Adding Multidex Support To Ensure All APK Classes are Scanned

[LordAmit]

CryptoGuard currently does not properly scan multidex apk file, and only looks at classes.dex file regardless of the dex files included in an apk file.

CryptoGuard uses Soot and dexlib2 for analyzing apks. However, the followings were found:

• dexlib2-2.2.1.jar was being used
• Soot does not have multidex enabled by default

As a result, apks were not being properly analyzed. To fix that, the following changes were necessary

Change in ApkAnalyzer.java

Options.v().set_process_multiple_dex(true);

This allows Soot to handle multidex based class files.

Change in Utils.java and dexlib2 version

public class Utils {

    File zipFile = new File(apkfile);

-        DexFile dexFile = DexFileFactory.loadDexEntry(zipFile, "classes.dex", true, Opcodes.forApi(23));
+        ZipDexContainer zipContainer = (ZipDexContainer) DexFileFactory.loadDexContainer(zipFile,Opcodes.forApi(23));

-        for (ClassDef classDef : dexFile.getClasses()) {
-            String className = classDef.getType().replace('/', '.');
-            if (!className.contains("android."))
-                classNames.add(className.substring(1, className.length() - 1));
+        for(String dexEntryName: zipContainer.getDexEntryNames()){
+            DexFile dexFile = DexFileFactory.loadDexEntry(zipFile, dexEntryName, true, Opcodes.forApi(23));
+
+            for (ClassDef classDef : dexFile.getClasses()) {
+                String className = classDef.getType().replace('/', '.');
+                if (!className.contains("android.")){
+                    classNames.add(className.substring(1, className.length() - 1));
+                }
+            }
         }

Several necessary changes are happening here:

• instead of hardcoding to find the classes.dex file, we are now looking at all of the classes<n>.dex files.
• to do that, we are leveraging the zipContainer.getDexEntryNames()
• However, the zipContainer.getDexEntryNames() is buggy in the used version of dexlib2, and returns an empty String array. Therefore, upgrading it was necessary. We went for the latest stable release, version dexlib2-2.4.0 based on the commit 5339a81f in repository https://github.com/JesusFreke/smali. Since the mentioned repository maintainers do not offer a precompiled version for specifically dexlib2, we compiled it ourselves based on the same commit 5339a81f.