Cynosphere/bcv-vf
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

2.7.0

Browse source 
01/11/2015 - Improved the Refresh Class function to be used as the
default compile function.
01/11/2015 - Implemented better error handling for decompiling class
files.
01/15/2015 - CTRL + O will open the add file interface.
01/15/2015 - CTRL + N will open the net workspace interface.
01/15/2015 - It will now save the last directory you opened.
01/15/2015 - Some how the URL for the auto updater change log got
changed, this has been fixed.
01/15/2015 - Slightly updated the change log display, it'll now show all
the changes since your version.
01/16/2015 - Made EZ-Injection UI look a bit nicer.
01/27/2015 - Decided to scrap the  JVM Sandbox POC and use the Security
Manager.
01/27/2015 - BCV now blocks exec and won't allow any ports to be bound.
This commit is contained in:
Kalen Kinloch 2015-01-27 12:45:12 -08:00
parent bc9cfe13f3
commit d9f35b8288
5 changed files with 37 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

BIN
BytecodeViewer 2.7.0.jar
View file

Binary file not shown.

4
README.txt
View file

@ -14,8 +14,8 @@ Code from various projects has been used, including but not limited to:
Procyon by Mstrobel
CFR by Lee Benfield
CFIDE by Bibl
Smali by JesusFreke
Dex2Jar by pxb1..?
Smali by JesusFreke
Dex2Jar by pxb1..?
Contributors:
Konloch

11
src/the/bytecode/club/bytecodeviewer/BytecodeViewer.java
View file

@ -80,12 +80,8 @@ import the.bytecode.club.bytecodeviewer.plugins.PluginManager;
* Option to make the bytecode pane automatically scroll to where the source code pane is
* Replacing all string field calls with the string instance - would require EZ-Injection to run code?
* Spiffy up the plugin console with red text optional, would require JTextPane, not JTextArea.
* Add robot to malware scanner
* Add right click on tab > close other tabs > close this tab
* Try automatic insert return null for all runtime.exec methods via ASM3; //maybe just do AMS5 then obfuscate the dex2jar shit.
*
* Look at Desktop.getDesktop().open();
* refine POC and just use sec man
* maybe just do AMS5 then obfuscate the dex2jar shit.
*
* ----Beta 1.0.0-----:
* 10/4/2014 - Designed a POC GUI, still needs a lot of work.
@ -304,15 +300,12 @@ import the.bytecode.club.bytecodeviewer.plugins.PluginManager;
* 01/16/2015 - Made EZ-Injection UI look a bit nicer.
* 01/27/2015 - Decided to scrap the JVM Sandbox POC and use the Security Manager.
* 01/27/2015 - BCV now blocks exec and won't allow any ports to be bound.
* 01/27/2015 - Added java.awt.Robot to the malicious code scanner.
*
* @author Konloch
*
*/
/**
* Store the inst object and original class bytes, then allow optional real time toggling?
*/
public class BytecodeViewer {
public static MainViewerGUI viewer = null;

35
src/the/bytecode/club/bytecodeviewer/gui/MaliciousCodeScannerOptions.java
View file

