FriendlyNeighborhoodShane
4 years ago
parent
23799f1a6f
commit
7f49166984
@ -1,200 +0,0 @@
|
||||
createwhitelist() {
|
||||
|
||||
ui_print " ";
|
||||
ui_print "Creating priv-app whitelist...";
|
||||
|
||||
spoofperm=android.permission.FAKE_PACKAGE_SIGNATURE;
|
||||
spoofpermod=61006e00640072006f00690064002e007000650072006d0069007300730069006f006e002e00460041004b0045005f005000410043004b004100470045005f005300490047004e00410054005500520045;
|
||||
hasspoof=false;
|
||||
syslist="$filedir/privlist/privperm.list";
|
||||
applist="$filedir/privlist/app.lst";
|
||||
permlist="$filedir/privlist/app.xml";
|
||||
|
||||
unzip -oq "$zipfile" "privlist/*" -d "$filedir";
|
||||
|
||||
case "$arch" in
|
||||
arm*)
|
||||
aapt="$filedir/privlist/aapt-arm";
|
||||
;;
|
||||
x86*)
|
||||
aapt="$filedir/privlist/aapt-x86";
|
||||
;;
|
||||
mips*)
|
||||
aapt="$filedir/privlist/aapt-mips";
|
||||
;;
|
||||
esac;
|
||||
[ -f "$aapt" ] || abort "No AAPT available";
|
||||
chmod 777 "$aapt";
|
||||
|
||||
"$aapt" dump xmltree "/$sysroot/system/framework/framework-res.apk" AndroidManifest.xml | \
|
||||
tr -d '\n' | sed -e 's/E:/\n/g' | grep '(type 0x11)0x[137]2' | \
|
||||
awk -F\" '{print $2}' | sort > "$syslist";
|
||||
|
||||
unzip -oq "/$sysroot/system/framework/framework-res.apk" "AndroidManifest.xml" -d "$filedir/privlist/";
|
||||
|
||||
grep -qF "$spoofperm" "$filedir/privlist/AndroidManifest.xml" && hasspoof=true;
|
||||
od -A n -t x1 "$filedir/privlist/AndroidManifest.xml" | tr -d ' \n' | grep -qF "$spoofpermod" && hasspoof=true;
|
||||
|
||||
if $hasspoof; then echo "android.permission.FAKE_PACKAGE_SIGNATURE" >> "${syslist}"; else log "WHITELISTER: No native sigspoof found"; fi;
|
||||
|
||||
buildlist() {
|
||||
|
||||
"${aapt}" dump permissions "$privobject" | \
|
||||
awk -F \' '/^uses-permission:/{print $2}' | \
|
||||
sort > "$applist";
|
||||
|
||||
[ "$(cat "$applist")" ] || return 1;
|
||||
|
||||
echo '<?xml version="1.0" encoding="utf-8"?>
|
||||
<permissions>
|
||||
<privapp-permissions package="'$package'">' > "$permlist";
|
||||
|
||||
for perm in $(cat "$applist"); do
|
||||
if grep -q "$perm" "$syslist"; then
|
||||
log "WHITELISTER: $package needs privapp-whitelist $perm";
|
||||
echo ' <permission name="'$perm'" />' >> "$permlist";
|
||||
fi;
|
||||
done;
|
||||
|
||||
echo ' </privapp-permissions>
|
||||
</permissions>' >> "$permlist";
|
||||
|
||||
}
|
||||
|
||||
unzip -oq "$zipfile" "system/priv-app/*" -d "$filedir";
|
||||
|
||||
for object in $stuff; do
|
||||
case $object in
|
||||
/system/priv-app/*/*.apk) ;;
|
||||
*) continue;;
|
||||
esac;
|
||||
for realobject in $filedir/$object; do
|
||||
privobject="$realobject"; break;
|
||||
done;
|
||||
[ -f "$privobject" ] || { log "ERROR: $privobject vanished"; continue; }
|
||||
package="$("$aapt" dump badging "$privobject" | awk -F \' '/^package: name/{print $2}')";
|
||||
log "WHITELISTER: Building list for $object";
|
||||
buildlist || continue;
|
||||
mkdir -p "$filedir/system/etc/permissions/";
|
||||
mv -f "$permlist" "$filedir/system/etc/permissions/$package.xml";
|
||||
stuff="$stuff
|
||||
/system/etc/permissions/$package.xml
|
||||
";
|
||||
done;
|
||||
|
||||
for object in $stuff_arch; do
|
||||
case $object in
|
||||
/system/priv-app/*/*.apk) ;;
|
||||
*) continue;;
|
||||
esac;
|
||||
for realobject in "$filedir/$(dirname "$object")"/*-"$arch"-*/"$(basename "$object")"; do
|
||||
privobject="$realobject"; break;
|
||||
done;
|
||||
[ -f "$privobject" ] || { log "ERROR: $privobject vanished"; continue; }
|
||||
package="$("$aapt" dump badging "$privobject" | awk -F \' '/^package: name/{print $2}')";
|
||||
log "WHITELISTER: Building list for $object ($cond)";
|
||||
cond="$(basename "$(dirname "$privobject")")";
|
||||
buildlist;
|
||||
mkdir -p "$filedir/system/etc/permissions/$cond/";
|
||||
mv -f "$permlist" "$filedir/system/etc/permissions/$cond/$package.xml";
|
||||
stuff_arch="$stuff_arch
|
||||
/system/etc/permissions/$package.xml
|
||||
";
|
||||
done;
|
||||
|
||||
for object in $stuff_sdk; do
|
||||
case $object in
|
||||
/system/priv-app/*/*.apk) ;;
|
||||
*) continue;;
|
||||
esac;
|
||||
for realobject in "$filedir/$(dirname "$object")"/*-"$sdk"-*/"$(basename "$object")"; do
