quark.Objects package

Submodules

quark.Objects.apkinfo module

quark.Objects.bytecodeobject module

class quark.Objects.bytecodeobject.BytecodeObject(mnemonic, registers, parameter)

Bases: object

BytecodeObject is used to store the instructions in smali, including mnemonic, registers, parameter

mnemonic

Dalvik bytecode instructions set, for example ‘invoke-virtual’.

Returns:a string of mnemonic
parameter

Commonly used for functions called by invoke-kind instructions, for example ‘Lcom/google/progress/APNOperator;->deleteAPN()Z’.

Returns:a string of the function name
registers

Registers used in Dalvik instructions, for example ‘[v3]’.

Returns:a list containing all the registers used

quark.Objects.quark module

quark.Objects.quarkrule module

class quark.Objects.quarkrule.QuarkRule(json_filename)

Bases: object

RuleObject is used to store the rule from json file

api

Key native APIs that do the action and target in order.

Returns:a list recording the APIs class_name and method_name in order
check_item
crime

Description of given crime.

Returns:a string of the crime
get_score(confidence)

According to the state of the five stages, we calculate the weighted score based on exponential growth. For example, we captured the third stage in five stages, then the weighted score would be (2^3-1) / 2^4.

2^(confidence - 1)

Parameters:confidence –
Returns:floating point
permission

Permission requested by the apk to practice the crime.

Returns:a list of given permissions
rule_filename
score

The value used to calculate the weighted score

Returns:integer

quark.Objects.tableobject module

class quark.Objects.tableobject.TableObject(count_reg)

Bases: object

This table is used to track the usage of variables in the register

get_obj_list(index)

Return the list which contains the VariableObject.

Parameters:index – the index to get the corresponding VariableObject
Returns:a list containing VariableObject
get_table()

Get the entire hash table.

Returns:a two-dimensional list
hash_table
insert(index, var_obj)

Insert VariableObject into the nested list in the hashtable.

Parameters:
  • index – the index to insert to the table
  • var_obj – instance of VariableObject
Returns:

None
pop(index)

Override the built-in pop function, to get the top element, which is VariableObject on the stack while not delete it.

Parameters:index – the index to get the corresponding VariableObject
Returns:VariableObject

quark.Objects.registerobject module

class quark.Objects.registerobject.RegisterObject(register_name, value, called_by_func=None)

Bases: object

The RegisterObject is used to record the state of each register

called_by_func

Record which functions have been called by using this register as a parameter.

Returns:a list containing function name
hash_index

Get the index number from given VarabileObject.

Returns:an integer corresponding to the register index
register_name

Individual register name, for example ‘v3’.

Returns:a string of register name
value

The current value stored in the register.

Returns:a string of the value

Module contents