Switch Quark's default core library to the Shuriken-based one #729
Conversation
|
Hello @zinwang! Thanks for updating this PR. We checked the lines you've touched for PEP 8 issues, and found:
Comment last updated at 2025-01-26 18:40:06 UTC |
- Add a colon if the API class defined in a rule missed one
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #729 +/- ##
==========================================
- Coverage 80.68% 80.57% -0.11%
==========================================
Files 75 75
Lines 6253 6265 +12
==========================================
+ Hits 5045 5048 +3
- Misses 1208 1217 +9
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
sidra-asa
force-pushed
the
switch_to_shuriken_core
branch
6 times, most recently
from
e43b705 to
78639cd
Compare
sidra-asa
force-pushed
the
switch_to_shuriken_core
branch
from
78639cd to
d1aed28
Compare
sidra-asa
force-pushed
the
switch_to_shuriken_core
branch
from
d1aed28 to
67208a2
Compare
…into switch_to_shuriken_core
sidra-asa
force-pushed
the
switch_to_shuriken_core
branch
from
288fbc7 to
dd3765f
Compare
sidra-asa
force-pushed
the
switch_to_shuriken_core
branch
from
dd3765f to
f29454e
Compare
|
Modifications in README.md:
New Features Coming Soon to Quark Agent
We are currently focused on:
We are committed to providing an intuitive and user-friendly experience, enabling users to design detection workflows seamlessly through both textual and visual methods. Many features are still under development and fine-tuning, and we will roll them out step by step as they become ready. If you have any suggestions, please don’t hesitate to share them with us! To stay updated with the latest news, make sure to watch our GitHub repository and follow us on X (Twitter). Quark Agent - Your AI-powered Android APK AnalystWith Quark Agent, you can perform analyses using only natural language. It creates Quark Script code following your ideas and adjusts the code promptly as you provide feedback. Showcase:Here’s a demonstration of using Quark Agent to detect the CWE-798 vulnerability in the ovaa.apk file. Step 1: Environment Requirements
Step 2: Install Quark Agent
git clone https://github.com/quark-engine/quark-engine.git && cd quark-engine
pip install .[QuarkAgent]Step 3: Prepare the Detection Rule and the Sample File.
├── ...
├── quark
├── ...
├── agent # Put rule file and sample file here
├── ... You can download the rule file here and the sample file here. Step 4: Add your OpenAI API keyAdd your OpenAI API key in os.environ["OPENAI_API_KEY"] = 'your-api-key-here'Step 5: Run Quark Agent$ cd quark/agent
$ python3 quarkAgentWeb.py
# You can now chat with Quark Agent in your browser.
# The default URL is http://127.0.0.1:5000Open a browser and navigate to See more CWE detections using quark scripts and play them with Quark Agent ! AcknowledgmentsThe Honeynet Project Google Summer Of CodeQuark-Engine has been participating in the GSoC under the Honeynet Project!
Stay tuned for the upcoming GSoC! Join the Honeynet Slack chat for more info. Core Values of Quark Engine Team
|
|
Modifications in docs/source/install.rst: Installing Quark-EngineStep 1. Install Shuriken-Analyzer
Step 2. Install Quark-Engine
Step 3. Check if Quark-Engine is installed
To learn how to scan multiple samples in a directory, please have a look at Directory Scanning. |
|
Modifications in docs/source/integration.rst: IntegrationQuark Engine Integration In Just 2 Steps First Step: InstallationYou can install Quark-Engine by following the instructions. Second Step: Code Snippet As You GoHere we present the simplest way for quark API usage: from quark.report import Report
APK_PATH = "14d9f1a92dd984d6040cc41ed06e273e.apk"
RULE_PATH = "sendLocation_SMS.json"
report = Report()
'''
RULE_PATH can be a directory with multiple rules inside
EX: "rules/"
'''
report.analysis(APK_PATH, RULE_PATH)
json_report = report.get_report("json")
print(json_report)Then you get the json report. :D {
"md5": "14d9f1a92dd984d6040cc41ed06e273e",
"apk_filename": "14d9f1a92dd984d6040cc41ed06e273e.apk",
"size_bytes": 166917,
"threat_level": "High Risk",
"total_score": 4,
"crimes": [
{
"crime": "Send Location via SMS",
"score": 4,
"weight": 4.0,
"confidence": "100%",
"permissions": [
"android.permission.SEND_SMS",
"android.permission.ACCESS_COARSE_LOCATION",
"android.permission.ACCESS_FINE_LOCATION"
],
"native_api": [
{
"class": "Landroid/telephony/TelephonyManager;",
"method": "getCellLocation"
},
{
"class": "Landroid/telephony/SmsManager;",
"method": "sendTextMessage"
}
],
"combination": [
{
"class": "Landroid/telephony/TelephonyManager",
"method": "getCellLocation",
"descriptor": "()Landroid/telephony/CellLocation;"
},
{
"class": "Landroid/telephony/SmsManager",
"method": "sendTextMessage",
"descriptor": "(Ljava/lang/String; Ljava/lang/String; Ljava/lang/String; Landroid/app/PendingIntent; Landroid/app/PendingIntent;)V"
}
],
"sequence": [
{
"Lcom/google/progress/AndroidClientService; sendMessage ()V": {
"first": [
"invoke-virtual",
"v6",
