1 /*
2 * Copyright (C) 2018 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "veridex.h"
18
19 #include <android-base/file.h>
20 #include <android-base/strings.h>
21
22 #include <cstdlib>
23 #include <sstream>
24 #include <string_view>
25
26 #include "base/mem_map.h"
27 #include "dex/dex_file.h"
28 #include "dex/dex_file_loader.h"
29 #include "hidden_api.h"
30 #include "hidden_api_finder.h"
31 #include "precise_hidden_api_finder.h"
32 #include "resolver.h"
33
34 namespace art {
35
36 static VeriClass z_(Primitive::Type::kPrimBoolean, 0, nullptr);
37 static VeriClass b_(Primitive::Type::kPrimByte, 0, nullptr);
38 static VeriClass c_(Primitive::Type::kPrimChar, 0, nullptr);
39 static VeriClass s_(Primitive::Type::kPrimShort, 0, nullptr);
40 static VeriClass i_(Primitive::Type::kPrimInt, 0, nullptr);
41 static VeriClass f_(Primitive::Type::kPrimFloat, 0, nullptr);
42 static VeriClass d_(Primitive::Type::kPrimDouble, 0, nullptr);
43 static VeriClass j_(Primitive::Type::kPrimLong, 0, nullptr);
44 static VeriClass v_(Primitive::Type::kPrimVoid, 0, nullptr);
45
46 VeriClass* VeriClass::boolean_ = &z_;
47 VeriClass* VeriClass::byte_ = &b_;
48 VeriClass* VeriClass::char_ = &c_;
49 VeriClass* VeriClass::short_ = &s_;
50 VeriClass* VeriClass::integer_ = &i_;
51 VeriClass* VeriClass::float_ = &f_;
52 VeriClass* VeriClass::double_ = &d_;
53 VeriClass* VeriClass::long_ = &j_;
54 VeriClass* VeriClass::void_ = &v_;
55
56 // Will be set after boot classpath has been resolved.
57 VeriClass* VeriClass::object_ = nullptr;
58 VeriClass* VeriClass::class_ = nullptr;
59 VeriClass* VeriClass::class_loader_ = nullptr;
60 VeriClass* VeriClass::string_ = nullptr;
61 VeriClass* VeriClass::throwable_ = nullptr;
62 VeriMethod VeriClass::forName_ = nullptr;
63 VeriMethod VeriClass::getField_ = nullptr;
64 VeriMethod VeriClass::getDeclaredField_ = nullptr;
65 VeriMethod VeriClass::getMethod_ = nullptr;
66 VeriMethod VeriClass::getDeclaredMethod_ = nullptr;
67 VeriMethod VeriClass::getClass_ = nullptr;
68 VeriMethod VeriClass::loadClass_ = nullptr;
69 VeriField VeriClass::sdkInt_ = nullptr;
70
71 static const char* kDexFileOption = "--dex-file=";
72 static const char* kStubsOption = "--core-stubs=";
73 static const char* kFlagsOption = "--api-flags=";
74 static const char* kImprecise = "--imprecise";
75 static const char* kTargetSdkVersion = "--target-sdk-version=";
76 static const char* kAppClassFilter = "--app-class-filter=";
77 static const char* kExcludeApiListsOption = "--exclude-api-lists=";
78
79 struct VeridexOptions {
80 const char* dex_file = nullptr;
81 const char* core_stubs = nullptr;
82 const char* flags_file = nullptr;
83 bool precise = true;
84 int target_sdk_version = 29; /* Q */
85 std::vector<std::string> app_class_name_filter;
86 std::vector<std::string> exclude_api_lists;
87 };
88
Substr(const char * str,int index)89 static const char* Substr(const char* str, int index) {
90 return str + index;
91 }
92
ParseArgs(VeridexOptions * options,int argc,char ** argv)93 static void ParseArgs(VeridexOptions* options, int argc, char** argv) {
94 // Skip over the command name.
