quark.Objects package¶
Submodules¶
quark.Objects.apkinfo module¶
quark.Objects.bytecodeobject module¶
-
class
quark.Objects.bytecodeobject.BytecodeObject(mnemonic, registers, parameter)¶ Bases:
objectBytecodeObject is used to store the instructions in smali, including mnemonic, registers, parameter
-
mnemonic¶ Dalvik bytecode instructions set, for example ‘invoke-virtual’.
Returns: a string of mnemonic
-
parameter¶ Commonly used for functions called by invoke-kind instructions, for example ‘Lcom/google/progress/APNOperator;->deleteAPN()Z’.
Returns: a string of the function name
-
registers¶ Registers used in Dalvik instructions, for example ‘[v3]’.
Returns: a list containing all the registers used
-
quark.Objects.ruleobject module¶
-
class
quark.Objects.ruleobject.RuleObject(json_filename)¶ Bases:
objectRuleObject is used to store the rule from json file
-
crime¶ Description of given crime.
Returns: a string of the crime
-
get_score(confidence)¶ According to the state of the five stages, we calculate the weighted score based on exponential growth. For example, we captured the third stage in five stages, then the weighted score would be (2^3-1) / 2^4.
2^(confidence - 1)
Parameters: confidence – Returns: floating point
-
x1_permission¶ Permission requested by the apk to practice the crime.
Returns: a list of given permissions
-
x2n3n4_comb¶ Key native APIs that do the action and target in order.
Returns: a list recording the APIs class_name and method_name in order
-
yscore¶ The value used to calculate the weighted score
Returns: integer
-
quark.Objects.tableobject module¶
-
class
quark.Objects.tableobject.TableObject(count_reg)¶ Bases:
objectThis table is used to track the usage of variables in the register
-
get_obj_list(index)¶ Return the list which contains the VariableObject.
Parameters: index – the index to get the corresponding VariableObject Returns: a list containing VariableObject
-
get_table()¶ Get the entire hash table.
Returns: a two-dimensional list
-
insert(index, var_obj)¶ Insert VariableObject into the nested list in the hashtable.
Parameters: - index – the index to insert to the table
- var_obj – instance of VariableObject
Returns: None
-
pop(index)¶ Override the built-in pop function, to get the top element, which is VariableObject on the stack while not delete it.
Parameters: index – the index to get the corresponding VariableObject Returns: VariableObject
-
quark.Objects.variableobject module¶
-
class
quark.Objects.variableobject.VarabileObject(register_name, value, called_by_func=None)¶ Bases:
objectThe variableobject is used to record the state of each register
-
called_by_func¶ Record which functions have been called by using this register as a parameter.
Returns: a list containing function name
-
hash_index¶ Get the index number from given VarabileObject.
Returns: an integer corresponding to the register index
-
register_name¶ Individual register name, for example ‘v3’.
Returns: a string of register name
-
value¶ The current value stored in the register.
Returns: a string of the value
-