jbkddlZddlZddlZddlZddlmZddlmZmZddl m Z m Z m Z GddZ Gdd ZGd d ZGd d ZGddZdZdededefdZdS)N)Dict)!extract_file_based_on_header_info(extract_all_files_from_central_directory)pretty_print_header save_to_jsonsave_data_to_filecJeZdZdZdZedZdZedZdS)EndOfCentralDirectoryRecordzO A class to provide details about the end of central directory record. c ||_||_||_||_||_||_||_||_| |_dSN signaturenumber_of_this_disk#disk_where_central_directory_starts0number_of_central_directory_records_on_this_disk)total_number_of_central_directory_recordssize_of_central_directory$offset_of_start_of_central_directorycomment_lengthcomment) selfrrrrrrrrrs [/home/ubuntu/.hermes/hermes-agent/venv/lib/python3.11/site-packages/apkInspector/headers.py__init__z$EndOfCentralDirectoryRecord.__init__sN##6 3V0@p=9b6)B&4X1, c d}d}d}|dd}||krrtd||z |z }||||}|sn/|d}|dkr||z}n||dz z }||kr|dkrt d|||d} t jd|dd} t jd|dd} t jd|dd} t jd|dd} t jd |dd}t jd |dd}t jd|dd}t jd |d ||dd d }|| | | | | |||| S)a Method to locate the "end of central directory record signature" as the first step of the correct process of reading a ZIP archive. Should be noted that certain APKs do not follow the zip specification and declare multiple "end of central directory records". For this reason the search for the corresponding signature of the eocd starts from the end of the apk. :param apk_file: The already read/loaded data of the APK file e.g. with open('test.apk', 'rb') as apk_file :type apk_file: bytesIO :return: Returns the end of central directory record with all the information available if the corresponding signature is found. If not, then it returns None. :rtype: EndOfCentralDirectoryRecord or None irsPKz:End of central directory record (EOCD) signature not found>H MM( # # #MM*--E ${{+>?? 2%%.69I.I+ j1n $Fy   r ! !YZZ Z 1222MM!$$ $mD(--2B2BCCAF.4mD(--PQBRBR.S.STU.V+;A=x}}]^O_O_;`;`ab;c84:M$ VWHXHX4Y4YZ[4\1$*M$ a8H8H$I$I!$L!/5}T8==QRCSCS/T/TUV/W,tX]]1-=-=>>qA- 5N 5 5 5x}}^7T7TUUVWX__`giqrrs   / < 5 % 0     rc t|j|j|j|j|j|j|j|j|jd S)t Represent the class as a dictionary. :return: returns the dictionary :rtype: dict rrrs rto_dictz#EndOfCentralDirectoryRecord.to_dictTsG#'#;373[@D@u9=9g)-)G484]"1|   rc|di|S)z Convert a dictionary back to an instance of the class. :param entry_dict: the dictionary :type entry_dict: dict :return: the instance of the class :rtype: EndOfCentralDirectoryRecord r=r. entry_dicts r from_dictz%EndOfCentralDirectoryRecord.from_dictgs  Z   rN) __name__ __module__ __qualname____doc__r classmethodr7r;r@r=rrr r ss   4 4 [4 l   & ! ![ ! ! !rr c4eZdZdZdZdZedZdS)CentralDirectoryEntryzC A class representing each entry in the central directory. c||_||_||_||_||_||_||_||_| |_| |_ | |_ | |_ | |_ ||_ ||_||_||_||_||_||_dSr version_made_byversion_needed_to_extractgeneral_purpose_bit_flagcompression_methodfile_last_modification_timefile_last_modification_datecrc32_of_uncompressed_datacompressed_sizeuncompressed_sizefile_name_lengthextra_field_lengthfile_comment_lengthdisk_number_where_file_startsinternal_file_attributesexternal_file_attributes$relative_offset_of_local_file_headerfilename extra_field file_commentoffset_in_central_directory)rrKrLrMrNrOrPrQrRrSrTrUrVrWrXrYrZr[r\r]r^s rrzCentralDirectoryEntry.__init__xs /)B&(@%"4+F(+F(*D'.!2 0"4#6 -J*(@%(@%4X1  &(+F(((rc@id|jd|jd|jd|jd|jd|jd|jd|jd |jd |j d |j d |j d |j d|j d|jd|jd|j|j|j|jdS)r9rKrLrMrNrOrPrQrRrSrTrUrVrWrXrYrZr[)r\r]r^rJr:s rr;zCentralDirectoryEntry.to_dicts) t3 ')G  '(E  !$"9  *4+K  *4+K   )$*I  t3  !7   5  !