mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

2.4 KiB

Raw Blame History

API Reference: Android Malware Reverse Engineering with JADX Agent

Overview

Reverse engineers Android APKs using apktool for manifest extraction, JADX for Java decompilation, and regex-based source code analysis for malicious patterns (C2 URLs, SMS interception, overlay attacks).

Dependencies

Package	Version	Purpose
hashlib	stdlib	APK hash computation
xml.etree	stdlib	AndroidManifest.xml parsing

External Tools Required

Tool	Purpose
apktool	APK disassembly and manifest extraction
jadx	DEX to Java decompilation with deobfuscation

Core Functions

`compute_apk_hashes(apk_path)`

Generates MD5 and SHA-256 hashes for APK identification.

`extract_manifest(apk_path, output_dir)`

Extracts AndroidManifest.xml and parses permissions, activities, services, receivers.

Returns: dict with package, permissions, activities, services, receivers

`analyze_permissions(permissions)`

Classifies permissions against a list of 16 dangerous Android permissions.

Risk: CRITICAL if SMS/accessibility/device-admin, HIGH if >5 dangerous
Returns: dict with categorized permission lists and risk level

`decompile_with_jadx(apk_path, output_dir)`

Runs JADX with --deobf flag for deobfuscated Java source output.

Timeout: 300 seconds

`search_source_code(source_dir, patterns)`

Searches decompiled Java source for 10 malicious pattern categories.

Returns: dict[str, list[dict]] - pattern name to file/match pairs

`analyze_apk(apk_path, output_base)`

Full pipeline: hashes -> manifest -> permissions -> decompile -> code analysis.

Malicious Code Patterns

Pattern	Indicator
urls	HTTP/HTTPS C2 server addresses
ips	Hardcoded IP addresses
exec_commands	Runtime.exec() shell command execution
reflection	Class.forName() dynamic class loading
dex_loading	DexClassLoader for loading additional code
overlay_attack	TYPE_APPLICATION_OVERLAY for phishing overlays
accessibility_abuse	AccessibilityService for keylogging/automation
sms_intercept	SMS_RECEIVED broadcast interception

Dangerous Permissions Checked

READ_SMS, SEND_SMS, RECEIVE_SMS, READ_CONTACTS, CAMERA, RECORD_AUDIO, ACCESS_FINE_LOCATION, READ_PHONE_STATE, BIND_ACCESSIBILITY_SERVICE, BIND_DEVICE_ADMIN, REQUEST_INSTALL_PACKAGES

Usage

python agent.py malware.apk

2.4 KiB Raw Blame History