ev-flow / ev-flow/quark-engine
Improve Quark's tainted analysis accuracy in stage 5
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 218
- Avg merge
- 4d 12h
- Merged PRs (30d)
- 7
Description
Currently, Quark uses our own Dalvik bytecode loader. Basically, it simulates the operation of the Real Android Dalvik virtual machine, but we only record the usage status of each register. So far, not all the instructions for Dalvik have been completely written. As a result, false positives often occur in the analysis.
The implementation of the Dalvik bytecode loader could be find [here](https://github.com/quark-engine/quark-engine/blob/master/quark/Evaluator/pyeval.py)
Dalvik instructions reference:
https://source.android.google.cn/devices/tech/dalvik/instruction-formats?hl=en
More details can be found in our DEFCON's presentation:
https://youtu.be/XK-yqHPnsvc?t=473
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.