Another Dalvik Abstract Machine
This is an experimental static analysis based security checker for Android Apps.
Simplely cmake . && make
To enable/disable building a tool package cmake -Dbuild_<package_name>=yes|no .
To change the log level and the optimization level, L=<log-level> O=<opt-level> cmake .
Use make show-flags to print the compile flags
Prepare the test data, use make data to download a sample input of ADAM from http://www.cs.utah.edu/~haohou/adam/data.tar.gz.
Then run test cases make test
Currently only Adam Debugger is avaliable.
This package is enabled by default, if you want to enable it explicitly, run cmake - Dbuild_adb=yes . before compilation.
You can use ADB to test the analyzer if you compile adam with ADB package.
ADAM takes the output of dex2sex which produces S-Expression represention of dalvik disassmebly code.
You can get a compiled binary from here.
To disassmble a APK package, simple use dex2sex <apk-package>.
You can either extract doxygen documentation from the source code by make docs
or visit the online version documentation at http://www.cs.utah.edu/~haohou/adam/html/
The default log config file is defined in include/constants.h. By default it is log.cfg.
If you do not have log.cfg in adam/ directory, there will be noisy output. The log.cfg file defines where to redirect log output of various levels (WARNING, ERROR, etc).
Obtain android.jar and place in adam/test/de2sex/bin/lib/ Obtain dex2sex from my other repo.
How do I prepare a .dex file for analysis?
java2s path/to/code output/dir OR apk2s path/to/apk output/dir
How do I start the debugger?
After building, run ./bin/adb, but no program is loaded yet.
How to load a program into the debugger?
(load "path/to/dir/with/sexpressionified-bytecode-files")
How do I inject into a start state?
Autocompletion is supported!!!
(frame/new [fully/qualified/classname/method(params,...) [object fully/qualified/returntype]])
How do I view the frame?
(frame/info)
Or as a dot file!!!
(frame/dot)
How do I set parameter values?
(frame/set v1 + - Z)
(frame/allocate CLASSPATH)
(frame/alloc v1 "Some String") <- not yet supported, Cambells task
How do I add commands to the debugger?
Add the Command to adb/main.c with a handler.
data flow graph: for each data tag: print file/line of occurences
tracking variable name changes: if it changes drastically, then it may be an attempt to hide data