Tim Strazzere

``` 06-17 13:30:18.482 16626 16626 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 06-17 13:30:18.483 16626 16626 F DEBUG...

Handle file unacceptable in new version of android

1

``` 06-17 13:30:18.405 16594 16618 W System.err: java.io.FileNotFoundException: /proc/net/tcp: open failed: EACCES (Permission denied) 06-17 13:30:18.405 16594 16618 W System.err: at libcore.io.IoBridge.open(IoBridge.java:496) 06-17 13:30:18.405 16594 16618 W System.err: at java.io.FileInputStream.(FileInputStream.java:159)...

hasAdbInEmulator misfires (or logic is wrong?) for tcpip adb connections

1

``` V/AntiEmulator(15537): Checking for QEmu env... V/AntiEmulator(15537): hasKnownDeviceId : false V/AntiEmulator(15537): hasKnownPhoneNumber : false V/AntiEmulator(15537): isOperatorNameAndroid : false V/AntiEmulator(15537): hasKnownImsi : false V/AntiEmulator(15537): hasEmulatorBuild : false V/AntiEmulator(15537): hasPipes : false...

Upstream yara dex module fails to properly identify dex files.

3

While looking at #190 I noticed an issue in the upstream dex module which lead to this commit; https://github.com/rednaga/APKiD/commit/b5ff0da82a397836fef841c07165a9b6986e0c53 Basically, if the "magic bytes" which are loosely defined in the...

Should not fail on bad zips (or should fail more gracefully?)

3

``` [*] /Users/diff/reverse/targets/android//weird-anti-emulator/contents/assets/alipay_msp-3.5.2-1000261.apk!classes.dex |-> anti_vm : device ID check, subscriber ID check |-> compiler : dx 2017-10-29 16:53:01 ERROR error extracting /Users/diff/reverse/targets/android//weird-anti-emulator/MeeLive.apk: File is not a zip file Traceback (most...

Add private malware packer for identificaiton

1

There may be some overlap with other signatures, need to verify these samples are 100% independent; ``` 3f98e8d89e42ecafadb529e96c8305707c4a42d9ca97500b91b8da2fc93e07c3 b7a0d51599ff8955f0f77bd946c92433d5241e14fa84e6cbe49e0ad98898ad94 d64e1e2d0847becd4a4cd9c5804e42093719c77c15b2560c2c8bc993e90dda3b 963ee42c96a25f4a5413d8c4c455575e473516aa58c55b575e86a4fbae4aa3aa bd6d7d8e519a3ba240d8a18d1b22c0e7bc7cc75130a661a7ff9791e58a870be4 99628aa4e1d36c4eef6993c44d3b5f2f5a0da3a4ddc9d2ef8f3c800381540b4d fccec72e6a0814f8be1f3b130eead09cce1bb20b7151245bdbd59cb946bca582 ``` ``` [+] APKiD 1.0.0 ::...

Should have a standard app to do benchmarks against

2

When speaking in the slack channel - the idea came up to catalogue all the protectors we currently detect and have a sample for each. This might be best to...

``` [30%]diff@rocksteady:[arxan] $ apkid . [+] APKiD 1.0.0 :: from RedNaga :: rednaga.io Traceback (most recent call last): File "/Users/diff/Library/Python/2.7/bin/apkid", line 9, in load_entry_point('apkid==1.0.0', 'console_scripts', 'apkid')() File "/Users/diff/repo/APKiD/apkid/__init__.py", line 60,...

Add "proguard elder dictionary" rules

1

Found this skimming some repos, might be interesting to flag; https://github.com/apkhook/proguard-elder-dictionary

Someone emailed me a sample asking for personal IT helpdesk support... So I figured I'd add it as an enhancement issue here if I can get around to it. Unknown...