95 argv++;
96 argc--;
97
98 for (int i = 0; i < argc; ++i) {
99 std::string_view arg(argv[i]);
100 if (arg.starts_with(kDexFileOption)) {
101 options->dex_file = Substr(argv[i], strlen(kDexFileOption));
102 } else if (arg.starts_with(kStubsOption)) {
103 options->core_stubs = Substr(argv[i], strlen(kStubsOption));
104 } else if (arg.starts_with(kFlagsOption)) {
105 options->flags_file = Substr(argv[i], strlen(kFlagsOption));
106 } else if (strcmp(argv[i], kImprecise) == 0) {
107 options->precise = false;
108 } else if (arg.starts_with(kTargetSdkVersion)) {
109 options->target_sdk_version = atoi(Substr(argv[i], strlen(kTargetSdkVersion)));
110 } else if (arg.starts_with(kAppClassFilter)) {
111 options->app_class_name_filter = android::base::Split(
112 Substr(argv[i], strlen(kAppClassFilter)), ",");
113 } else if (arg.starts_with(kExcludeApiListsOption)) {
114 options->exclude_api_lists = android::base::Split(
115 Substr(argv[i], strlen(kExcludeApiListsOption)), ",");
116 } else {
117 LOG(ERROR) << "Unknown command line argument: " << argv[i];
118 }
119 }
120 }
121
Split(const std::string & str,char sep)122 static std::vector<std::string> Split(const std::string& str, char sep) {
123 std::vector<std::string> tokens;
124 std::string tmp;
125 std::istringstream iss(str);
126 while (std::getline(iss, tmp, sep)) {
127 tokens.push_back(tmp);
128 }
129 return tokens;
130 }
131
132 class Veridex {
133 public:
Run(int argc,char ** argv)134 static int Run(int argc, char** argv) {
135 VeridexOptions options;
136 ParseArgs(&options, argc, argv);
137 android::base::InitLogging(argv);
138
139 if (!options.dex_file) {
140 LOG(ERROR) << "Required argument '" << kDexFileOption << "' not provided.";
141 return 1;
142 }
143
144 gTargetSdkVersion = options.target_sdk_version;
145
146 std::vector<std::string> boot_content;
147 std::vector<std::string> app_content;
148 std::vector<std::unique_ptr<const DexFile>> boot_dex_files;
149 std::vector<std::unique_ptr<const DexFile>> app_dex_files;
150 std::string error_msg;
151
152 // Read the boot classpath.
153 std::vector<std::string> boot_classpath = Split(options.core_stubs, ':');
154 boot_content.resize(boot_classpath.size());
155 uint32_t i = 0;
156 for (const std::string& str : boot_classpath) {
157 if (!Load(str, boot_content[i++], &boot_dex_files, &error_msg)) {
158 LOG(ERROR) << error_msg;
159 return 1;
160 }
161 }
162
163 // Read the apps dex files.
164 std::vector<std::string> app_files = Split(options.dex_file, ':');
165 app_content.resize(app_files.size());
166 i = 0;
167 for (const std::string& str : app_files) {
168 if (!Load(str, app_content[i++], &app_dex_files, &error_msg)) {
169 LOG(ERROR) << error_msg;
170 return 1;
171 }
172 }
173
174 // Resolve classes/methods/fields defined in each dex file.
175
176 ApiListFilter api_list_filter(options.exclude_api_lists);
177 HiddenApi hidden_api(options.flags_file, api_list_filter);
178
179 // Cache of types we've seen, for quick class name lookups.
180 TypeMap type_map;
181 // Add internally defined primitives.
182 type_map["Z"] = VeriClass::boolean_;
183 type_map["B"] = VeriClass::byte_;
184 type_map["S"] = VeriClass::short_;
185 type_map["C"] = VeriClass::char_;
186 type_map["I"] = VeriClass::integer_;
187 type_map["F"] = VeriClass::float_;
188 type_map["D"] = VeriClass::double_;
189 type_map["J"] = VeriClass::long_;
190 type_map["V"] = VeriClass::void_;
191
192 // Cache of resolvers, to easily query address in memory to VeridexResolver.