|
||||
privobject="$realobject"; break;
|
||||
done;
|
||||
[ -f "$privobject" ] || { log "ERROR: $privobject vanished"; continue; }
|
||||
package="$("$aapt" dump badging "$privobject" | awk -F \' '/^package: name/{print $2}')";
|
||||
cond="$(basename "$(dirname "$privobject")")";
|
||||
log "WHITELISTER: Building list for $object ($cond)";
|
||||
buildlist;
|
||||
mkdir -p "$filedir/system/etc/permissions/$cond/";
|
||||
mv -f "$permlist" "$filedir/system/etc/permissions/$cond/$package.xml";
|
||||
stuff_sdk="$stuff_sdk
|
||||
/system/etc/permissions/$package.xml
|
||||
";
|
||||
done;
|
||||
|
||||
for object in $stuff_arch_sdk; do
|
||||
case $object in
|
||||
/system/priv-app/*/*.apk) ;;
|
||||
*) continue;;
|
||||
esac;
|
||||
for realobject in "$filedir/$(dirname "$object")"/*-"$arch"-*-"$sdk"-*/"$(basename "$object")"; do
|
||||
privobject="$realobject"; break;
|
||||
done;
|
||||
[ -f "$privobject" ] || { log "ERROR: $privobject vanished"; continue; }
|
||||
package="$("$aapt" dump badging "$privobject" | awk -F \' '/^package: name/{print $2}')";
|
||||
cond="$(basename "$(dirname "$privobject")")";
|
||||
log "WHITELISTER: Building list for $object ($cond)";
|
||||
buildlist;
|
||||
mkdir -p "$filedir/system/etc/permissions/$cond/";
|
||||
mv -f "$permlist" "$filedir/system/etc/permissions/$cond/$package.xml";
|
||||
stuff_arch_sdk="$stuff_arch_sdk
|
||||
/system/etc/permissions/$package.xml
|
||||
";
|
||||
done;
|
||||
|
||||
}
|
||||
|
||||
getwhitelist() {
|
||||
|
||||
echo " ";
|
||||
echo " - Getting priv-app permissions...";
|
||||
|
||||
privpermlist="util/privperms.lst";
|
||||
privpermurl="https://developer.android.com/reference/android/Manifest.permission";
|
||||
|
||||
wget -q --show-progress "$privpermurl" -O "$tmpdir/tmppage" || { echo "ERROR: Android permission docpage failed to download" >&2; return 1; }
|
||||
|
||||
lines="$(grep -En "<!-- [=]* [A-Z ]* [=]* -->" "$tmpdir/tmppage" | grep -A1 "ENUM CONSTANTS DETAIL" | sed "s|:| |g" | awk '{ print $1 }')";
|
||||
for line in $lines; do
|
||||
[ "$startline" ] && endline="$line" || startline="$line";
|
||||
done;
|
||||
cat "$tmpdir/tmppage" | tail -n+"$(($startline + 1))" | head -n"$(($endline - $startline - 1))" | tr -d "\n" | sed "s|<div data|\n|g" | grep "Not for use by third-party applications" | grep -oE "android.permission.[A-Z_]*" > "$tmpdir/tmplist";
|
||||
echo "android.permission.FAKE_PACKAGE_SIGNATURE" >> "$tmpdir/tmplist";
|
||||
|
||||
cat "$resdldir/$privpermlist" "$tmpdir/tmplist" | sort -u > "$tmpdir/sortedlist";
|
||||
mv -f "$tmpdir/sortedlist" "$resdldir/$privpermlist";
|
||||
|
||||
}
|
||||
|
||||
checkwhitelist() {
|
||||
|
||||
echo " ";
|
||||
echo " - Checking priv-app permissions...";
|
||||
|
||||
aapt="util/aapt";
|
||||
privpermlist="util/privperms.lst";
|
||||
|
||||
[ -f "$resdldir/$privpermlist" ] || { echo "ERROR: No privileged permission list to check" >&2; return 1; }
|
||||
[ -f "$resdldir/$aapt" ] || { echo "ERROR: No aapt found" >&2; return 1; }
|
||||
|
||||
privlogfile="$(ls -t $reldir/update-*.log | head)";
|
||||
for privappfile in $(cat "$reldir/$privlogfile" | grep -Po "FILE: [^,]*" | cut -d" " -f2 | grep -o "/system/priv-app/.*/.*.apk"); do
|
||||
[ -f "$privappfile" ] || { echo "ERROR: Privapp $privappfile not found" >&2; continue; }
|
||||
privperms="";
|
||||
privapppackage="$("$resdldir/$aapt" dump badging "$privappfile" | grep -o "package: name=[^ ]*" | sed "s|'| |g" | awk '{ print $3 }')"
|
||||
privappperms="$("$resdldir/$aapt" dump permissions "$privappfile" | grep -o "uses-permission: name=[^ ]*" | sed "s|'| |g" | awk '{ print $3 }' | sort -u)";
|
||||
for privperm in in $privappperms; do
|
||||
grep -q "$privperm" "$resdldir/$privpermlist" || continue;
|
||||
grep -q "$privperm" "$resdir/system/etc/permissions/$privapppackage.xml" && continue;
|
||||
privperms="$privperm $privperms";
|
||||
done;
|
||||
[ "$privperms" ] || continue;
|
||||
echo " ";
|
||||
echo " -- File: $privappfile";
|
||||
echo " -- Package: $privapppackage";
|
||||
for permentry in $privperms; do
|
||||
echo " ++ Needs whitelisting perm $permentry";
|
||||
done;
|
||||
done;
|
||||
|
||||
}
|
||||
Loading…
Reference in new issue