ev-flow / ev-flow/quark-engine

Quark script implementation

Open
#324 31 comments 1 reaction 0 assignees View on GitHub
issue-processing-state-04
Dominant language
Python
Stars
1.7k
Forks
218
Avg merge
4d 12h
Merged PRs (30d)
7

Description

Hi @PaulNicolasHunter

@pulorsok , @haeter525 and I discuss the idea of #313 .
And we found out that the idea has high complexity and low practicality.

Therefore, we have a simple, concrete and practical idea for your GSoC 2022 proposal
which is to implement ```Quark Script```.

The idea emerged when we used Quark to actually analyze Android applications.
It is often that we are still confused when we get Quark's summary reports.

For example, we'd like to know whether particular behavior appears
in the third-party module that this application imported.
Or whether this behavior performs right exactly in the application the author coded.

Sometimes, we also want to know the relationships between the ```behaviors```.
For example, does X behavior trigger the Y behavior.
Or is X triggered by Z?

And many other information behind the behavior
we'd like to know during the application analysis.

So, the new idea in short, is to develop functions
retrieving the information behind the behavior.

Once the functions are implemented, we then can write some sort of ```Quark Scripts```
to quickly narrow down and explore the behaviors Quark detected.

For example:

```python
if isFound("001.json") and isNotThirdParty("001.json"):
print("001.json is the behavior we're looking for.")
```

This script helps us to quickly verified
if the behavior detected is not from the third party module.

```python
if isFound("001.json") and isFound("002.json"):
if hasMutualParentFunction("001.json", "002.json"):
print("001.json and 002.json performs under the same function.")
```

```python
if hasStrings("001.json", "hello world"):
print("The source code in behavior 001.json contains strings hello world.")
```

So, what do you think @PaulNicolasHunter ? 😄

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.