ev-flow / ev-flow/quark-engine

Change Quark's default core library to the Shuriken-based one

Open
#728 0 comments 1 reaction 1 assignee Assigned to @zinwang View on GitHub
enhancement
Dominant language
Python
Stars
1.7k
Forks
218
Avg merge
4d 12h
Merged PRs (30d)
7

Description

**Why**

PR #697 introduced a new core library based on [Shuriken-Analyzer](https://github.com/Shuriken-Group/Shuriken-Analyzer), alongside a comparison with the existing Androguard-based one.

The comparison shows that both core libraries produce **identical Quark reports** when tested with the built-in rules and samples from [apk-samples](https://github.com/quark-engine/apk-samples). Also, the information extracted by the new core library matches **99.84% on average** with that extracted by the Androguard-based one.

Based on those results, I propose changing Quark's default core library to the Shuriken-based one.

**How**

Change the default value of the CLI flag [`--core-library`](https://github.com/quark-engine/quark-engine/blob/918c9f42cfb147128c5e08d425868efde2362f2f/quark/cli.py#L132) to `shuriken`. However, to ensure all Quark features and the downstream tools remain functional, we should do the following checks before making this change.

- [ ] Ensure Quark passes the unit tests and the smoke tests on Linux, macOS, and Windows platforms.
- [ ] Ensure Quark Agent, Quark-Script, and Quark Report showcase work as expected.
- [ ] Ensure Quark is installable via Pip, Pipenv, Kali Package, and Docker Image.
- [ ] Ensure the integrations with IntelOwl, Jadx, MobSF, and Apklab work as expected.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.