search

MobSF / Mobile-Security-Framework-MobSF

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
https://opensecurity.in
GNU General Public License v3.0
16.68k stars 3.16k forks source link

Tests failing for Binskim and Binscope in StaticAnalysis #2349

Closed Mardigas closed 3 months ago

Mardigas commented 4 months ago

ENVIRONMENT

OS and Version: Windows 10
Python Version: Python 3.11.4
MobSF Version: v3.9.4

EXPLANATION OF THE ISSUE

Binskim and Binscope arguments are being passed to subprocess_hook from windows.py binskim function and windows.py binscope function as a tuple with string inside it, instead of a tuple containing list. In result it throws an TypeError when trying to parse executable name from params.

Args in subprocess hook currently:  ('\\MobSF\\Tools\\Microsoft.CodeAnalysis.BinSkim.1.7.2\\tools\\netcoreapp3.1\\win-x64\\BinSkim.exe analyze \\.MobSF\\uploads/8179b557433835827a70510584f3143e/AppStudio.exe --verbose -o \\.MobSF\\uploads/8179b557433835827a70510584f3143e/AppStudio.exe_binskim --config default --force',)

Should be: (['\\MobSF\\Tools\\Microsoft.CodeAnalysis.BinSkim.1.7.2\\tools\\netcoreapp3.1\\win-x64\\BinSkim.exe', 'analyze', '\\.MobSF\\uploads/8179b557433835827a70510584f3143e/AppStudio.exe', '--verbose', 
'-o', '\\.MobSF\\uploads/8179b557433835827a70510584f3143e/AppStudio.exe_binskim', '--config', 'default', '--force'],)

I think the problem is the use of subprocess.list2cmdline function in mentioned lines here and here, because without it everything seemed to work correctly

github-actions[bot] commented 4 months ago

👋 @Mardigas Issues is only for reporting a bug/feature request. For limited support, questions, and discussions, please join MobSF Slack channel Please include all the requested and relevant information when opening a bug report. Improper reports will be closed without any response.

ajinabraham commented 4 months ago

I will take a look at this when I get some time. Thanks for reporting and sharing the details here.