{
    "info": {
        "author": "Victor Dorneanu",
        "author_email": "info@dornea.nu",
        "bugtrack_url": null,
        "classifiers": [
            "License :: OSI Approved :: MIT License",
            "Natural Language :: English",
            "Operating System :: OS Independent",
            "Programming Language :: Python",
            "Topic :: Security",
            "Topic :: Software Development :: Libraries :: Java Libraries"
        ],
        "description": "=========================================\nStatic Code Analysis for Smali\n=========================================\n\n.. image:: https://img.shields.io/pypi/dm/smalisca.svg?style=plastic \n        :target: https://pypi.python.org/pypi/smalisca\n.. image:: https://img.shields.io/pypi/v/smalisca.svg?style=plastic   \n        :target: https://pypi.python.org/pypi/smalisca\n.. image:: https://img.shields.io/pypi/l/smalisca.svg?style=plastic   \n        :target: https://pypi.python.org/pypi/smalisca\n.. image:: https://readthedocs.org/projects/smalisca/badge/?version=stable   \n        :target: http://smalisca.readthedocs.org/en/stable/\n\n\nIf you ever have looked at Android applications you know to appreciate\nthe ability of analyzing your target at the most advanced level. Dynamic\nprogram analysis will give you a pretty good overview of your applications\nactivities and general behaviour. However sometimes you'll want to just\nanalyze your application **without** running it. You'll want to have a look\nat its components, analyze how they interact and how data is tainted\nfrom one point to another.\n\nThis is was the major factor driving the development of *smalisca*. There\nare indeed some good reasons for a *static code analysis* before the\n*dynamic* one. Before interacting with the application I like to know\nhow the application has been build, if there is any API and generate all\nsort of *call flow graphs*. In fact graphs have been very important to\nme since they *visualize* things. Instead of jumping from file to file,\nfrom class to class, I just look at the graphs.\n\nWhile graph building has been an important reason for me to code such a\ntool, *smalisca* has some other neat **features** you should read about.\n\n\nFeatures\n========\n\nAt the moment there are some few major functionalities like:\n\n* **parsing**\n\n  You can parse a whole directory of **Smali** files and **extract**:\n\n  * class information\n  * class properties\n  * class methods\n  * calls between methods of different classes\n\n  You can then **export** the results as **JSON** or **SQLite**.\n\n  Have a loot at the `parsing page <http://smalisca.readthedocs.org/en/stable/parsing.html>`_ for more information.\n\n\n\n* **analyzing**\n\n  After exporting the results you'll get an **interactive prompt** to take\n  a closer look at your parsed data. You can **search** for classes, properties,\n  methods and even method calls. You can then apply several **filters** to your search\n  criterias like::\n\n      smalisca> sc -c class_name -p test -r 10 -x path -s class_type\n\n  This command will search for *10* (-r 10) classes which contain the pattern *test* (-p)\n  in their *class name* (-c). Afterwards  the command will exclude the column *path*\n  (-x path) from the results and sort them by the *class type* (-s).\n\n  Let's have a look at another example::\n\n      smalisca> scl -fc com/android -fm init -r 10\n\n  This will search for all **method calls** whose *calling* class name contains the pattern\n  *com/android* (-fc). Additionally we can look for calls originating from methods whose\n  name contain the pattern *init* (-fm).\n\n  You can of course read your commands from a file and analyze your results in a *batch*-\n  like manner::\n\n    $ cat cmd.txt\n    sc -c class_name -p com/gmail/xlibs -r 10 -x path\n    quit\n    $ ./smalisca.py analyzer -i results.sqlite -f sqlite -c cmd.txt\n    ...\n\n  Have a loot at the `analysis page <http://smalisca.readthedocs.org/en/stable/analysis.html>`_ for more information.\n\n* **web API**\n\n  smalisca provides a REST web service in order to easily interact with the results by just using \n  a web client. This way you can access data in your own (fancy) web application and have a clean\n  separation between backend and frontend. \n\n  Read more about the available REST API at the `web API page <http://smalisca.readthedocs.org/en/stable/web-api.html>`_. \n\n\n* **visualizing**\n\n  I think this the **most** valuable feature of *smalisca*. The ability to visualize your\n  results in a structured way makes your life more comfortable. Depending on what you're\n  interested in, this tool has several graph drawing features I'd like to promote.