193 DexResolverMap resolver_map;
194
195 std::vector<std::unique_ptr<VeridexResolver>> boot_resolvers;
196 Resolve(boot_dex_files, resolver_map, type_map, &boot_resolvers);
197 for (const auto &it : type_map) {
198 hidden_api.AddSignatureSource(it.first, SignatureSource::BOOT);
199 }
200
201 if (options.precise) {
202 // For precise mode we expect core-stubs to contain java.lang classes.
203 VeriClass::object_ = type_map["Ljava/lang/Object;"];
204 VeriClass::class_ = type_map["Ljava/lang/Class;"];
205 VeriClass::class_loader_ = type_map["Ljava/lang/ClassLoader;"];
206 VeriClass::string_ = type_map["Ljava/lang/String;"];
207 VeriClass::throwable_ = type_map["Ljava/lang/Throwable;"];
208 VeriClass::forName_ = boot_resolvers[0]->LookupDeclaredMethodIn(
209 *VeriClass::class_, "forName", "(Ljava/lang/String;)Ljava/lang/Class;");
210 VeriClass::getField_ = boot_resolvers[0]->LookupDeclaredMethodIn(
211 *VeriClass::class_, "getField", "(Ljava/lang/String;)Ljava/lang/reflect/Field;");
212 VeriClass::getDeclaredField_ = boot_resolvers[0]->LookupDeclaredMethodIn(
213 *VeriClass::class_, "getDeclaredField", "(Ljava/lang/String;)Ljava/lang/reflect/Field;");
214 VeriClass::getMethod_ = boot_resolvers[0]->LookupDeclaredMethodIn(
215 *VeriClass::class_,
216 "getMethod",
217 "(Ljava/lang/String;[Ljava/lang/Class;)Ljava/lang/reflect/Method;");
218 VeriClass::getDeclaredMethod_ = boot_resolvers[0]->LookupDeclaredMethodIn(
219 *VeriClass::class_,
220 "getDeclaredMethod",
221 "(Ljava/lang/String;[Ljava/lang/Class;)Ljava/lang/reflect/Method;");
222 VeriClass::getClass_ = boot_resolvers[0]->LookupDeclaredMethodIn(
223 *VeriClass::object_, "getClass", "()Ljava/lang/Class;");
224 VeriClass::loadClass_ = boot_resolvers[0]->LookupDeclaredMethodIn(
225 *VeriClass::class_loader_, "loadClass", "(Ljava/lang/String;)Ljava/lang/Class;");
226
227 VeriClass* version = type_map["Landroid/os/Build$VERSION;"];
228 if (version != nullptr) {
229 VeriClass::sdkInt_ = boot_resolvers[0]->LookupFieldIn(*version, "SDK_INT", "I");
230 }
231 }
232
233 std::vector<std::unique_ptr<VeridexResolver>> app_resolvers;
234 Resolve(app_dex_files, resolver_map, type_map, &app_resolvers);
235 for (const auto &it : type_map) {
236 if (!hidden_api.IsInBoot(it.first)) {
237 hidden_api.AddSignatureSource(it.first, SignatureSource::APP);
238 }
239 }
240
241 ClassFilter app_class_filter(options.app_class_name_filter);
242
243 // Find and log uses of hidden APIs.
