#!/usr/bin/python # -*- coding: utf-8 -*- from pychrysalide import PluginModule from pychrysalide.analysis.contents import EncapsulatedContent from pychrysalide.analysis.contents import MemoryContent from pychrysalide.core import _global import io import zipfile class ApkFiles(PluginModule): """Open and process APK files.""" def get_interface(self): """Provide the full plugin description.""" desc = { 'name' : 'ApkFiles', 'desc' : 'Add suppport for the APK file format', 'version' : '0.1', 'actions' : [ PluginModule.PGA_CONTENT_EXPLORER ] } return desc def handle_content(self, action, content, wid, status): """Process an operation on a binary content.""" assert(action == PluginModule.PGA_CONTENT_EXPLORER) pseudo_file = io.BytesIO(content.data) if zipfile.is_zipfile(pseudo_file): zf = zipfile.ZipFile(pseudo_file) if zf.namelist().count('classes.dex') > 0 \ and zf.namelist().count('AndroidManifest.xml') > 0: explorer = _global().content_explorer for name in zf.namelist(): f = zf.open(name, 'r') data = f.read() f.close() mem_content = MemoryContent(data) encaps_content = EncapsulatedContent(content, name, mem_content) explorer.populate_group(wid, encaps_content)