ev-flow / ev-flow/quark-engine

Improve Quark's tainted analysis accuracy in stage 5

Open
#131 0 comments 0 reactions 0 assignees View on GitHub
enhancement issue-processing-state-01
Dominant language
Python
Stars
1.7k
Forks
218
Avg merge
4d 12h
Merged PRs (30d)
7

Description

Currently, Quark uses our own Dalvik bytecode loader. Basically, it simulates the operation of the Real Android Dalvik virtual machine, but we only record the usage status of each register. So far, not all the instructions for Dalvik have been completely written. As a result, false positives often occur in the analysis.

The implementation of the Dalvik bytecode loader could be find [here](https://github.com/quark-engine/quark-engine/blob/master/quark/Evaluator/pyeval.py)

Dalvik instructions reference:
https://source.android.google.cn/devices/tech/dalvik/instruction-formats?hl=en

More details can be found in our DEFCON's presentation:
https://youtu.be/XK-yqHPnsvc?t=473

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.