quark.core.struct package

Submodules

quark.core.struct.bytecodeobject module

class quark.core.struct.bytecodeobject.BytecodeObject(mnemonic, registers, parameter)

Bases: object

BytecodeObject is used to store the instructions in smali, including mnemonic, registers, parameter

mnemonic

Dalvik bytecode instructions set, for example ‘invoke-virtual’.

Returns:a string of mnemonic
parameter

Commonly used for functions called by invoke-kind instructions, for example ‘Lcom/google/progress/APNOperator;->deleteAPN()Z’.

Returns:a string of the function name
registers

Registers used in Dalvik instructions, for example ‘[v3]’.

Returns:a list containing all the registers used

quark.core.struct.methodobject module

class quark.core.struct.methodobject.MethodObject(class_name: str, name: str, descriptor: str, access_flags: str = '', cache: object = None)

Bases: object

Information about a method in a dex file.

access_flags = ''
cache = None
full_name
is_android_api() → bool

quark.core.struct.registerobject module

class quark.core.struct.registerobject.RegisterObject(register_name, value, called_by_func=None, value_type=None)

Bases: object

The RegisterObject is used to record the state of each register

called_by_func

Record which functions have been called by using this register as a parameter.

Returns:a list containing function name
current_type

Get the type of the value in the register

Returns:a plant text that describes a data type
Return type:str
hash_index

Get the index number from given VarabileObject.

Returns:an integer corresponding to the register index
register_name

Individual register name, for example ‘v3’.

Returns:a string of register name
type_histroy
value

The current value stored in the register.

Returns:a string of the value

quark.core.struct.ruleobject module

class quark.core.struct.ruleobject.RuleObject(ruleJson: os.PathLike, jsonData: dict = None)

Bases: object

RuleObject is used to store the rule from json file

api

Key native APIs that do the action and target in order.

Returns:a list recording the APIs class_name and method_name in order
check_item
crime

Description of given crime.

Returns:a string of the crime
get_score(confidence)

According to the state of the five stages, we calculate the weighted score based on exponential growth. For example, we captured the third stage in five stages, then the weighted score would be (2^3-1) / 2^4.

2^(confidence - 1)

Parameters:confidence –
Returns:floating point
label

A list contains various lebels described in https://github.com/quark-engine/quark-rules/blob/master/label_desc.csv

Returns:a label list defined in rules
permission

Permission requested by the apk to practice the crime.

Returns:a list of given permissions
rule_filename
score

The value used to calculate the weighted score

Returns:integer

quark.core.struct.tableobject module

class quark.core.struct.tableobject.TableObject(count_reg)

Bases: object

This table is used to track the usage of variables in the register

get_obj_list(index)

Return the list which contains the VariableObject.

Parameters:index – the index to get the corresponding VariableObject
Returns:a list containing VariableObject
get_table()

Get the entire hash table.

Returns:a two-dimensional list
hash_table
insert(index, var_obj)

Insert VariableObject into the nested list in the hashtable.

Parameters:
  • index – the index to insert to the table
  • var_obj – instance of VariableObject
Returns:

None
pop(index)

Override the built-in pop function, to get the top element, which is VariableObject on the stack while not delete it.

Parameters:index – the index to get the corresponding VariableObject
Returns:VariableObject

Module contents