Conversation
familiary#239) testCrossArchMinhashing ran AArch64 and CIL reports through shingling, storage and sample matching, but Dalvik only had its escaper dispatch and fingerprint tested. It now checks that Dalvik functions are hashed with DalvikInstructionEscaper and that a known near-duplicate and an identical function match by MinHash and PicHash respectively. The fixtures are two functions of smda's own Dalvik test sample (blockblast_classes_xored): report A as smda disassembles it, report B from a copy with one instruction changed (sput-object to const-string, the same 21c format) and its checksum and signature recomputed, since no second build of that app is at hand.
The first Dalvik fixtures paired smda's BlockBlast test DEX with a copy that had one instruction changed, for lack of a second build. They now come from two real builds of the HackingTeam RCS Android implant: three of its own methods in each, two of which changed between the builds (MinHash-only matches at 87.5 and 81.25) and one that did not (PicHash).
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #239.
testCrossArchMinhashingruns AArch64 and CIL reports through escaper dispatch, both shinglers, storage andMatcherSample, but Dalvik only had its dispatch and fingerprint tested. It now gets the same two checks: its minhashes come fromDalvikInstructionEscaper, and two near-duplicates and an identical function match by MinHash and by PicHash.The fixtures come from two builds of the HackingTeam RCS Android implant (rednaga's write-up), trimmed to three of the implant's own methods each:
87efe6a1…)07278c56…)HttpUtils.uploadFile0x16d0c, 189 instructions0x15918, 161Logger.WriteErrorLog0x205f80x1e0f4Serialization.binarySerialize0x19b100x18338For scale, across the whole
classes.dexof the two builds MCRIT reports 2,367 PicHash and 212 MinHash-only function matches. The reports are 85–91 KB; their statistics are cut down to the three functions, the rest of the metadata still describes the whole DEX.Tests only; the full suite is green.