Bug in SMALI parsing with extra whitespace

[TheDauntless]

Describe the bug I have a malware sample that contains the following SMALI line:

const-string v1 "Auto"\r

Dexcalibur gives an error while analyzing.

To reproduce / to understand Ran excalibur with debug to get the following error:

TypeError: Cannot read property '1' of null
    at Object.setstring [as parse] (/usr/local/lib/node_modules/dexcalibur/src/Opcode.js:329:20)
    at Object.parse (/usr/local/lib/node_modules/dexcalibur/src/Opcode.js:1043:15)
    at SmaliParser.instr (/usr/local/lib/node_modules/dexcalibur/src/SmaliParser.js:324:23)
    at SmaliParser.method (/usr/local/lib/node_modules/dexcalibur/src/SmaliParser.js:611:32)
    at SmaliParser.parse (/usr/local/lib/node_modules/dexcalibur/src/SmaliParser.js:733:34)
    at Analyzer.file (/usr/local/lib/node_modules/dexcalibur/src/Analyzer.js:800:30)
    at /usr/local/lib/node_modules/dexcalibur/src/Analyzer.js:839:18
    at Object.forEachFileOf (/usr/local/lib/node_modules/dexcalibur/src/Utils.js:108:21)
    at Object.forEachFileOf (/usr/local/lib/node_modules/dexcalibur/src/Utils.js:105:26)
    at Analyzer.path (/usr/local/lib/node_modules/dexcalibur/src/Analyzer.js:838:12)

I added a few debug lines as wel at line 324:

console.log(src);
console.log("---");
console.log(raw_src);

[ 'const-string', 'v1,', '"Auto"\r' ]
---
 v1, "Auto"

Expected behavior Not crash

Desktop (please complete the following information):

• OS: Kali
• Node JS version: v12.21.0
• Dexcalibur version (see 'package.json' or output) : 0.7.8

I'm not sure if it's valid SMALI code, but the sample appears to execute correctly.

Fix

I added raw_src = raw_src.trim(); to Opcode.js:1040 but there may be a better place to put that.

[FrenchYeti]

Hey :)

Thank you for this interesting issue ! I will fix it now.

But as you said, i'm not sure it is valid smali

[FrenchYeti]

Very thank you.

Fixed by 132d55eedad4bae03742a6967fdeefdf1d26b673