include_file_regex`: A regex that all tested files will match. 155 | - `exclude_file_regex`: A regex that will whitelist files matched by the previous regex. 156 | This enables much better file searching: If you need to search for `R` class variables, no need 157 | to search other files than `R.java`. 158 | 159 | ### Bug Fixes 160 | 161 | - SUPER no longer prints to `stderr` on tests. 162 | - Finally fixed all output coloring errors. 163 | 164 | ### Contributions 165 | 166 | Apart from the core team, the following people has contributed to this release: 167 | - **[@gnieto](https://github.com/gnieto)** 168 | 169 | ## SUPER 0.2.0 170 | 171 | ### Features 172 | 173 | - SUPER now uses templates for report generation. This is one of the biggest changes of the 174 | release, and enables users to create their own report templates. 175 | - Installation package for Mac OS. 176 | - Line highlighting is now shown in the vulnerable line of the code in found vulnerabilities, 177 | colored depending on the criticality of the vulnerability. 178 | - Reports now show the version of SUPER used to generate them. 179 | - SUPER now supports analysis of applications placed anywhere instead of having to place them 180 | in a folder. 181 | - Added the `--open` option to automatically open reports. 182 | - Added the `--test-all` option to the CLI, that will test all *.apk* files in the *downloads* 183 | folder. 184 | - Added options to the CLI to modify the properties in the config file. We now have 185 | `--downloads`, `--threads`, `--dist`, `--results`, `--apktool`, `--dex2jar`, `--jd-cmd`, 186 | `--rules` or `--template` options in the CLI. 187 | 188 | ### Changes in Rules 189 | 190 | - SUPER now detects `exported` attributes in ``, ``, ``, 191 | `` and `` tags in the *AndroidManifest.xml*, and reports potential 192 | vulnerabilities. This still needs work since we still don't have all the required information to 193 | show real vulnerabilities. 194 | 195 | ### Bug Fixes 196 | 197 | - Changed paths for better multiplatform support. 198 | - Regular Expressions: 199 | - URL Disclosure no longer detects content providers (`content://...`). 200 | - Solved some coloring errors when combining styling and color in the same print. 201 | 202 | ### Contributions 203 | 204 | Apart from the core team, the following people has contributed to this release: 205 | - **[@pocket7878](https://github.com/pocket7878)** 206 | - **[@VoltBit](https://github.com/VoltBit)** 207 | - **[@b52](https://github.com/b52)** 208 | - **[@nxnfufunezn](https://github.com/nxnfufunezn)** 209 | - **[@atk](https://github.com/atk)** 210 | 211 | 212 | ## SUPER 0.1.0 213 | 214 | ### Features 215 | 216 | - Release of 64-bit packages for Linux (Debian 8.6, Ubuntu 16.04, CentOS 7, Fedora 24) and Windows 217 | (8.1+). 218 | - *AndroidManifest.xml* analysis (Dangerous permission checks). 219 | - Certificate analysis (Certificate validity checks). 220 | - Code analysis (37 rules for checking the source code): 221 | - SQLi 222 | - XSS 223 | - URL Disclosure 224 | - Weak algorithms 225 | - Insecure WebViews 226 | - Generic exceptions 227 | - Root detection 228 | - ... 229 | - HTML and JSON report generation. 230 | - Classification of vulnerabilities (Critical, High, Medium, Low, Info). 231 | - Application related info. 232 | - File fingerprinting. 233 | -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | # Contributor Covenant Code of Conduct 2 | 3 | ## Our Pledge 4 | 5 | In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation. 6 | 7 | ## Our Standards 8 | 9 | Examples of behavior that contributes to creating a positive environment include: 10 | 11 | * Using welcoming and inclusive language 12 | * Being respectful of differing viewpoints and experiences 13 | * Gracefully accepting constructive criticism 14 | * Focusing on what is best for the community 15 | * Showing empathy towards other community members 16 | 17 | Examples of unacceptable behavior by participants include: 18 | 19 | * The use of sexualized language or imagery and unwelcome sexual attention or advances 20 | * Trolling, insulting/derogatory comments, and personal or political attacks 21 | * Public or private harassment 22 | * Publishing others' private information, such as a physical or electronic address, without explicit permission 23 | * Other conduct which could reasonably be considered inappropriate in a professional setting 24 | 25 | ## Our Responsibilities 26 | 27 | Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. 