ev-flow / ev-flow/quark-engine

Behavior not detected when the data flow propagates through member fields

Open
#830 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
1.7k
Forks
218
Avg merge
4d 12h
Merged PRs (30d)
7

Description

**Describe the bug**

A behavior is not detected by Quark for an APK (SHA256: `2aeef8181f0babf1756cd4d415920241ca51bdd9bd9e1dfc3b2a587b2ca6d53b`), although the behavior exists in the decompiled code. The summary report is attached below.

Image

The Quark rule used for detecting this behavior:

```json
{
"crime": "Create a window and add a view to it",
"permission": [],
"api": [
{
"descriptor": "()V",
"class": "Landroid/view/WindowManager$LayoutParams;",
"method": ""
},
{
"descriptor": "(Landroid/view/View; Landroid/view/ViewGroup$LayoutParams;)V",
"class": "Landroid/view/WindowManager",
"method": "addView"
}
],
"score": 2.11,
"label": []
}
```

In the `ir.indoria.fiktir.FxService` class, the result of `Landroid/view/WindowManager$LayoutParams;->()V` is stored in a member field (``this.wmParams``) instead of a register. Consequently, Quark fails to track the data flow between the two API calls, resulting in the behavior not being detected.

Image

**To Reproduce**

Steps to reproduce the behavior:

1. Download the APK and the Quark rule
2. Run `quark -a -s `
3. Check the summary report

**Expected behavior**

Quark should detect the behavior with 100% confidence.

**Possible Solution**
Implement a mechanism for tracking data flow through member fields.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.