| 66 | print(msg) |
| 67 | |
| 68 | class InterfaceExtractor(): |
| 69 | def __init__(self, |
| 70 | service_name: str, |
| 71 | device: frida.core.Device, |
| 72 | service: vanilla.Service, |
| 73 | binder_db, |
| 74 | meta_device_id=None, |
| 75 | resume=None |
| 76 | ) -> None: |
| 77 | self.service_name = service_name |
| 78 | self.device = device |
| 79 | self.device_id = device.id |
| 80 | if meta_device_id is None: |
| 81 | self.meta_device_id = self.device_id |
| 82 | else: |
| 83 | self.meta_device_id = meta_device_id |
| 84 | self.service = service |
| 85 | self.binder_db = binder_db |
| 86 | self.target_path = os.path.join( |
| 87 | TARGET_DIR, self.meta_device_id, self.service_name |
| 88 | ) |
| 89 | self.out_path = os.path.join(self.target_path, PREPOCESS_DIR_NAME) |
| 90 | self.resume = resume |
| 91 | self.interface = {} |
| 92 | self.new_interface = {} |
| 93 | self.crashing_cmd_ids = [] |
| 94 | |
| 95 | def log(self, msg): |
| 96 | logging.info(f'[EXTRACTOR]{msg}') |
| 97 | print(f'[EXTRACTOR] {msg}') |
| 98 | |
| 99 | def move_fuzz_out(self, intermediate_fuzz_dir): |
| 100 | backup_dir = os.path.join(self.target_path, PREPOCESS_FUZZ_BACK) |
| 101 | if not os.path.exists(backup_dir): |
| 102 | run_cmd(f'mkdir -p {backup_dir}') |
| 103 | run_cmd(f'cp -r {intermediate_fuzz_dir} {backup_dir}/') |
| 104 | |
| 105 | def collect_interface(self, refined_seed_dir): |
| 106 | interface = {} |
| 107 | for cmd_id in os.listdir(refined_seed_dir): |
| 108 | for seed in os.listdir(os.path.join(refined_seed_dir, cmd_id)): |
| 109 | f_p = os.path.join(refined_seed_dir, cmd_id, seed) |
| 110 | deser_p = fuzzparcel.deserialize_parcel(open(f_p, 'rb').read()) |
| 111 | if deser_p is None: |
| 112 | logging.error(f'failed deserializing {f_p}, removing invalid seed') |
| 113 | run_cmd(f'rm {f_p}') |
| 114 | continue |
| 115 | interface[cmd_id] = [t.argtype.name for t in deser_p.entries] |
| 116 | return interface |
| 117 | |
| 118 | def interface_updated(self): |
| 119 | if self.new_interface == {}: |
| 120 | return True |
| 121 | new_deserializer_found = False |
| 122 | for cmd_id in self.new_interface: |
| 123 | if cmd_id not in self.interface: |
| 124 | new_deserializer_found = True |
| 125 | continue |