mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
68 lines
2.4 KiB
Markdown
68 lines
2.4 KiB
Markdown
# API Reference: Android Malware Reverse Engineering with JADX Agent
|
|
|
|
## Overview
|
|
|
|
Reverse engineers Android APKs using apktool for manifest extraction, JADX for Java decompilation, and regex-based source code analysis for malicious patterns (C2 URLs, SMS interception, overlay attacks).
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| hashlib | stdlib | APK hash computation |
|
|
| xml.etree | stdlib | AndroidManifest.xml parsing |
|
|
|
|
## External Tools Required
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| apktool | APK disassembly and manifest extraction |
|
|
| jadx | DEX to Java decompilation with deobfuscation |
|
|
|
|
## Core Functions
|
|
|
|
### `compute_apk_hashes(apk_path)`
|
|
Generates MD5 and SHA-256 hashes for APK identification.
|
|
|
|
### `extract_manifest(apk_path, output_dir)`
|
|
Extracts AndroidManifest.xml and parses permissions, activities, services, receivers.
|
|
- **Returns**: `dict` with `package`, `permissions`, `activities`, `services`, `receivers`
|
|
|
|
### `analyze_permissions(permissions)`
|
|
Classifies permissions against a list of 16 dangerous Android permissions.
|
|
- **Risk**: CRITICAL if SMS/accessibility/device-admin, HIGH if >5 dangerous
|
|
- **Returns**: `dict` with categorized permission lists and risk level
|
|
|
|
### `decompile_with_jadx(apk_path, output_dir)`
|
|
Runs JADX with `--deobf` flag for deobfuscated Java source output.
|
|
- **Timeout**: 300 seconds
|
|
|
|
### `search_source_code(source_dir, patterns)`
|
|
Searches decompiled Java source for 10 malicious pattern categories.
|
|
- **Returns**: `dict[str, list[dict]]` - pattern name to file/match pairs
|
|
|
|
### `analyze_apk(apk_path, output_base)`
|
|
Full pipeline: hashes -> manifest -> permissions -> decompile -> code analysis.
|
|
|
|
## Malicious Code Patterns
|
|
|
|
| Pattern | Indicator |
|
|
|---------|-----------|
|
|
| urls | HTTP/HTTPS C2 server addresses |
|
|
| ips | Hardcoded IP addresses |
|
|
| exec_commands | Runtime.exec() shell command execution |
|
|
| reflection | Class.forName() dynamic class loading |
|
|
| dex_loading | DexClassLoader for loading additional code |
|
|
| overlay_attack | TYPE_APPLICATION_OVERLAY for phishing overlays |
|
|
| accessibility_abuse | AccessibilityService for keylogging/automation |
|
|
| sms_intercept | SMS_RECEIVED broadcast interception |
|
|
|
|
## Dangerous Permissions Checked
|
|
|
|
READ_SMS, SEND_SMS, RECEIVE_SMS, READ_CONTACTS, CAMERA, RECORD_AUDIO, ACCESS_FINE_LOCATION, READ_PHONE_STATE, BIND_ACCESSIBILITY_SERVICE, BIND_DEVICE_ADMIN, REQUEST_INSTALL_PACKAGES
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python agent.py malware.apk
|
|
```
|