@ -25,7 +25,7 @@ import java.awt.event.ActionEvent;
public class MaliciousCodeScannerOptions extends JFrame {
public MaliciousCodeScannerOptions() {
this.setIconImages(BytecodeViewer.iconList);
setSize(new Dimension(250, 300));
setSize(new Dimension(250, 323));
setResizable(false);
setTitle("Malicious Code Scanner Options");
getContentPane().setLayout(null);
@ -38,11 +38,11 @@ public class MaliciousCodeScannerOptions extends JFrame {
final JCheckBox chckbxJavanet = new JCheckBox("java/net");
chckbxJavanet.setSelected(true);
chckbxJavanet.setBounds(6, 59, 232, 23);
chckbxJavanet.setBounds(6, 81, 232, 23);
getContentPane().add(chckbxJavanet);
final JCheckBox chckbxJavaio = new JCheckBox("java/io");
chckbxJavaio.setBounds(6, 85, 232, 23);
chckbxJavaio.setBounds(6, 104, 232, 23);
getContentPane().add(chckbxJavaio);
final JCheckBox chckbxJavalangruntime = new JCheckBox(
@ -54,48 +54,57 @@ public class MaliciousCodeScannerOptions extends JFrame {
final JCheckBox chckbxLdcContainswww = new JCheckBox(
"LDC contains 'www.'");
chckbxLdcContainswww.setSelected(true);
chckbxLdcContainswww.setBounds(6, 111, 232, 23);
chckbxLdcContainswww.setBounds(6, 130, 232, 23);
getContentPane().add(chckbxLdcContainswww);
final JCheckBox chckbxLdcContainshttp = new JCheckBox(
"LDC contains 'http://'");
chckbxLdcContainshttp.setSelected(true);
chckbxLdcContainshttp.setBounds(6, 137, 232, 23);
chckbxLdcContainshttp.setBounds(6, 156, 232, 23);
getContentPane().add(chckbxLdcContainshttp);
final JCheckBox chckbxLdcContainshttps = new JCheckBox(
"LDC contains 'https://'");
chckbxLdcContainshttps.setSelected(true);
chckbxLdcContainshttps.setBounds(6, 163, 232, 23);
chckbxLdcContainshttps.setBounds(6, 182, 232, 23);
getContentPane().add(chckbxLdcContainshttps);
final JCheckBox chckbxLdcMatchesIp = new JCheckBox(
"LDC matches IP regex");
chckbxLdcMatchesIp.setSelected(true);
chckbxLdcMatchesIp.setBounds(6, 189, 232, 23);
chckbxLdcMatchesIp.setBounds(6, 208, 232, 23);
getContentPane().add(chckbxLdcMatchesIp);
final JCheckBox chckbxNullSecMan = new JCheckBox(
"SecurityManager set to null");
chckbxNullSecMan.setSelected(true);
chckbxNullSecMan.setBounds(6, 215, 232, 23);
chckbxNullSecMan.setBounds(6, 234, 232, 23);
getContentPane().add(chckbxNullSecMan);
final JCheckBox chckbxJavaawtrobot = new JCheckBox("java/awt/Robot");
chckbxJavaawtrobot.setSelected(true);
chckbxJavaawtrobot.setBounds(6, 59, 232, 23);
getContentPane().add(chckbxJavaawtrobot);
JButton btnNewButton = new JButton("Start Scanning");
btnNewButton.addActionListener(new ActionListener() {
public void actionPerformed(ActionEvent arg0) {
PluginManager.runPlugin(new MaliciousCodeScanner(
chckbxJavalangreflection.isSelected(),
chckbxJavalangruntime.isSelected(), chckbxJavanet
.isSelected(), chckbxJavaio.isSelected(),
chckbxJavalangruntime.isSelected(),
chckbxJavanet.isSelected(),
chckbxJavaio.isSelected(),
chckbxLdcContainswww.isSelected(),
chckbxLdcContainshttp.isSelected(),
chckbxLdcContainshttps.isSelected(), chckbxLdcMatchesIp
.isSelected(), chckbxNullSecMan.isSelected()));
chckbxLdcContainshttps.isSelected(),
chckbxLdcMatchesIp.isSelected(),
chckbxNullSecMan.isSelected(),
chckbxJavaawtrobot.isSelected()));
dispose();
}
});
btnNewButton.setBounds(6, 245, 232, 23);
btnNewButton.setBounds(6, 264, 232, 23);
getContentPane().add(btnNewButton);
this.setLocationRelativeTo(null);
}

15
src/the/bytecode/club/bytecodeviewer/plugins/MaliciousCodeScanner.java
View file

@ -28,11 +28,11 @@ import the.bytecode.club.bytecodeviewer.api.PluginConsole;
public class MaliciousCodeScanner extends Plugin {
public boolean ORE, ONE, ORU, OIO, LWW, LHT, LHS, LIP, NSM;
public boolean ORE, ONE, ORU, OIO, LWW, LHT, LHS, LIP, NSM, ROB;
public MaliciousCodeScanner(boolean reflect, boolean runtime, boolean net,
boolean io, boolean www, boolean http, boolean https, boolean ip,
boolean nullSecMan) {
boolean nullSecMan, boolean robot) {
ORE = reflect;
ONE = net;
ORU = runtime;
@ -42,6 +42,7 @@ public class MaliciousCodeScanner extends Plugin {
LHS = https;
LIP = ip;
NSM = nullSecMan;
ROB = robot;
}
@Override
@ -59,6 +60,8 @@ public class MaliciousCodeScanner extends Plugin {
|| (LHS && s.contains("https://"))
|| (ORE && s.contains("java/lang/Runtime"))
|| (ORE && s.contains("java.lang.Runtime"))
|| (ROB && s.contains("java.awt.Robot"))
|| (ROB && s.contains("java/awt/Robot"))
|| (LIP && s
.matches("\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b")))
sb.append("Found LDC \"" + s + "\" at field "
@ -73,6 +76,8 @@ public class MaliciousCodeScanner extends Plugin {
|| (LHS && s.contains("https://"))
|| (ORE && s.contains("java/lang/Runtime"))
|| (ORE && s.contains("java.lang.Runtime"))
|| (ROB && s.contains("java.awt.Robot"))
|| (ROB && s.contains("java/awt/Robot"))
|| (LIP && s
.matches("\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b")))
sb.append("Found LDC \"" + s + "\" at field "
@ -93,8 +98,8 @@ public class MaliciousCodeScanner extends Plugin {
final MethodInsnNode min = (MethodInsnNode) a;
if ((ORE && min.owner.startsWith("java/lang/reflect"))
|| (ONE && min.owner.startsWith("java/net"))
|| (ORU && min.owner
.equals("java/lang/Runtime"))
|| (ORU && min.owner.equals("java/lang/Runtime"))
|| (ROB && min.owner.equals("java/awt/Robot"))
|| (OIO && min.owner.startsWith("java/io"))) {
sb.append("Found Method call to " + min.owner + "."
+ min.name + "(" + min.desc + ") at "
@ -110,6 +115,8 @@ public class MaliciousCodeScanner extends Plugin {
|| (LHS && s.contains("https://"))
|| (ORE && s.contains("java/lang/Runtime"))
|| (ORE && s.contains("java.lang.Runtime"))
|| (ROB && s.contains("java.awt.Robot"))
|| (ROB && s.contains("java/awt/Robot"))
|| (LIP && s
.matches("\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b"))) {
sb.append("Found LDC \"" + s + "\" at method "