ev-flow / ev-flow/quark-engine
Quark script implementation
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 218
- Avg merge
- 4d 12h
- Merged PRs (30d)
- 7
Description
Hi @PaulNicolasHunter
@pulorsok , @haeter525 and I discuss the idea of #313 .
And we found out that the idea has high complexity and low practicality.
Therefore, we have a simple, concrete and practical idea for your GSoC 2022 proposal
which is to implement ```Quark Script```.
The idea emerged when we used Quark to actually analyze Android applications.
It is often that we are still confused when we get Quark's summary reports.
For example, we'd like to know whether particular behavior appears
in the third-party module that this application imported.
Or whether this behavior performs right exactly in the application the author coded.
Sometimes, we also want to know the relationships between the ```behaviors```.
For example, does X behavior trigger the Y behavior.
Or is X triggered by Z?
And many other information behind the behavior
we'd like to know during the application analysis.
So, the new idea in short, is to develop functions
retrieving the information behind the behavior.
Once the functions are implemented, we then can write some sort of ```Quark Scripts```
to quickly narrow down and explore the behaviors Quark detected.
For example:
```python
if isFound("001.json") and isNotThirdParty("001.json"):
print("001.json is the behavior we're looking for.")
```
This script helps us to quickly verified
if the behavior detected is not from the third party module.
```python
if isFound("001.json") and isFound("002.json"):
if hasMutualParentFunction("001.json", "002.json"):
print("001.json and 002.json performs under the same function.")
```
```python
if hasStrings("001.json", "hello world"):
print("The source code in behavior 001.json contains strings hello world.")
```
So, what do you think @PaulNicolasHunter ? 😄
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.