DEV IN PROGRESS

Module pychrysalide.format.dex

Documentation

This module provides several features to deal with the Dalvik Executable (DEX) format.

The layout of such a format is described at: https://source.android.com/devices/tech/dalvik/dex-format

Classes

Class DexClass

The DexClass object handles a class defined in a DEX file.

Hierarchy

builtins.object
 ╰── gi._gi.GObject
      ╰── pychrysalide.format.dex.DexClass

Attributes

data

Native data of the Dex class, if any.

definition

Native definition of the Dex class.

direct_methods

of direct methods of the Dex class, None if none and None on error.

interfaces

Interface Android types of the Dex class, None if none and None on error.

source_file

Source file of the Dex class, None on error.

static_fields

of static fields of the Dex class, None if none and None on error.

super

Android type of the parent Dex class, None on error.

type

Android type of the Dex class, None on error.

virtual_methods

of virtual methods of the Dex class, None if none and None on error.

Class DexField

The DexField object handles a field linked to a DEX class.

Hierarchy

builtins.object
 ╰── gi._gi.GObject
      ╰── pychrysalide.format.dex.DexField

Attributes

encoded

Encoded information about the Dex field.

variable

Chrysalide variable for the Dex field.

Class DexFormat

DexFormat deals with DEX format.

Instances can be created using the following constructor:

    DexFormat(content)

Where content is a BinContent object.

Hierarchy

builtins.object
 ╰── gi._gi.GObject
      ╰── pychrysalide.format.KnownFormat
           ╰── pychrysalide.format.BinFormat
                ╰── pychrysalide.format.ExeFormat
                     ╰── pychrysalide.format.dex.DexFormat

Implements: pychrysalide.analysis.storage.SerializableObject

Methods

read_type_list(self, offset)

Provide the raw data of a given type list as an array of StructObject instances.

All the items are fields extracted from the Dex type_list structure:

  • type_idx: index into the type_ids list.

In case of error, the function returns None.

Attributes

pool

Resource pool of the Dex format.

Constants

AccessFlags

Accessibility and overall properties of classes and class members.

1= 0x1
2= 0x2
4= 0x4
8= 0x8
16= 0x10
32= 0x20
64= 0x40
128= 0x80
256= 0x100
512= 0x200
1024= 0x400
2048= 0x800
4096= 0x1000
8192= 0x2000
16384= 0x4000
65536= 0x10000
131072= 0x20000

Class DexMethod

The DexMethod handles a method defined in a DEX format.

Hierarchy

builtins.object
 ╰── gi._gi.GObject
      ╰── pychrysalide.format.dex.DexMethod

Attributes

code_item

StructObject instance of code information about the Dex method, or None if none.

All the fields are extracted from the Dex code_item structure:

  • registers_size: the number of registers used by the code ;
  • ins_size: number of words of incoming arguments to the method that the code is for ;
  • outs_size: number of words of outgoing argument space required for invocation ;
  • tries_size: number of try_items for the instance ;
  • debug_info_off: offset from the start of the file to the debug info sequence for this code, or 0 no such information ;
  • insns_size: size of the instructions list, in 16-bit code units.

encoded

StructObject instance for encoded information about the Dex method.

All the fields are extracted from the Dex encoded_method structure:

  • method_idx_diff: index into the method_ids list for the identity of the method ;
  • access_flags: access flags for the method ;
  • code_off: offset from the start of the file to the code structure for the method.

id_item

StructObject instance of identifiers used by the method.

All the fields are extracted from the Dex method_id_item structure:

  • class_idx: index into the type_ids list for the definer of the method ;
  • proto_idx: index into the proto_ids list for the prototype of the method ;
  • name_idx: index into the string_ids list for the name of the method.

routine

DEX method as seen from Chrysalide.

The result is a BinRoutine instance or None.

Class DexPool

DexPool is the class collecting all resources of a Dex format.

The pool is populated when the format gets analyzed.

Hierarchy

builtins.object
 ╰── gi._gi.GObject
      ╰── pychrysalide.format.dex.DexPool

Methods

get_raw_class(self, index)

Provide the raw data of a given class in the Dex pool as a StructObject instance.

Indexes start at 0.

All the fields are extracted from the Dex class_def_item structure:

  • class_idx: index into the type_ids list for this class ;
  • access_flags: access flags for the class (public, final, etc.) ;
  • superclass_idx: index into the type_ids list for the superclass, or the constant value NO_INDEX if the class has no superclass ;
  • interfaces_off: offset from the start of the file to the list of interfaces, or 0 if there are none ;
  • source_file_idx: index into the string_ids list for the name of the file containing the original source for (at least most of) this class, or the special value NO_INDEX to represent a lack of this information ;
  • annotations_off: offset from the start of the file to the annotations structure, or 0 if there are no annotation ;
  • class_data_off: offset from the start of the file to the associated class data, or 0 if there is no class data ;
  • static_values_off: offset from the start of the file to the list of initial values for static fields, or 0 if there are none.

In case of error, the function returns None.

get_raw_field(self, index)

Provide the raw data of a given field in the Dex pool as a StructObject instance.

Indexes start at 0.

All the fields are extracted from the Dex field_id_item structure:

  • class_idx: index into the type_ids list for the definer of the field ;
  • type_idx: index into the type_ids list for the type of the field ;
  • name_idx: index into the string_ids list for the name of the field.

In case of error, the function returns None.

get_raw_method(self, index)

Provide the raw data of a given method in the Dex pool as a StructObject instance.

Indexes start at 0.

All the fields are extracted from the Dex method_id_item structure:

  • class_idx: index into the type_ids list for the definer of the method ;
  • proto_idx: index into the proto_ids list for the prototype of the method ;
  • name_idx: index into the string_ids list for the name of the method.

In case of error, the function returns None.

get_raw_prototype(self, index)

Provide the raw data of a given prototype in the Dex pool as a StructObject instance.

Indexes start at 0.

All the fields are extracted from the Dex proto_id_item structure:

  • shorty_idx: index into the string_ids list for the short-form descriptor string ;
  • return_type_idx: index into the type_ids list for the return type ;
  • parameters_off: offset from the start of the Dex file to the list of parameter types.

In case of error, the function returns None.

get_raw_type(self, index)

Provide the raw data of a given type in the Dex pool as a StructObject instance.

Indexes start at 0.

All the fields are extracted from the Dex type_id_item structure:

  • descriptor_idx: index into the string_ids list for the descriptor string.

In case of error, the function returns None.

Attributes

classes

Classes inside the Dex pool.

These objects are the Chrysalide version of all class_def_item structures stored in the Dex format header.

fields

Fields inside the Dex pool.

These objects are the Chrysalide version of all field_id_item structures stored in the Dex format header.

methods

Methods inside the Dex pool.

These objects are the Chrysalide version of all method_id_item structures stored in the Dex format header.

prototypes

Prototypes inside the Dex pool.

These objects are the Chrysalide version of all proto_id_item structures stored in the Dex format header.

strings

Strings inside the Dex pool.

These objects are the Chrysalide version of all string_id_item structures stored in the Dex format header.

types

Types inside the Dex pool.

These objects are the Chrysalide version of all type_id_item structures stored in the Dex format header.

Class DexRoutine

The DexRoutine is a definition of binary routine for DEX methods.

The only reason for such an object to exist is to provide a link to a DexMethod from a BinRoutine.

The object can be compared using rich methods (like <= or !=) and produce an "informal" string representation of itself with a call to str().

Hierarchy

builtins.object
 ╰── gi._gi.GObject
      ╰── pychrysalide.format.BinSymbol
           ╰── pychrysalide.analysis.BinRoutine
                ╰── pychrysalide.format.dex.DexRoutine

Implements:

Attributes

method

Dex method attached to the Dex routine.

The result is a DexMethod instance or None.