103 lines
4.4 KiB
Python
103 lines
4.4 KiB
Python
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
from tools.static_passport_chain_report import RELATIVE_FILES, analyze_static_chain
|
|
|
|
|
|
def _write_fixture(root: Path, name: str, body: str) -> None:
|
|
path = root / RELATIVE_FILES[name]
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
path.write_text(body, encoding="utf-8")
|
|
|
|
|
|
class StaticPassportChainReportTests(unittest.TestCase):
|
|
def test_analyze_static_chain_extracts_proven_edges_and_gap(self):
|
|
with tempfile.TemporaryDirectory() as td:
|
|
root = Path(td)
|
|
_write_fixture(
|
|
root,
|
|
"weaponhi",
|
|
"""
|
|
.method public static b(Ljava/lang/String;)Ljava/lang/String;
|
|
invoke-static {p0}, Lcom/kuaishou/weapon/ks/i0;->a([B)[B
|
|
const-string v1, "privacykit"
|
|
const-string v2, "7e46b28a-8c93-4940-8238-4c60e64e3c81"
|
|
invoke-interface {v0, v1, v2, v3, p0}, Lcom/middleware/security/wrapper/IKSecurityBase;->atlasEncrypt(Ljava/lang/String;Ljava/lang/String;I[B)[B
|
|
invoke-static {p0, v0}, Lcom/kuaishou/weapon/ks/q;->c([BI)Ljava/lang/String;
|
|
.end method
|
|
.method public static dd(I)Ljava/lang/String;
|
|
const-string v0, "VIMG_"
|
|
invoke-static {p0}, Lcom/kuaishou/weapon/ks/z0;->a(Landroid/content/Context;)Lcom/kuaishou/weapon/ks/z0;
|
|
const-string v0, "a_y_q_z"
|
|
invoke-virtual {p0, v0, v1}, Lcom/kuaishou/weapon/ks/z0;->a(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;
|
|
.end method
|
|
""",
|
|
)
|
|
_write_fixture(root, "gzip", "new-instance v0, Ljava/util/zip/GZIPOutputStream;\n")
|
|
_write_fixture(
|
|
root,
|
|
"z0",
|
|
"""
|
|
.method public constructor <init>(Landroid/content/Context;)V
|
|
const-string v0, "wcfg"
|
|
invoke-virtual {p1, v0, v1}, Landroid/content/Context;->getSharedPreferences(Ljava/lang/String;I)Landroid/content/SharedPreferences;
|
|
.end method
|
|
.method public a(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;
|
|
invoke-interface {v0, p1, p2}, Landroid/content/SharedPreferences;->getString(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;
|
|
.end method
|
|
.method public a(ZLjava/lang/String;Ljava/lang/String;)V
|
|
invoke-interface {v0, p2, p3}, Landroid/content/SharedPreferences$Editor;->putString(Ljava/lang/String;Ljava/lang/String;)Landroid/content/SharedPreferences$Editor;
|
|
.end method
|
|
""",
|
|
)
|
|
_write_fixture(
|
|
root,
|
|
"x0",
|
|
'.field public static b:Ljava/lang/String; = "L3Jlc3QvaW5mcmEvZ2RmcC9tL2s="\n'
|
|
'.field public static c:Ljava/lang/String; = "L3Jlc3QvaW5mcmEvZ2RmcC9hL3E="\n'
|
|
'.field public static d:Ljava/lang/String; = "L2YvYS9w"\n',
|
|
)
|
|
_write_fixture(
|
|
root,
|
|
"r1",
|
|
"""
|
|
invoke-static {p0}, Lcom/kuaishou/weapon/i/WeaponHI;->b(Ljava/lang/String;)Ljava/lang/String;
|
|
const-string v4, "VIMG_"
|
|
const-string v5, "data"
|
|
invoke-static {p1, p0}, Lcom/kuaishou/weapon/ks/i;->a(Landroid/content/Context;Lcom/kuaishou/weapon/ks/k1;)Ljava/lang/String;
|
|
""",
|
|
)
|
|
_write_fixture(root, "i", "invoke-interface {p0}, Lokhttp3/Call;->execute()Lokhttp3/Response;\n")
|
|
_write_fixture(root, "y0", 'const-string v2, "POST"\n')
|
|
_write_fixture(
|
|
root,
|
|
"zvl_c",
|
|
"""
|
|
const-string v2, "ugAccoutNetAddRiskParam"
|
|
invoke-static {v0}, Lcom/kuaishou/weapon/i/WeaponHI;->dd(I)Ljava/lang/String;
|
|
const-string v1, "passport_account_image"
|
|
invoke-interface {p1, v1, v0}, Ljava/util/Map;->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;
|
|
""",
|
|
)
|
|
|
|
result = analyze_static_chain(root)
|
|
|
|
self.assertTrue(result["proven"]["weaponhi_b_upload_encrypt"])
|
|
self.assertTrue(result["proven"]["weaponhi_dd21_reads_a_y_q_z"])
|
|
self.assertTrue(result["proven"]["z0_uses_wcfg"])
|
|
self.assertTrue(result["proven"]["passport_map_injection"])
|
|
self.assertTrue(result["proven"]["fap_upload_endpoint"])
|
|
self.assertFalse(result["proven"]["direct_local_a_y_q_z_writer"])
|
|
self.assertEqual(result["facts"]["fap_upload"]["decoded_endpoint"], "/f/a/p")
|
|
self.assertEqual(
|
|
result["pure_calc_status"]["final_passport_ticket"],
|
|
"server_or_wcfg_state",
|
|
)
|
|
self.assertFalse(result["pure_calc_status"]["final_ticket_offline_proven"])
|
|
self.assertTrue(result["unresolved"])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|