vincentcox / StaCoAn

StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
MIT License
825 stars 129 forks source link

local variable issue #75

Open jaikishantulswani opened 5 years ago

jaikishantulswani commented 5 years ago

Hello @vincentcox , I am facing this error after supplying the apk UnboundLocalError: local variable 'sorted_tosort' referenced before assignment [WARNING] 127.0.0.1 - - [10/Oct/2018 19:35:59] code 404, message File not found

vincentcox commented 5 years ago

Are you using a build from the release? Or do you use the python command line?

If it's possible, I can check with your APK to debug this issue.

jaikishantulswani commented 5 years ago

Hi @vincentcox , Thanks for prompt reply. I am using from the command line.

vincentcox commented 5 years ago

What happens if you use: python3 stacoan.py -p test-apk.apk --disable-server --disable-browser

You can also try to put your APK in the same folder as stacoan (in the src folder). then run: python3 stacoan.py -p your-apk.apk --disable-server --disable-browser

jaikishantulswani commented 5 years ago

Getting the same even with the test-apk.apk `python3 stacoan.py -p test-apk.apk --disable-server --disable-browser [INFO] Decompiling app... [INFO] /mnt/Security/Tools/Android/StaCoAn/src/test-apk_apk/jadx_source_code [INFO] "/mnt/Security/Tools/Android/StaCoAn/src/jadx/bin/jadx" -d "/mnt/Security/Tools/Android/StaCoAn/src/test-apk_apk/jadx_source_code" "test-apk.apk" Invalid maximum heap size: -Xmx4g The specified size exceeds the maximum representable size. Error: Could not create the Java Virtual Machine. Error: A fatal exception has occurred. Program will exit. [INFO] --------- JADX OUTPUT BELOW ---------

[INFO] jadx return code: 1 [INFO] Decompiling done. [INFO] Searching trough files [INFO] Searching done. [INFO] start generating report [INFO] progress: 100%
[ERROR] ERROR: Unknown error: local variable 'sorted_tosort' referenced before assignment. `

vincentcox commented 5 years ago

I know what happened. JADX could not allocate 4Gigs of memory so it didn't run. The program tries to continue anyhow and there are 0 results, which causes a for loop to not run somewhere.

Please double check that you are using 64-bit java version. JADX sets max memory heap to 4GB by default. This only possible on 64-bit java.

jaikishantulswani commented 5 years ago

Is this issue with system architecture, as I am having 32bit system.

vincentcox commented 5 years ago

Indeed, it's caused by the 32 bit architecture. However, you can try to run: set DEFAULT_JVM_OPTS="-Xms128M" "-Xmx2g"

But I am not sure if it will work because StaCoAn spawns an own subshell.

vincentcox commented 5 years ago

Let me know if it works. I will try to make a fix for this if it's not working.

jaikishantulswani commented 5 years ago

Still getting the same :(

vincentcox commented 5 years ago

I'll create a fix this weekend. Thanks for reporting this issue, I will let you know when the fix is available.

Note for myself:

jaikishantulswani commented 5 years ago

Hello @vincentcox , Thank you for your quick & positive response on this issue. Waiting for the fix :1234:

vincentcox commented 5 years ago

Can you try the DEV branch?

git clone -b dev https://github.com/vincentcox/StaCoAn
cd StaCoAn
cd src
python3 stacoan.py -p test-apk.apk --disable-server --disable-browser

Let me know what the output is, If it works for you then I know the fix is working and I push it to the master.

jaikishantulswani commented 5 years ago

Hi @vincentcox , Sorry for the delay, still getting the same issue

python3 stacoan.py -p test-apk.apk --disable-server --disable-browser [INFO] Decompiling app... [INFO] /mnt/Security/Tools/Android/StaCoAn/src/test-apk_apk/jadx_source_code [INFO] "/mnt/Security/Tools/Android/StaCoAn/src/jadx/bin/jadx" -d "/mnt/Security/Tools/Android/StaCoAn/src/test-apk_apk/jadx_source_code" "test-apk.apk" [INFO] 32 bit detected, setting max memory for java to 2G instead of 4G. This might cause problems for JADX. Invalid maximum heap size: -Xmx4g The specified size exceeds the maximum representable size. Error: Could not create the Java Virtual Machine. Error: A fatal exception has occurred. Program will exit. [INFO] --------- JADX OUTPUT BELOW ---------

[INFO] jadx return code: 1 [INFO] Decompiling done. [INFO] Searching trough files [INFO] Searching done. [INFO] start generating report [INFO] progress: 100%
[ERROR] ERROR: Unknown error: local variable 'sorted_tosort' referenced before assignment.

jaikishantulswani commented 5 years ago

Hello @vincentcox , Any updates on this ?

vincentcox commented 5 years ago

Can you try the dev branch again?

git clone -b dev https://github.com/vincentcox/StaCoAn
cd StaCoAn
cd src
python3 stacoan.py -p test-apk.apk --disable-server --disable-browser

Normally it should work now because I put the variable into the command. Let me know the output if it still doesn't work, we'll figure it out!

jaikishantulswani commented 5 years ago

Hello @vincentcox , Don't know why its not working on my machine ??? Still getting the same issue check this screenshot from 2018-10-19 17-30-40

vincentcox commented 5 years ago

I'll download a 32 bit kali machine to figure this out. It will take me some time but I will dive into this! 💪

jaikishantulswani commented 5 years ago

Great @vincentcox :+1:

vincentcox commented 5 years ago

I was able to reproduce it and found the cause why our limit was not correctly applied.

You have to open src/jadx/bin/jadxand uncomment the line DEFAULT_JVM_OPTS='"-Xms128M" "-Xmx4g"'. Then it should work (at least for me it did).

jaikishantulswani commented 5 years ago

Hi @vincentcox , Thank you, it Works :+1: :100: This is the best support I ever got :100:

vincentcox commented 5 years ago

No problem, thank you for your patience because it took me some time to figure it out. Soon I will push a global fix for this, but meanwhile you can use this fix to get it working for you. Have a nice weekend!

jaikishantulswani commented 5 years ago

Thank you :+1: