Module pychrysalide.format.dex
Class DexClass
Class DexField
Class DexFormat
Class DexMethod
Class DexPool
Class DexRoutine
Module pychrysalide.format.dex
Documentation
This module provides several features to deal with the Dalvik Executable (DEX) format.
The layout of such a format is described at: https://source.android.com/devices/tech/dalvik/dex-format
Classes
Class DexClass
The DexClass object handles a class defined in a DEX file.
Hierarchy
builtins.object ╰── gi._gi.GObject ╰── pychrysalide.format.dex.DexClass
Attributes
data
Native data of the Dex class, if any.
definition
Native definition of the Dex class.
direct_methods
of direct methods of the Dex class, None if none and None on error.
interfaces
Interface Android types of the Dex class, None if none and None on error.
source_file
Source file of the Dex class, None on error.
static_fields
of static fields of the Dex class, None if none and None on error.
super
Android type of the parent Dex class, None on error.
type
Android type of the Dex class, None on error.
virtual_methods
of virtual methods of the Dex class, None if none and None on error.
Class DexField
The DexField object handles a field linked to a DEX class.
Hierarchy
builtins.object ╰── gi._gi.GObject ╰── pychrysalide.format.dex.DexField
Attributes
encoded
Encoded information about the Dex field.
variable
Chrysalide variable for the Dex field.
Class DexFormat
DexFormat deals with DEX format.
Instances can be created using the following constructor:
DexFormat(content)
Where content is a BinContent
object.
Hierarchy
builtins.object ╰── gi._gi.GObject ╰── pychrysalide.format.KnownFormat ╰── pychrysalide.format.BinFormat ╰── pychrysalide.format.ExeFormat ╰── pychrysalide.format.dex.DexFormat
Implements: pychrysalide.analysis.storage.SerializableObject
Methods
read_type_list(self, offset)
Provide the raw data of a given type list as an array of StructObject
instances.
All the items are fields extracted from the Dex type_list
structure:
- type_idx: index into the
type_ids
list.
In case of error, the function returns None.
Attributes
pool
Resource pool of the Dex format.
Constants
AccessFlags
Accessibility and overall properties of classes and class members.
1 | = 0x1 |
2 | = 0x2 |
4 | = 0x4 |
8 | = 0x8 |
16 | = 0x10 |
32 | = 0x20 |
64 | = 0x40 |
128 | = 0x80 |
256 | = 0x100 |
512 | = 0x200 |
1024 | = 0x400 |
2048 | = 0x800 |
4096 | = 0x1000 |
8192 | = 0x2000 |
16384 | = 0x4000 |
65536 | = 0x10000 |
131072 | = 0x20000 |
Class DexMethod
The DexMethod handles a method defined in a DEX format.
Hierarchy
builtins.object ╰── gi._gi.GObject ╰── pychrysalide.format.dex.DexMethod
Attributes
code_item
StructObject
instance of code information about the Dex method, or None if none.
All the fields are extracted from the Dex code_item
structure:
- registers_size: the number of registers used by the code ;
- ins_size: number of words of incoming arguments to the method that the code is for ;
- outs_size: number of words of outgoing argument space required for invocation ;
- tries_size: number of
try_items
for the instance ; - debug_info_off: offset from the start of the file to the debug info sequence for this code, or 0 no such information ;
- insns_size: size of the instructions list, in 16-bit code units.
encoded
StructObject
instance for encoded information about the Dex method.
All the fields are extracted from the Dex encoded_method
structure:
- method_idx_diff: index into the
method_ids
list for the identity of the method ; - access_flags: access flags for the method ;
- code_off: offset from the start of the file to the code structure for the method.
id_item
StructObject
instance of identifiers used by the method.
All the fields are extracted from the Dex method_id_item
structure:
- class_idx: index into the
type_ids
list for the definer of the method ; - proto_idx: index into the
proto_ids
list for the prototype of the method ; - name_idx: index into the
string_ids
list for the name of the method.
routine
DEX method as seen from Chrysalide.
The result is a BinRoutine
instance or None.
Class DexPool
DexPool is the class collecting all resources of a Dex format.
The pool is populated when the format gets analyzed.
Hierarchy
builtins.object ╰── gi._gi.GObject ╰── pychrysalide.format.dex.DexPool
Methods
get_raw_class(self, index)
Provide the raw data of a given class in the Dex pool as a StructObject
instance.
Indexes start at 0.
All the fields are extracted from the Dex class_def_item
structure:
- class_idx: index into the type_ids list for this class ;
- access_flags: access flags for the class (public, final, etc.) ;
- superclass_idx: index into the type_ids list for the superclass, or the constant value NO_INDEX if the class has no superclass ;
- interfaces_off: offset from the start of the file to the list of interfaces, or 0 if there are none ;
- source_file_idx: index into the string_ids list for the name of the file containing the original source for (at least most of) this class, or the special value NO_INDEX to represent a lack of this information ;
- annotations_off: offset from the start of the file to the annotations structure, or 0 if there are no annotation ;
- class_data_off: offset from the start of the file to the associated class data, or 0 if there is no class data ;
- static_values_off: offset from the start of the file to the list of initial values for static fields, or 0 if there are none.
In case of error, the function returns None.
get_raw_field(self, index)
Provide the raw data of a given field in the Dex pool as a StructObject
instance.
Indexes start at 0.
All the fields are extracted from the Dex field_id_item
structure:
- class_idx: index into the type_ids list for the definer of the field ;
- type_idx: index into the type_ids list for the type of the field ;
- name_idx: index into the string_ids list for the name of the field.
In case of error, the function returns None.
get_raw_method(self, index)
Provide the raw data of a given method in the Dex pool as a StructObject
instance.
Indexes start at 0.
All the fields are extracted from the Dex method_id_item
structure:
- class_idx: index into the type_ids list for the definer of the method ;
- proto_idx: index into the proto_ids list for the prototype of the method ;
- name_idx: index into the string_ids list for the name of the method.
In case of error, the function returns None.
get_raw_prototype(self, index)
Provide the raw data of a given prototype in the Dex pool as a StructObject
instance.
Indexes start at 0.
All the fields are extracted from the Dex proto_id_item
structure:
- shorty_idx: index into the
string_ids
list for the short-form descriptor string ; - return_type_idx: index into the
type_ids
list for the return type ; - parameters_off: offset from the start of the Dex file to the list of parameter types.
In case of error, the function returns None.
get_raw_type(self, index)
Provide the raw data of a given type in the Dex pool as a StructObject
instance.
Indexes start at 0.
All the fields are extracted from the Dex type_id_item
structure:
- descriptor_idx: index into the string_ids list for the descriptor string.
In case of error, the function returns None.
Attributes
classes
Classes inside the Dex pool.
These objects are the Chrysalide version of all class_def_item
structures stored in the Dex format header.
fields
Fields inside the Dex pool.
These objects are the Chrysalide version of all field_id_item
structures stored in the Dex format header.
methods
Methods inside the Dex pool.
These objects are the Chrysalide version of all method_id_item
structures stored in the Dex format header.
prototypes
Prototypes inside the Dex pool.
These objects are the Chrysalide version of all proto_id_item
structures stored in the Dex format header.
strings
Strings inside the Dex pool.
These objects are the Chrysalide version of all string_id_item
structures stored in the Dex format header.
types
Types inside the Dex pool.
These objects are the Chrysalide version of all type_id_item
structures stored in the Dex format header.
Class DexRoutine
The DexRoutine is a definition of binary routine for DEX methods.
The only reason for such an object to exist is to provide a link to a DexMethod
from a BinRoutine
.
The object can be compared using rich methods (like <=
or !=
) and produce an "informal" string representation of itself with a call to str()
.
Hierarchy
builtins.object ╰── gi._gi.GObject ╰── pychrysalide.format.BinSymbol ╰── pychrysalide.analysis.BinRoutine ╰── pychrysalide.format.dex.DexRoutine
Implements:
Attributes
method
Dex method attached to the Dex routine.
The result is a DexMethod
instance or None.