244 HiddenApiStats stats;
245
246 HiddenApiFinder api_finder(hidden_api);
247 api_finder.Run(app_resolvers, app_class_filter);
248 api_finder.Dump(std::cout, &stats, !options.precise);
249
250 if (options.precise) {
251 PreciseHiddenApiFinder precise_api_finder(hidden_api);
252 precise_api_finder.Run(app_resolvers, app_class_filter);
253 precise_api_finder.Dump(std::cout, &stats);
254 }
255
256 DumpSummaryStats(std::cout, stats, api_list_filter);
257
258 if (options.precise) {
259 std::cout << "To run an analysis that can give more reflection accesses, " << std::endl
260 << "but could include false positives, pass the --imprecise flag. " << std::endl;
261 }
262
263 return 0;
264 }
265
266 private:
DumpSummaryStats(std::ostream & os,const HiddenApiStats & stats,const ApiListFilter & api_list_filter)267 static void DumpSummaryStats(std::ostream& os,
268 const HiddenApiStats& stats,
269 const ApiListFilter& api_list_filter) {
270 os << stats.count << " hidden API(s) used: "
271 << stats.linking_count << " linked against, "
272 << stats.reflection_count << " through reflection" << std::endl;
273 DumpApiListStats(os, stats, hiddenapi::ApiList(), api_list_filter);
274 for (size_t i = 0; i < hiddenapi::ApiList::kValueCount; ++i) {
275 DumpApiListStats(os, stats, hiddenapi::ApiList(i), api_list_filter);
276 }
277 }
278
DumpApiListStats(std::ostream & os,const HiddenApiStats & stats,const hiddenapi::ApiList & api_list,const ApiListFilter & api_list_filter)279 static void DumpApiListStats(std::ostream& os,
280 const HiddenApiStats& stats,
281 const hiddenapi::ApiList& api_list,
282 const ApiListFilter& api_list_filter) {
283 if (api_list_filter.Matches(api_list)) {
284 os << "\t" << stats.api_counts[api_list.GetIntValue()] << " in " << api_list << std::endl;
285 }
286 }
287
Load(const std::string & filename,std::string & content,std::vector<std::unique_ptr<const DexFile>> * dex_files,std::string * error_msg)288 static bool Load(const std::string& filename,
289 std::string& content,
290 std::vector<std::unique_ptr<const DexFile>>* dex_files,
291 std::string* error_msg) {
292 if (filename.empty()) {
293 *error_msg = "Missing file name";
294 return false;
295 }
296
297 // TODO: once added, use an api to android::base to read a std::vector<uint8_t>.
298 if (!android::base::ReadFileToString(filename, &content)) {
299 *error_msg = "ReadFileToString failed for " + filename;
300 return false;
301 }
302
303 DexFileLoaderErrorCode error_code;
304 static constexpr bool kVerifyChecksum = true;
305 static constexpr bool kRunDexFileVerifier = true;
306 DexFileLoader dex_file_loader(
307 reinterpret_cast<const uint8_t*>(content.data()), content.size(), filename);
308 if (!dex_file_loader.Open(
309 kRunDexFileVerifier, kVerifyChecksum, &error_code, error_msg, dex_files)) {
310 if (error_code == DexFileLoaderErrorCode::kEntryNotFound) {
311 LOG(INFO) << "No .dex found, skipping analysis.";
312 return true;
313 }
314 return false;
315 }
316
317 return true;
318 }
319
Resolve(const std::vector<std::unique_ptr<const DexFile>> & dex_files,DexResolverMap & resolver_map,TypeMap & type_map,std::vector<std::unique_ptr<VeridexResolver>> * resolvers)320 static void Resolve(const std::vector<std::unique_ptr<const DexFile>>& dex_files,
321 DexResolverMap& resolver_map,
322 TypeMap& type_map,
323 std::vector<std::unique_ptr<VeridexResolver>>* resolvers) {
324 for (const std::unique_ptr<const DexFile>& dex_file : dex_files) {
325 VeridexResolver* resolver =
326 new VeridexResolver(*dex_file.get(), resolver_map, type_map);
327 resolvers->emplace_back(resolver);
328 resolver_map[reinterpret_cast<uintptr_t>(dex_file->Begin())] = resolver;
329 }
330
331 for (const std::unique_ptr<VeridexResolver>& resolver : *resolvers) {
332 resolver->Run();
333 }
334 }
335 };
336
337 } // namespace art
338
main(int argc,char ** argv)339 int main(int argc, char** argv) {
340 art::MemMap::Init();
341 return art::Veridex::Run(argc, argv);
342 }
343