\n\n  At first you can draw your packages including their classes, properties and methods::\n\n    smalisca> dc -c class_name -p test -f dot -o /tmp/classes.dot\n    :: INFO       Wrote results to /tmp/classes.dot\n    smalisca>\n\n  This will first search classes whose class name contains *test* and then export the\n  results in the **Graphviz DOT** language. You can then manually generate a graph using\n  *dot*, *neato*, *circo* etc. Or you do that using the interactive prompt::\n\n    smalisca> dc -c class_name -p test -f pdf -o /tmp/classes.pdf --prog neato\n    :: INFO       Wrote results to /tmp/classes.pdf\n    smalisca>\n\n  Have a loot at the `drawing page <http://smalisca.readthedocs.org/en/stable/drawing.html>`_ for more information.\n\nScreenshots\n===========\n\n.. figure:: http://smalisca.readthedocs.org/en/stable/_images/smalisca_search_classes.png\n   :scale: 99%\n   :alt: Basic usage\n   \n   Output results as table.\n   \n\n\n.. figure:: http://smalisca.readthedocs.org/en/stable/_images/smalisca_dxcl_dot_0.png\n   :scale: 99%\n   :alt: Cross calls\n   \n   Basic relationships between classes and modules.\n\n\nHave a look at the `screenshots page <http://smalisca.readthedocs.org/en/stable/screenshots.html>`_.\n\n\nInstallation\n============\n\nRefer to the `installation page <http://smalisca.readthedocs.org/en/stable/installation.html>`_.\nRequirements:\n\n* Python (2.x / 3.x)\n* `cement <http://builtoncement.com/>`_\n* Graphviz\n* SQLAlchemy\n\n\nHow to use it\n=============\n\nAfter installing the tool, you may want to first pick up an Android application (APK)\nto play with. Use `apktool <https://code.google.com/p/android-apktool/>`_ or my own tool\n`ADUS <https://github.com/dorneanu/adus>`_ to dump the APKs content. For the sake of\nsimplicity I'll be using **FakeBanker** which I've analyzed in a previous\n`blogpost <http://blog.dornea.nu/2014/07/07/disect-android-apks-like-a-pro-static-code-analysis/>`_ .\n\nFirst touch\n-----------\n\nBut first let's have a look at the tools main options::\n\n    $ smalisca --help\n\n                               /\\_ \\    __                            \n      ____    ___ ___      __  \\//\\ \\  /\\_\\    ____    ___     __     \n     /',__\\ /' __` __`\\  /'__`\\  \\ \\ \\ \\/\\ \\  /',__\\  /'___\\ /'__`\\   \n    /\\__, `\\/\\ \\/\\ \\/\\ \\/\\ \\L\\.\\_ \\_\\ \\_\\ \\ \\/\\__, `\\/\\ \\__//\\ \\L\\.\\_ \n    \\/\\____/\\ \\_\\ \\_\\ \\_\\ \\__/.\\_\\/\\____\\\\ \\_\\/\\____/\\ \\____\\ \\__/.\\_\\\n     \\/___/  \\/_/\\/_/\\/_/\\/__/\\/_/\\/____/ \\/_/\\/___/  \\/____/\\/__/\\/_/\n                                                                      \n\n    --------------------------------------------------------------------------------\n    :: Author:       Victor <Cyneox> Dorneanu\n    :: Desc:         Static Code Analysis tool for Smali files\n    :: URL:          http://nullsecurity.net, http://{blog,www}.dornea.nu\n    :: Version:      0.2\n    --------------------------------------------------------------------------------\n\n    usage: smalisca (sub-commands ...) [options ...] {arguments ...}\n\n    [--] Static Code Analysis (SCA) tool for Baskmali (Smali) files.\n\n    commands:\n\n      analyzer\n        [--] Analyze results using an interactive prompt or on the command line.\n\n      parser\n        [--] Parse files and extract data based on Smali syntax.\n\n      web\n        [--] Analyze results using web API.\n\n    optional arguments:\n      -h, --help            show this help message and exit\n      --debug               toggle debug output\n      --quiet               suppress all output\n      --log-level {debug,info,warn,error,critical}\n                            Change logging level (Default: info)\n      -v, --version         show program's version number and exit\n\n\nParsing\n-------\n\nI'll first **parse** some directory for **Smali** files before doing the analysis stuff::\n\n    $ smalisca parser -l ~/tmp/FakeBanker2/dumped/smali -s java -f sqlite  -o fakebanker.sqlite\n\n    ...\n\n    :: INFO       Parsing .java files in /home/victor/tmp/FakeBanker2/dumped/smali ...