ruby_apk

Android Apk static analysis library for Ruby.

Requirements

• ruby(>=1.9.x)

Install

$ gem install ruby_apk

Usage

Initialize

require'ruby_apk'apk=Android::Apk.new('sample.apk')# set apk file path

Apk

Listing files in Apk

# listing files in apkapk=Android::Apk.new('sample.apk')apk.each_filedo |name,data|
puts"#{name}: #{data.size}bytes"# puts file name and data sizeend

Find files in Apk

apk=Android::Apk.new('sample.apk')elf_files=apk.find{|name,data| data[0..3] == [0x7f,0x45,0x4c,0x46]}# ELF magic number

Extract icon data in Apk (since 0.6.0)

apk=Android::Apk.new('sample.apk')icons=apk.icon# { "res/drawable-hdpi/ic_launcher.png" => "\x89PNG\x0D\x0A...", ... }icons.eachdo |name,data|
File.open(File.basename(name),'wb'){|f| f.writedata}# save to file.end

Extract signature and certificate information from Apk (since v0.7.0)

apk=Android::Apk.new('sample.apk')signs=apk.signs# retrun Hash(key: signature file path, value: OpenSSL::PKCS7)signs.eachdo |path,sign|
putspath# => "MATA-INF/CERT.RSA" or ...putssign# => "-----BEGIN PKCS7-----\n..." PKCS7 objectendcerts=apk.certificates# retrun Hash(key: signature file path, value: OpenSSL::X509::Certificate)certs.eachdo |path,cert|
putspath# => "MATA-INF/CERT.RSA" or ...putscert# => "-----BEGIN CERTIFICATE-----\n..." # X509::Certificate objectend

Note: Most apks have only one signature and cerficate.

Manifest

Get readable xml

apk=Android::Apk.new('sample.apk')manifest=apk.manifestputsmanifest.to_xml

Listing components and permissions

apk=Android::Apk.new('sample.apk')manifest=apk.manifest# listing componentsmanifest.components.eachdo |c| # 'c' is Android::Manifest::Component objectputs"#{c.type}: #{c.name}"c.intent_filters.eachdo |filter|
puts"\t#{filter.type}"endend# listing use-permission tagmanifest.use_permissions.eachdo |permission|
putspermissionend

Extract application label string

apk=Android::Apk.new('sample.apk')putsapk.manifest.label

Resource

Extract resource strings from apk

apk=Android::Apk.new('sample.apk')rsc=apk.resourcersc.strings.eachdo |str|
putsstrend

Parse resource file directly

rsc_data=File.open('resources.arsc','rb').read{|f| f.read}rsc=Android::Resource.new(rsc_data)

Resolve resource id

This feature supports only srting resources for now.

apk=Android::Apk.new('sample.apk')rsc=apk.resource# assigns readable resource idputsrsc.find('@string/app_name')# => 'application name'# assigns hex resource idputsrsc.find('@0x7f040000')# => 'application name'# you can set lang attribute.putsrsc.find('@0x7f040000',:lang=>'ja')

Dex

Extract dex information

apk=Android::Apk.new('sample.apk')dex=apk.dex# listing string table in dexdex.strings.eachdo |str|
putsstrend# listing all class namesdex.classes.eachdo |cls| # cls is Android::Dex::ClassInfoputs"class: #{cls.name}"cls.virtual_methods.eachdo |m| # Android::Dex::MethodInfoputs"\t#{m.definition}"# puts method definitionendend

Parse dex file directly

dex_data=File.open('classes.dex','rb').read{|f| f.read}dex=Android::Dex.new(dex_data)

Copyright

Copyright (c) 2012 SecureBrain. See LICENSE.txt for further details.