necst / aamo

AAMO: Another Android Malware Obfuscator
MIT License
121 stars 55 forks source link

String Encryption and Renaming dont seem to work #5

Open erev0s opened 5 years ago

erev0s commented 5 years ago

I have the code running and I am testing it to evaluate the quality of obfuscation produced.
Currently as a first attempt i tried using the list of ['Fields', 'Renaming', 'StringEncrypt', 'Manifest']. The resulting obfuscators.log reports success but upon analysis of the output apk all the methods and classes have their original names. I am suspecting I am doing something wrong!

obfuscators.log

DEBUG:root:[erevos]:Obfuscators Initialize: /home/er/Desktop/tools/aamo_erev0s/obfuscators /home/er/Desktop/tools/aamo_erev0s/dir_with_apks_to_obfuscate/erevos/app
DEBUG:root:[erevos]:Obfuscate Request: /home/er/Desktop/tools/aamo_erev0s/dir_with_apks_to_obfuscate/erevos.apk - ['Fields', 'Renaming', 'StringEncrypt', 'Manifest'] - /home/er/Desktop/tools/aamo_erev0s/dir_with_apks_to_obfuscate/erevos
DEBUG:root:[erevos]:Directory cleaned: /home/er/Desktop/tools/aamo_erev0s/dir_with_apks_to_obfuscate/erevos
DEBUG:root:[erevos]:
DEBUG:root:[erevos]:
DEBUG:root:[erevos]:Backsmali: /home/er/Desktop/tools/aamo_erev0s/dir_with_apks_to_obfuscate/erevos.apk into /home/er/Desktop/tools/aamo_erev0s/dir_with_apks_to_obfuscate/erevos
DEBUG:root:[erevos]:I: Using Apktool 2.4.0 on erevos.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /home/er/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Baksmaling classes2.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...

DEBUG:root:[erevos]:
DEBUG:root:[erevos]:Obfuscate Start: 2019-06-17 12:35:13.761913
DEBUG:root:[erevos]:Obfuscator Field
DEBUG:root:[erevos]:Python Obfuscator!
DEBUG:root:[erevos]:Obfuscator Renaming
DEBUG:root:[erevos]:Python Obfuscator!
DEBUG:root:[erevos]:Obfuscator String
DEBUG:root:[erevos]:Python Obfuscator!
DEBUG:root:[erevos]:Obfuscator Manifest
DEBUG:root:[erevos]:Python Obfuscator!
DEBUG:root:[erevos]:Obfuscate Stop: 2019-06-17 12:35:51.097055
DEBUG:root:[erevos]:Obfuscate Time: 0:00:37.335142
DEBUG:root:[erevos]:Smali: /home/er/Desktop/tools/aamo_erev0s/dir_with_apks_to_obfuscate/erevos.apk from /home/er/Desktop/tools/aamo_erev0s/dir_with_apks_to_obfuscate/erevos
DEBUG:root:[erevos]:I: Using Apktool 2.4.0
I: Smaling smali folder into classes.dex...

DEBUG:root:[erevos]:dir_with_apks_to_obfuscate/erevos/app/smali/ac31b3236/a9a0364b9/a9b207167/ada38cd10.smali[19,4] Error for input '.parameter': Invalid directive
dir_with_apks_to_obfuscate/erevos/app/smali/ac31b3236/a9a0364b9/a9b207167/ada38cd10.smali[19,15] mismatched input '"str"' expecting END_METHOD_DIRECTIVE
dir_with_apks_to_obfuscate/erevos/app/smali/ac31b3236/a9a0364b9/a9b207167/ada38cd10.smali[74,4] Error for input '.parameter': Invalid directive
dir_with_apks_to_obfuscate/erevos/app/smali/ac31b3236/a9a0364b9/a9b207167/ada38cd10.smali[74,15] mismatched input '"s"' expecting END_METHOD_DIRECTIVE
dir_with_apks_to_obfuscate/erevos/app/smali/ac31b3236/a9a0364b9/a9b207167/ada38cd10.smali[186,4] Error for input '.parameter': Invalid directive
dir_with_apks_to_obfuscate/erevos/app/smali/ac31b3236/a9a0364b9/a9b207167/ada38cd10.smali[187,4] Error for input '.parameter': Invalid directive
dir_with_apks_to_obfuscate/erevos/app/smali/ac31b3236/a9a0364b9/a9b207167/ada38cd10.smali[186,15] mismatched input '"mode"' expecting END_METHOD_DIRECTIVE
dir_with_apks_to_obfuscate/erevos/app/smali/ac31b3236/a9a0364b9/a9b207167/ada38cd10.smali[198,4] missing EOF at '.prologue'
Could not smali file: ac31b3236/a9a0364b9/a9b207167/ada38cd10.smali

DEBUG:root:[erevos]:Sign: /home/er/Desktop/tools/aamo_erev0s/dir_with_apks_to_obfuscate/erevos.apk
DEBUG:root:[erevos]:jar signed.

Warning: 
The MD5withRSA algorithm specified for the -sigalg option is considered a security risk.

DEBUG:root:[erevos]:
DEBUG:root:[erevos]:Directory cleaned: /home/er/Desktop/tools/aamo_erev0s/dir_with_apks_to_obfuscate/erevos
DEBUG:root:[erevos]:
DEBUG:root:[erevos]:
DEBUG:root:[erevos]:### SUCCESS ### {0:00:37.335142}

SECOND ATTEMPT
This time i tried to run ['Manifest', 'Renaming'] only, and to my surprise the output was indeed obfuscated, the names of the methods and classes are random this time. I tried to run this apk but no matter if i run in on emulator or not the result is that it keeps crashing with a message from Android Name_of_the_app keeps stopping.

THIRD ATTEMPT
Using only ['Renaming'], nothing happens again, like the first attempt

P.S The paths are wrong in the obfuscators/obfuscators.py and i have fixed them in order for this to work -- plus i have made the appropriate changes in smali and backsmali to work with apktool 2.4.0