\n    :: INFO       Finished parsing!\n    :: INFO       Exporting results to SQLite\n    :: INFO         Extract classes ...\n    :: INFO         Extract class properties ...\n    :: INFO         Extract class methods ...\n    :: INFO         Extract calls ...\n    :: INFO         Commit changes to SQLite DB\n    :: INFO         Wrote results to fakebanker.sqlite\n    :: INFO       Finished scanning\n\nAlso have a look at the `parsing page <http://smalisca.readthedocs.org/en/stable/parsing.html>`_ for further information.\n\n\nAnalyzing\n----------\n\nNow you're free to do whatever you want with your generated exports. You can inspect the **SQLite DB**\ndirectly or use *smaliscas* **analysis** features::\n\n    $ smalisca analyzer -f sqlite -i fakebanker.sqlite\n\n    ...\n\n\n    smalisca>sc -x path -r 10\n    +----+-----------------------------------------------------------------------------------------+--------------------+--------------------------+-------+\n    | id | class_name                                                                              | class_type         | class_package            | depth |\n    +----+-----------------------------------------------------------------------------------------+--------------------+--------------------------+-------+\n    | 1  | Landroid/support/v4/net/ConnectivityManagerCompat                                       | public             | Landroid.support.v4.net  | 5     |\n    | 2  | Landroid/support/v4/view/AccessibilityDelegateCompat$AccessibilityDelegateJellyBeanImpl |                    | Landroid.support.v4.view | 5     |\n    | 3  | Landroid/support/v4/view/ViewCompat$ViewCompatImpl                                      | interface abstract | Landroid.support.v4.view | 5     |\n    | 4  | Landroid/support/v4/app/ActivityCompatHoneycomb                                         |                    | Landroid.support.v4.app  | 5     |\n    | 5  | Landroid/support/v4/app/NoSaveStateFrameLayout                                          |                    | Landroid.support.v4.app  | 5     |\n    | 6  | Landroid/support/v4/net/ConnectivityManagerCompatHoneycombMR2                           |                    | Landroid.support.v4.net  | 5     |\n    | 7  | Lcom/gmail/xpack/BuildConfig                                                            | public final       | Lcom.gmail.xpack         | 4     |\n    | 8  | Landroid/support/v4/app/BackStackRecord$Op                                              | final              | Landroid.support.v4.app  | 5     |\n    | 9  | Landroid/support/v4/app/FragmentManagerImpl                                             | final              | Landroid.support.v4.app  | 5     |\n    | 10 | Landroid/support/v4/app/ShareCompat$ShareCompatImpl                                     | interface abstract | Landroid.support.v4.app  | 5     |\n    +----+-----------------------------------------------------------------------------------------+--------------------+--------------------------+-------+\n\nAlso refer to the `analysis page <http://smalisca.readthedocs.org/en/stable/analysis.html>`_ for more available **commands** and options.\n\n\nDrawing\n-------\n\nPlease refer to the `drawing page <http://smalisca.readthedocs.org/en/stable/drawing.html>`_ for full examples.\n\n\nLicense\n========\n\n*smalisca* has been released under the **MIT** license. Have a look at the **LICENSE.rst** file.\n\nCredits\n=======\n\nThis tool is dedicated to **Lic\u0103**. Many thanks also go to:\n\n* `Stephen McAllister <https://de.linkedin.com/pub/stephen-mcallister/13/843/71a>`_\n\n    * Many thanks for all those hours full of APK debugging and great ideas\n\n* My gf\n\n    * Thank you very much for your patience and understanding!\n\n* `nullsecurity.net <http://nullsecurity.net>`_\n\n    * Hack the planet!