28 | 29 | Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. 30 | 31 | ## Scope 32 | 33 | This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. 34 | 35 | ## Enforcement 36 | 37 | Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at contact@superanalyzer.rocks. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. 38 | 39 | Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. 40 | 41 | ## Attribution 42 | 43 | This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version] 44 | 45 | [homepage]: http://contributor-covenant.org 46 | [version]: http://contributor-covenant.org/version/1/4/ 47 | -------------------------------------------------------------------------------- /Cargo.toml: -------------------------------------------------------------------------------- 1 | [package] 2 | name = "super-analyzer" 3 | version = "0.5.1" 4 | authors = [ 5 | "Iban Eguia ", 6 | "Jaime Salas ", 7 | "Bruno Pin ", 8 | "Sergio de los Dolores "] 9 | edition = "2018" 10 | license = "GPL-3.0" 11 | readme = "README.md" 12 | repository = "https://github.com/SUPERAndroidAnalyzer/super" 13 | homepage = "https://superanalyzer.rocks" 14 | description = """\ 15 | Secure, Unified, Powerful and Extensible Rust Android Analyzer. Core software\ 16 | with CLI.\ 17 | """ 18 | keywords = ["Android", "security", "audit", "super", "analyzer"] 19 | categories = ["command-line-utilities", "development-tools"] 20 | 21 | [package.metadata.deb] 22 | maintainer = "SUPER Team " 23 | copyright = "2016 - 2018, SUPER Team " 24 | license-file = ["LICENSE", "0"] 25 | extended-description = """\ 26 | Secure, Unified, Powerful and Extensible Rust Android Analyzer. Core software\ 27 | with CLI.""" 28 | depends = "libc6, libgcc1, default-jre-headless, bash" 29 | section = "devel" 30 | priority = "optional" 31 | assets = [ 32 | # Executable 33 | ["target/release/super-analyzer", "usr/bin/", "755"], 34 | 35 | # Completion scripts 36 | #["target/release/super.bash", "usr/share/bash-completion/completions/", "755"], 37 | #["target/release/super.fish", "usr/share/fish/vendor_completions.d/", "755"], 38 | #["target/release/_super", "usr/share/zsh/vendor-completions/", "755"], 39 | 40 | # JD-CMD 41 | ["vendor/jd-cmd.jar", "usr/share/super-analyzer/vendor/", "755"], 42 | ["vendor/jd-cmd.LICENSE.txt", "usr/share/super-analyzer/vendor/", "644"], 43 | 44 | # Dex2Jar 45 | ["vendor/dex2jar-2.1-SNAPSHOT/LICENSE.txt", "usr/share/super-analyzer/vendor/dex2jar-2.1-SNAPSHOT/", "644"], 46 | ["vendor/dex2jar-2.1-SNAPSHOT/*.sh", "usr/share/super-analyzer/vendor/dex2jar-2.1-SNAPSHOT/", "755"], 47 | ["vendor/dex2jar-2.1-SNAPSHOT/lib/*", "usr/share/super-analyzer/vendor/dex2jar-2.1-SNAPSHOT/lib/", "755"], 48 | ["vendor/dex2jar-2.1-SNAPSHOT/bin/dex-tools", "usr/share/super-analyzer/vendor/dex2jar-2.1-SNAPSHOT/bin/", "755"], 49 | 50 | # Web assets 51 | ["templates/super/css/*", "usr/share/super-analyzer/templates/super/css/", "644"], 52 | ["templates/super/img/*", "usr/share/super-analyzer/templates/super/img/", "644"], 53 | ["templates/super/js/*", "usr/share/super-analyzer/templates/super/js/", "644"], 54 | 55 | # Templates 56 | ["templates/super/*", "usr/share/super-analyzer/templates/super/", "644"], 57 | 58 | # Configuration 59 | ["rules.json", "etc/super-analyzer/", "644"], 60 | ["config.toml", "etc/super-analyzer/", "644"], 61 | ["config.toml.sample", "etc/super-analyzer/", "644"], 62 | 63 | # README 64 | ["README.md", "usr/share/doc/super-analyzer/README.md", "644"], 65 | ] 66 | 67 | [badges] 68 | travis-ci = { repository = "SUPERAndroidAnalyzer/super", branch = "master" } 69 | codecov = { repository = "SUPERAndroidAnalyzer/super", branch = "master", service = "github" } 70 | is-it-maintained-issue-resolution = { repository = "SUPERAndroidAnalyzer/super" } 71 | is-it-maintained-open-issues = { repository = "SUPERAndroidAnalyzer/super" } 72 | maintenance = { status = "experimental" } 73 | 74 | [[bin]] 75 | name = "super-analyzer" 76 | path = "src/main.rs" 77 | 78 | [lib] 79 | name = "super_analyzer_core" 80 | path = "src/lib.rs" 81 | 82 | [dependencies] 83 | failure = "0.1.3" 84 | failure_derive = "0.1.3" 85 | clap = "2.32.0" 86 | xml-rs = "0.8.0" 87 | serde = "1.0.81" 88 | serde_derive = "1.0.81" 89 | serde_json = "1.0.33" 90 | chrono = { version = "0.4.6", features = ["serde"] } 91 | toml = "0.4.10" 92 | regex = "1.1.0" 93 | lazy_static = "1.2.0" 94 | open = "1.2.2" 95 | bytecount = "0.4.0" 96 | log = "0.4.6" 97 | env_logger = "0.6.0" 98 | md5 = "0.6.0" 99 | sha1 = "0.6.0" 100 | sha2 = "0.8.0" 101 | abxml = "0.7.1" 102 | handlebars = "1.1.0" 103 | semver = "0.9.0" 104 | hex = "0.3.2" 105 | num_cpus = "1.8.0" 106 | colored = "1.6.1" 107 | 108 | [build-dependencies] 109 | clap = "2.32.0" 110 | 111 | [dev-dependencies] 112 | reqwest = "0.9.5" 113 | 114 | [features] 115 | default = [] 116 | unstable = ["certificate"] 117 | no-color = ["colored/no-color"] 118 | certificate = [] 119 | 120 | # The release profile, used for `cargo build`. 121 | [profile.dev] 122 | incremental = true 123 | opt-level = 0 124 | debug = true 125 | rpath = false 126 | lto = false 127 | debug-assertions = true 128 | overflow-checks = true 129 | panic = 'unwind' 130 | 131 | # The release profile, used for `cargo build --release`. 132 | [profile.release] 133 | incremental = false 134 | opt-level = 3 135 | debug = false 136 | rpath = false 137 | codegen-units = 1 138 | lto = true 139 | debug-assertions = false 140 | overflow-checks = false 141 | panic = 'unwind' 142 | -------------------------------------------------------------------------------- /DCO.txt: -------------------------------------------------------------------------------- 1 | Developer's Certificate of Origin 1.1 2 | 3 | By making a contribution to this project, I certify that: 4 | 5 | (a) The contribution was created in whole or in part by me and I 6 | have the right to submit it under the open source license 7 | indicated in the file; or 8 | 9 | (b) The contribution is based upon previous work that, to the best 10 | of my knowledge, is covered under an appropriate open source 11 | license and I have the right under that license to submit that 12 | work with modifications, whether created in whole or in part 13 | by me, under the same open source license (unless I am 14 | permitted to submit under a different license), as indicated 15 | in the file; or 16 | 17 | (c) The contribution was provided directly to me by some other 18 | person who certified (a), (b) or (c) and I have not modified 19 | it. 20 | 21 | (d) I understand and agree that this project and the contribution 22 | are public and that a record of the contribution (including all 23 | personal information I submit with it, including my sign-off) is 24 | maintained indefinitely and may be redistributed consistent with 25 | this project or the open source license(s) involved. 26 | -------------------------------------------------------------------------------- /PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | **Description** 2 | A clear and concise description of what the pull request is about. 3 | If it's a new feature, explain what it does, if it's a fix, explain what it fixes. 4 | 5 | **Related issues** 6 | Mention any issue that this pull request might fix or could be related to. You can use the `#123` notation. 7 | 8 | **Ping contributors** 9 | Mention any relevant contributor to the project using the `@` notation, such as `@Razican`. 