$"9  "4#;  ,T-O  '(E  '(E 3D4]! "  # $ + -+/+K)    rc|di|S)z Convert a dictionary back to an instance of the class. :param entry_dict: the dictionary :type entry_dict: dict :return: the instance of the class :rtype: CentralDirectoryEntry r=r=r>s rr@zCentralDirectoryEntry.from_dictrArN)rBrCrDrErr;rFr@r=rrrHrHtsZGGG6   < ! ![ ! ! !rrHcReZdZdZdZeddefdZdZedZ dS) CentralDirectoryz The CentralDirectory containing all the CentralDirectoryEntry entries discovered. The entries are listed as a dictionary where the filename is the key. c||_dSr entries)rres rrzCentralDirectory.__init__s  rNeocdc |st|}||j||jkrt di} |}|d}|dkrntjd|dd}tjd|dd}tjd|dd}tjd|dd} tjd|dd} tjd|dd} tjd|dd} tjd|dd} tjd|dd}tjd|dd}tjd|dd}tjd|dd}tjd|dd}tjd|dd}tjd|dd}tjd|dd}tjd |d ||d d d }tjd |d ||d d d }tjd |d ||d d d }|}t|||| | | | | ||||||||||||}|||j <||S) a Method that is used to parse the central directory header according to the specification https://pkware.cachefly.net/webdocs/APPNOTE/APPNOTE-6.3.9.TXT based on the offset provided by the end of central directory record: eocd.offset_of_start_of_central_directory. :param apk_file: The already read/loaded data of the APK file e.g. with open('test.apk', 'rb') as apk_file :type apk_file: bytesIO :param eocd: End of central directory record :type eocd: EndOfCentralDirectoryRecord :return: Returns a dictionary with all the entries discovered. The filename of each entry is used as the key. Besides the fields defined by the specification, each entry has an additional field named 'Offset in the central directory header', which includes the offset of the entry in the central directory itself. :rtype: CentralDirectory zDFailed to find the offset for the central directory within the file!TrsPKr rrr!r"r#r$r%) r r7r&rtellr*r(r+r,r-rHr[)r.r/rfcentral_directory_entriesc_offsetrrKrLrMrNrOrPrQrRrSrTrUrVrWrXrYrZr[r\r]r^central_directory_entrys rr7zCentralDirectory.parses ?.44X>>D d?@@@ ==??dG G Gdee e$&!" b}}H a((I///$mD(--2B2BCCAFO(. dHMM!N>N*O*OPQ*R '*0-hmmA>N>N*O*OPQ*R ')/tX]]1=M=M)N)Nq)Q &$mD(--2B2BCCAFO & dHMM!4D4D E Ea H %}T8==3C3CDDQG !'tX]]15E5E!F!Fq!I "(-hmmA6F6F"G"G"J ,2M$ a@P@P,Q,QRS,T )'-}T8==;K;K'L'LQ'O $'-}T8==;K;K'L'LQ'O $39=x}}UVGWGW3X3XYZ3[ 0}%<)9%<%<%]>]^^_`ahhiprz{{H -(A,>(A(A(A8==QcCdCdeefghoopwzBCCK!=)C-@)C)C)CX]]SfEgEghhijkrrsz}EFFL*2 '&;!:i|]\}}||Sr=r;.0r[entrys r z,CentralDirectory.to_dict..s&VVVoh%--//VVVr)reitemsr:s rr;zCentralDirectory.to_dicts'WVASASAUAUVVVVrci}|D]$\}}t|}|||<%||S)z Convert a dictionary back to an instance of the class. :param entry_dict: the dictionary :type entry_dict: dict :return: the instance of the class :rtype: CentralDirectory rd)rsrHr@)r.r?rer[ entry_dataentry_instances rr@zCentralDirectory.from_dict s\$.$4$4$6$6 / / Hj2<8.8.8.[8.tWWW $ $[ $ $ $rrbcPeZdZdZdZedefdZdZedZ dS)LocalHeaderRecordz5 The local header for each entry discovered. c ||_||_||_||_||_||_||_||_| |_| |_ | |_ | |_ dSr rLrMrNrOrPrQrRrSrTrUr[r\) rrLrMrNrOrPrQrRrSrTrUr[r\s rrzLocalHeaderRecord.__init__sj *C&(@%"4+F(+F(*D'.!2 0"4  &rentry_of_interestc||j|d}|dkstjddSt jd|dd}t jd|dd}t jd|dd}t jd|dd}t jd|dd}t jd|dd} t jd|dd} t jd|dd} t jd|dd} t jd|dd} t jd | d || dd d }t jd | d || dd d }n#|j}|j }YnxYw||||||| | | | | || S) ai Method that attempts to read the local file header according to the specification https://pkware.cachefly.net/webdocs/APPNOTE/APPNOTE-6.3.9.TXT. :param apk_file: The already read/loaded data of the APK file e.g. with open('test.apk', 'rb') as apk_file :type apk_file: bytesIO :param entry_of_interest: The central directory header of the specific entry of interest :type entry_of_interest: CentralDirectoryEntry :return: Returns a dictionary with the local header information or None if it failed to find the header. :rtype: LocalHeaderRecord or None rsPKz0Does not seem to be the start of a local header!Nr rrr!r"r#r$r%) r&rZr(loggingwarningr+r,r-r[r\)r.r/r{header_signaturerLrMrNrOrPrQrRrSrTrUr[r\s rr7zLocalHeaderRecord.parse1s  'LMMM#==++#666 ON O O O4(. dHMM!N>N*O*OPQ*R '*0-hmmA>N>N*O*OPQ*R ')/tX]]1=M=M)N)Nq)Q &$mD(--2B2BCCAFO & dHMM!4D4D E Ea H %}T8==3C3CDDQG !'tX]]15E5E!F!Fq!I  <!=)@-=)@)@)@(--P`BaBabbcdellmtv~$m,E0B,E,E,Ex}}UgGhGhiijklsst{~FGG  <,5/; s %'?AS ')DF` .0@BT k ## #s B J&&J8c |j|j|j|j|j|j|j|j|j|j |j |j d S)r9rzrzr:s rr;zLocalHeaderRecord.to_dictZsZ*.)G(,(E"&"9+/+K+/+K*.*I#3!%!7 $ 5"&"9 +   rc|di|S)z Convert a dictionary back to an instance of the class. :param entry_dict: the dictionary :type entry_dict: dict :return: the instance of the class :rtype: LocalHeaderRecord r=r=r>s rr@zLocalHeaderRecord.from_dictprArN) rBrCrDrErrFrHr7r;r@r=rrrxrxs'''$&#0E&#&#&#[&#P   , ! ![ ! ! !rrxceZdZdZdededeeeffdZ e dde fdZ e ddedefd Z d Zd Zd Zdde fdZdeeeffdZdZdZd S)ZipEntryz Is the actual APK represented as a composition of the previous classes, which are: the EndOfCentralDirectoryRecord, the CentralDirectory and a dictionary of values of LocalHeaderRecord. rfcentral_directory local_headersc>||_||_||_||_dSr )ziprfrr)r zip_bytesrfrrs rrzZipEntry.__init__s& !2*rTrawc|r|}nNt|d5}tj|}dddn #1swxYwYt|}t ||}i}|jD]4}t||j|} | r | || j <5|||||S)a Method to start processing an APK. The raw (bytes) APK may be passed or the path to it. :param inc_apk: the incoming apk, either path or bytes :type inc_apk: str or bytesIO :param raw: boolean flag to specify whether it is the raw apk in bytes or not :type raw: bool :return: returns the instance of the class :rtype: ZipEntry rbN) openioBytesIOr(r r7rbrerxr[) r.inc_apkrr/apkrfrrrqlocal_header_entrys rr7zZipEntry.parses  2HHgt$$ 2:chhjj11 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2*00::,228TBB &. P PE!2!8!8CTC\]bCc!d!d ! P=O 09:s8T#4mDDDs'A  A A Nc|r|s5t|}t||}|t||j|i}|||||S)a Similar to parse, but instead of parsing the entire APK, it only targets the specified file. :param apk_file: The apk file expected raw :type apk_file: bytesIO :param filename: the filename of the file to be parsed :type filename: str :param eocd: Optionally, the instance of the end of central directory from the APK :type eocd: EndOfCentralDirectoryRecord(, optional) :param central_directory: Optionally, the instance of the central directory record :type central_directory: CentralDirectory(, optional) :return: returns the instance of the class :rtype: ZipEntry )r r7rbrxre)r.r/r[rfr local_headers r parse_singlezZipEntry.parse_singles{" G, G.44X>>D 0 6 6x F F  "3"9"9(DUD]^fDg"h"hi s8T#4lCCCrc|j|jd|jDdS)r9c>i|]\}}||Sr=rnros rrrz$ZipEntry.to_dict..s&jjjOHeh jjjr)end_of_central_directoryrr)rfr;rrrsr:s rr;zZipEntry.to_dictsV)- (9(9(;(;!%!7!?!?!A!AjjtOaOgOgOiOijjj   rc||jjvr$|jj|Std|d)aN Method to retrieve the central directory entry for a specific filename. :param filename: the filename of the file to search for in the central directory :type filename: str :return: returns a dictionary of the central directory entry or None if the filename is not found :rtype: dict Key: z4 was not found within the central directory entries!)rrer;KeyErrorrr[s r get_central_directory_entry_dictz)ZipEntry.get_central_directory_entry_dictsL t-5 5 5)1(;CCEE Ea8aaabb brcx||jvr|j|Std|d)a< Method to retrieve the local header