\n\n===========\nChangelog\n===========\n\n0.2 (2015-06-22)\n================\n\n* Bugs\n\n    * Fixed issue #2\n    * Fixed issue #3\n    * Fixed issue described in pull #5\n\n* Parsing\n\n    * Added concurrency to the parser\n    * You can specify by \"-j\" the number of jobs/workers \n    * Have a look at this `blog post <http://blog.dornea.nu/2015/05/06/adding-concurrency-to-smalisca/>`_\n\n* Configuration\n    \n    * Added configuration files\n    * Specify configuration file by \"-c\" parameter\n\n* Web API\n\n    * Added REST API to access the SQLite DB\n    * Use http://<host>:<port>/api/<table name> to access JSON data\n    * Based on `Flask <http://flask.pocoo.org/>`_ and `Flask Restless <https://flask-restless.readthedocs.org/en/latest/>`_\n\n\n0.1 (2015-04-01)\n================\n\n* General\n   \n    * Minor bugs\n    * Small changes related to versioning\n    * Create PyPI package\n\n* Parser\n    \n    * Parse for const string (const-string) as well\n\n* Analyzer\n\n    * Added analyzer command (scs) for const strings\n    * Added global search\n    * Search for pattern(s) in tables\n\n* Added Makefile\n\n    * Use make {install, uninstall, clean}\n\n\n0.1-RC1 (2015-03-11)\n====================\n\n* Implemented basic project structure \n  \n    * Basic CLI application\n    * Use cement als stable CLI framework\n\n* Add basic parsing functionalities \n\n    * Parse classes, methods, properties\n    * JSONify results\n    * No use of complex regexp (due to performance issues)\n\n* Add filter functionalities\n\n    * Search for classes, methods, properties\n    * Create directed graphs (CFGs)\n\n* Output results \n\n    * JSON\n    * DOT (Graphviz)",
        "description_content_type": null,
        "docs_url": null,
        "download_url": "https://github.com/dorneanu/smalisca/archive/0.2.tar.gz",
        "downloads": {
            "last_day": -1,
            "last_month": -1,
            "last_week": -1
        },
        "home_page": "http://github.com/dorneanu/smalisca",
        "keywords": "cli smali sca",
        "license": "MIT",
        "maintainer": null,
        "maintainer_email": null,
        "name": "smalisca",
        "package_url": "https://pypi.org/project/smalisca/",
        "platform": "UNKNOWN",
        "project_url": "https://pypi.org/project/smalisca/",
        "project_urls": {
            "Download": "https://github.com/dorneanu/smalisca/archive/0.2.tar.gz",
            "Homepage": "http://github.com/dorneanu/smalisca"
        },
        "release_url": "https://pypi.org/project/smalisca/0.2/",
        "requires_dist": null,
        "requires_python": null,
        "summary": "Static code analysis tool for Smali files",
        "version": "0.2"
    },
    "last_serial": 1602886,
    "releases": {
        "0.1": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "890a7ce480d6909c31bec8d4be725acd",
                    "sha256": "8debc18cb2f28bb4e9e9bd010e77abe4d3c329e055f4793486fd11d70dd5c2b0"
                },
                "downloads": -1,
                "filename": "smalisca-0.1.tar.gz",
                "has_sig": false,
                "md5_digest": "890a7ce480d6909c31bec8d4be725acd",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": null,
                "size": 31121,
                "upload_time": "2015-04-01T16:51:59",
                "url": "https://files.pythonhosted.org/packages/f8/19/8210236887c6ceebef6540e946364dbe93acd0fb5c2a7297bc46ce257c6d/smalisca-0.1.tar.gz"
            }
        ],
        "0.2": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "d188c31aecc5860ac2b8dcafd9574c89",
                    "sha256": "c7c664577a7bf70f62ccde540bfc17a8c30af186483d17b157c0c8ca5530e91c"
                },
                "downloads": -1,
                "filename": "smalisca-0.2.tar.gz",
                "has_sig": false,
                "md5_digest": "d188c31aecc5860ac2b8dcafd9574c89",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": null,
                "size": 34268,
                "upload_time": "2015-06-23T10:08:13",
                "url": "https://files.pythonhosted.org/packages/e7/8c/90dddc641d914fcea52737963d6a9aa27b3bfe88b76f344a6569285c85ba/smalisca-0.2.tar.gz"
            }
        ]
    },
    "urls": [
        {
            "comment_text": "",
            "digests": {
                "md5": "d188c31aecc5860ac2b8dcafd9574c89",
                "sha256": "c7c664577a7bf70f62ccde540bfc17a8c30af186483d17b157c0c8ca5530e91c"
            },
            "downloads": -1,
            "filename": "smalisca-0.2.tar.gz",
            "has_sig": false,
            "md5_digest": "d188c31aecc5860ac2b8dcafd9574c89",
            "packagetype": "sdist",
            "python_version": "source",
            "requires_python": null,
            "size": 34268,
            "upload_time": "2015-06-23T10:08:13",
            "url": "https://files.pythonhosted.org/packages/e7/8c/90dddc641d914fcea52737963d6a9aa27b3bfe88b76f344a6569285c85ba/smalisca-0.2.tar.gz"
        }
    ]
}