search

MobSF / Mobile-Security-Framework-MobSF

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
https://opensecurity.in
GNU General Public License v3.0
17.3k stars 3.22k forks source link

[FEATURE] Support non-default XMLNS attribute in androidManifest.xml #2198

Closed JonasH-polestar closed 1 year ago

JonasH-polestar commented 1 year ago

Is your feature request related to a problem? Please describe. Some APKs seemingly has a different naming scheme for things that usually are prefixed with android:xxxx, this prevents mobsf from properly listing things such as used permissions etc.
At present I am unsure whether this comes from the build process of the APK itself, or if it comes from the tooling underneath mobsf to extract the manifest.

Describe the solution you'd like Preferably MobSF would read the XMLNS attached to http://schemas.android.com/apk/res/android instead of using the hardcoded android: prefix.

Describe alternatives you've considered I took a look at the source code to figure out whether the prefix was hard coded in MobSF, and it does seem to be the case looking at https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/dc0dc273e520d6bf2949e75fcf8dc10e27866b30/mobsf/StaticAnalyzer/views/android/manifest_analysis.py#L97

Additional context I am not sure whether linking APK mirrors here are allowed, but for testing I used Vivaldi Browser 6.1.3035.102 of the x86_64 architecture.

MobSF version: c7578b87 (jun 14)

github-actions[bot] commented 1 year ago

👋 @JonasH-polestar Issues is only for reporting a bug/feature request. For limited support, questions, and discussions, please join MobSF Slack channel Please include all the requested and relevant information when opening a bug report. Improper reports will be closed without any response.

ajinabraham commented 1 year ago

Thanks for reporting will add this to the backlog.

ajinabraham commented 1 year ago

@JonasH-polestar this is addressed in https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2248/files