10 | If you don't know who to mention, `@SUPERAndroidAnalyzer/all` is a safe bet. 11 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # SUPER Android Analyzer # 2 | 3 | [![Build Status][linux_mac_build_img]][linux_mac_build] 4 | [![codecov][coverage_img]][coverage] 5 | 6 | SUPER Android Analyzer logo 7 | 8 | *Secure, Unified, Powerful and Extensible Rust Android Analyzer* 9 | 10 | SUPER is a command-line application that can be used in Windows, MacOS X and Linux, that analyzes 11 | *.apk* files in search for vulnerabilities. It does this by decompressing APKs and applying a series 12 | of rules to detect those vulnerabilities. 13 | 14 | But, why create a new analyzer? Is it not enough with MobSF, Qark, Androbugs…? Well, we think it's 15 | not enough. All of them have two main issues we wanted to fix: They are written in Java or Python 16 | and they are not easily extensible. They are not meant to be used by businesses directly working in 17 | Android analysis, and don't put that kind of functionality first. 18 | 19 | Our approach solves those issues in different ways: We first decided to use **Rust** as our 20 | programming language. The language developed openly by Mozilla Foundation gives us lots of 21 | utilities to work with regular expressions, files etc. and, most importantly, it enables us to 22 | create a secure software that does not depend in *JVM* or *JIT* compilers. With Rust, stack 23 | overflows, segmentation faults etc. are directly not possible, which makes sense in a security 24 | centered application. And it also gives us enough power to do efficient analysis, giving us the 25 | option to automate it in high volume. This is given by Rust zero-cost abstractions, that gives us 26 | an efficiency only comparable to C/C++. 27 | 28 | And secondly, we decided to make the software 100% extensible: All rules are centered in a 29 | `rules.json` file, and each company or tester could create its own rules to analyze what they need. 30 | It's also modular, so that new developments can easily add new functionality. Finally, a templating 31 | system for results reports gives users the ability to personalize the report. 32 | 33 | It also gives great code review tools, directly in the HTML report, so that anyone can search 34 | through the generated code with syntax highlighting for even better vulnerability analysis. 35 | 36 | ## Installation ## 37 | 38 | We have released some binaries in the [download page][downloads] for Windows (8.1+), Linux, and 39 | MacOS X. We only have 64-bit packages for now. If you need to use SUPER in a 32-bit system, you 40 | will need to [compile SUPER from source][compile]. For that, you will need to install **Rust** with 41 | [rustup.rs][rustup]. 42 | 43 | *Note: It requires Java 1.7+ to run.* 44 | 45 | ## Usage ## 46 | 47 | SUPER is very easy to use. Just download the desired *.apk* into the *downloads* folder (create 48 | that folder if necessary) and use the name as an argument when running the program. After the 49 | execution, a detailed report will appear in the *results* folder with that application name. There 50 | are a few usage options available: 51 | 52 | ``` 53 | USAGE: 54 | super [FLAGS] [OPTIONS] 55 | 56 | FLAGS: 57 | --bench Show benchmarks for the analysis 58 | --force If you'd like to force the auditor to do everything from the beginning 59 | -h, --help Prints help information 60 | --html Generates the reults in HTML format 61 | --json Generates the reults in JSON format 62 | --open Open the report in a browser once it is complete 63 | -q, --quiet If you'd like a zen auditor that won't output anything in stdout 64 | -a, --test-all Test all .apk files in the downloads directory 65 | -V, --version Prints version information 66 | -v, --verbose If you'd like the auditor to talk more than necessary 67 | 68 | OPTIONS: 69 | --dex2jar Where to store the jar files 70 | --dist Folder where distribution files will be extracted 71 | --downloads Folder where the downloads are stored 72 | --jd-cmd Path to the jd-cmd file 73 | --min-criticality Set a minimum criticality to analyze (Critical, High, Medium, Low) 74 | --results Folder where to store the results 75 | --rules Path to a JSON rules file 76 | --template