forked from typetools/sparta
-
Notifications
You must be signed in to change notification settings - Fork 0
/
suspicious.pl
executable file
·71 lines (57 loc) · 1.82 KB
/
suspicious.pl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
#!/usr/bin/env perl
use strict;
use warnings;
use Regexp::Common qw/URI/;
use Regexp::Common qw/net/;
# Script to analyze a bunch of source files for suspicious content.
#
# Parameters:
#
# 1) root-dir: root directory to recursively search for files
#
# 2) pattern: custom regexp pattern to search for
# (replaces the built-in ones) - optional parameter
#
#
$#ARGV>=0 || die "usage: $0 'root-dir' [pattern]";
# name pattern of files to include in analysis
my $file_pattern="(\.java|[sS]trings\.xml)\$";
# default search pattern:
# - content prefix (e.g., used in content://...)
# - http prefix (e.g., used in String concatenation)
# - URIs
# - IPv4 addresses
# - MAC addresses
# - String constant for ACTION_VIEW intent
# - auto-generated catch block
my $search_pattern =
"(\"\\s*content[^\"]*\"|\"\\s*http[^\"]*\"|$RE{URI}{-keep}|$RE{net}{IPv4}{-keep}|$RE{net}{MAC}{-keep}|android\.intent\.action\.VIEW|//.*generated catch block)";
# use specific pattern if provided via cmd
$search_pattern="($ARGV[1])" if $#ARGV==1;
# recursively analyze directory
process_dir ($ARGV[0]);
sub process_dir{
my $root_dir = shift;
opendir (DIR, $root_dir) or die "Unable to open directory \'$root_dir\': $!";
my @files = grep !/^\.{1,2}$/ , readdir (DIR);
closedir (DIR);
@files = map { $root_dir . '/' . $_ } @files;
for (@files) {
# analyze sub-directories if this file is a directory
if (-d $_) {
process_dir($_);
} else {
# check for defined file name pattern and analyze files
analyze_file($_) if /$file_pattern/;
}
}
}
sub analyze_file{
my $file=$_;
my $line=1;
open(IN, "<$file") or die "Cannot open file \'$file\': $!";
while(<IN>){
print "$file($line): Contains $1\n" if /$search_pattern/;
$line
}
}