of a specific filename. :param filename: the filename of the entry to search for among the local headers :type filename: str :return: returns a ditionary of the local header entry or None if the filename is not found :rtype: dict rz- was not found within the local headers list!)rr;rrs rget_local_header_dictzZipEntry.get_local_header_dictsF t) ) )%h/7799 9Z8ZZZ[[ [rFsavect|j||||d}|rt d|||S)a Method to utilize the extract module and extract a single entry from the APK based on the filename. :param name: the name of the file to be read/extracted :type name: str :param save: boolean to define whether the extracted file should be saved as well or not :type save: bool(, optional) :return: returns the raw bytes of the filename that was extracted :rtype: bytes r EXTRACTED_)rrrrr )rnamerextracted_files rr(z ZipEntry.readsm;48TE_E_`dEeEe;?;`;`ae;f;fhhhik  C 1411> B B Brreturnc|jjS)z List of information about the entries in the central directory. :return: returns a dictionary where the keys are the filenames and the values are each an instance of the CentralDirectoryEntry :rtype: dict )rrer:s rinfolistzZipEntry.infolists%--rcHd|jDS)z List of the filenames included in the central directory. :return: returns the list of the filenames :rtype: list cg|]}|Sr=r=)rpvls r z%ZipEntry.namelist..s>>>r>>>r)rr;r:s rnamelistzZipEntry.namelists'?>T3;;==>>>>rctj||}t|j|d|d|st jd|dSdS)z Extracts all the contents of the APK. :param extract_path: where to extract it :type extract_path: str :param apk_name: the name of the apk :type apk_name: str rrzExtraction successful for: N)ospathjoinrrr;r}info)r extract_pathapk_name output_paths r extract_allzZipEntry.extract_allsgll<:: 7$,,..QdBe8< 8WYdff C LAxAA B B B B B C Cr)T)NN)F)rBrCrDrEr rbrstrrxrrFboolr7rr;rrr(rHrrrr=rrrr}se+(C+Xh+ $S*;%; <++++EEEEE[E2RV;?DD4OD(8DDD[D,     c c c \ \ \t".$s$99:....??? C C C C Crrc |r|stjddStd|D]h}|dks|dkr?t|ddt t ||d||Mt|dd||itd |D]}t|dd||dS) a Prints out the details for both the central directory header and the local file header. Useful for the CLI. :param cd_h_of_file: central directory header of a filename as it may be retrieved from headers_of_filename :type cd_h_of_file: dict :param local_header_of_file: local header dictionary of a filename as it may be retrieved from headers_of_filename :type local_header_of_file: dict z!Are you sure the filename exists?NzCENTRAL DIRECTORYz$Relative offset of local file headerz&Offset in the central directory header40z : z | z LOCAL HEADER)r}rrprinthexint) cd_h_of_filelocal_header_of_fileks rprint_headers_of_filenamers 3 8999+,,, 11 6 6 6!?g:g:g QMMMc#l1o"6"677MMLOMM N N N N Q///l1o// 0 0 0 0''' !55 333.q133444455r header_typeexportshowc|r)|D]&}t|t||'|rt|d|d|dSdS)av Print information for each entry for the central directory header and allow to possibly export to JSON. :param entries: The dictionary with all the entries for the central directory :type entries: dict :param apk_name: String with the name of the APK, so it can be used for the export. :type apk_name: str :param header_type: What type of header that is, either central_directory or local, to be used for the export :type header_type: str :param export: Boolean for exporting or not to JSON :type export: bool :param show: Boolean for printing or not the entries :type show: bool _z _header.jsonN)rrr)rerrrrrqs rshow_and_save_info_of_headersr+sz " " "E  & & & '%. ! ! ! ! G<<;<<rs  ````````IIIIIIIIIIf!f!f!f!f!f!f!f!RG!G!G!G!G!G!G!G!TZ$Z$Z$Z$Z$Z$Z$Z$z_!_!_!_!_!_!_!_!DTCTCTCTCTCTCTCTCn555.G#GtG[_GGGGGGr