"Lcom/google/progress/Locate;->getLocation()Ljava/lang/String;"
],
"first_hex": "6e 10 2f 02 06 00",
"second": [
"invoke-virtual",
"v4",
"v6",
"v7",
"Lcom/google/progress/SMSHelper;->sendSms(Ljava/lang/String; Ljava/lang/String;)I"
],
"second_hex": "6e 30 3e 02 64 07"
}
},
{
"Lcom/google/progress/AndroidClientService; doByte ([B)V": {
"first": [
"invoke-virtual/range",
"v35",
"Lcom/google/progress/Locate;->getLocation()Ljava/lang/String;"
],
"first_hex": "74 01 2f 02 23 00",
"second": [
"invoke-virtual",
"v0",
"v1",
"v2",
"Lcom/google/progress/SMSHelper;->sendSms(Ljava/lang/String; Ljava/lang/String;)I"
],
"second_hex": "6e 30 3e 02 10 02"
}
},
{
"Lcom/google/progress/AndroidClientService$2; run ()V": {
"first": [
"invoke-virtual",
"v5",
"Lcom/google/progress/Locate;->getLocation()Ljava/lang/String;"
],
"first_hex": "6e 10 2f 02 05 00",
"second": [
"invoke-virtual",
"v3",
"v0",
"v4",
"Lcom/google/progress/SMSHelper;->sendSms(Ljava/lang/String; Ljava/lang/String;)I"
],
"second_hex": "6e 30 3e 02 03 04"
}
}
],
"register": [
{
"Lcom/google/progress/AndroidClientService; sendMessage ()V": {
"first": [
"invoke-virtual",
"v6",
"Lcom/google/progress/Locate;->getLocation()Ljava/lang/String;"
],
"first_hex": "6e 10 2f 02 06 00",
"second": [
"invoke-virtual",
"v4",
"v6",
"v7",
"Lcom/google/progress/SMSHelper;->sendSms(Ljava/lang/String; Ljava/lang/String;)I"
],
"second_hex": "6e 30 3e 02 64 07"
}
},
{
"Lcom/google/progress/AndroidClientService$2; run ()V": {
"first": [
"invoke-virtual",
"v5",
"Lcom/google/progress/Locate;->getLocation()Ljava/lang/String;"
],
"first_hex": "6e 10 2f 02 05 00",
"second": [
"invoke-virtual",
"v3",
"v0",
"v4",
"Lcom/google/progress/SMSHelper;->sendSms(Ljava/lang/String; Ljava/lang/String;)I"
],
"second_hex": "6e 30 3e 02 03 04"
}
}
]
}
]
}Directory Scanning {#dir_scan}To scan the entire directory with quark, you can use a simple bash #!/bin/bash
for apkFile in *.apk; do
quark -a ${apkFile} -o ${apkFile%%.*}_output.json;
done;Alternatively, you can use the quark API as well. #!/usr/bin/env python
from glob import glob
from quark.report import Report
RULE_PATH = "./quark-rules/00001.json"
report = Report()
for file in glob('*.apk'):
report.analysis(file, RULE_PATH)
json_report = report.get_report("json")
print(json_report)RadiocontrastRadiocontrast is a Quark API that quickly generates Quark rules from a For example, we want to know the behavior of a method called from quark.radiocontrast import RadioContrast
# The target APK.
APK_PATH = "Ahmyth.apk"
# The method that you want to generate rules.
TARGET_METHOD = "Lahmyth/mine/king/ahmyth/CameraManager;->startUp(I)V"
# The output directory for generated rules.
GENERATED_RULE_DIR = "~/generated_rules"
radiocontrast = RadioContrast(
APK_PATH,
TARGET_METHOD,
GENERATED_RULE_DIR
)
radiocontrast.rule_generate() |
|
Modifications in docs/source/quark_agent.rst: Quark AgentIntroducing Quark's new member, Quark Agent, the AI assistant in the Quark Agent integrates with LangChain, using OpenAI's large language Below are showcases of using Quark Agent for vulnerability and malware Vulnerability AnalysisShowcase: Detecting CWE-798 with Quark AgentThis example uses Quark Agent to detect Quick Start
Decode the PromptsHere are two prompts, each for executing different analysis processes. Used Quark Script APIs/Tools that LLM used: Used Quark Script APIs/Tools that LLM used: The Showcase: Generating Quark Script with Quark AgentQuark Agent allows you to automate the creation of Quark Script code. Here's an example for generating a Quark Script to detect CWE-798. Demo VideoDecode the PromptsNow, let's instruct Quark Agent to detect CWE-798 and write the Quark Assign a role to the Agent To make Quark Agent's responses more precise and relevant to Instruct the detection process Instruct Quark Agent to detect CWE-798 using the following detection
Generate Quark Script Finally, ask Quark Agent to write and execute the Python code based on Here is the generated code: from quark.script import Rule, runQuarkAnalysis
# Load the rule
rule_path = 'constructCryptoGraphicKey.json'
rule_instance = Rule(rule_path)
# Define the sample path
sample_path = 'ovaa.apk'
# Run the Quark analysis
quark_result = runQuarkAnalysis(sample_path, rule_instance)
# Extract the behavior occurrence list
behavior_occur_list = quark_result.behaviorOccurList
# Iterate through each behavior and get parameter values
for behavior in behavior_occur_list:
param_values = behavior.getParamValues()
for param in param_values:
# Check if the parameter value is hardcoded
is_hardcoded = quark_result.isHardcoded(param)
if is_hardcoded:
print(f'Hardcoded value found: {param}')Here is the result. Hardcoded value found: 49u5gh249gh24985ghf429gh4ch8f23f
Hardcoded value found: AESWe added 2 tools,
Malware AnalysisShowcase: Generate Summary Report with Quark AgentThis example uses Quark Agent to analyze Quick Start
Decode the PromptsHere, we explain what happens after running Quark Agent. Preset Prompt To ensure the When Quark Agent starts, it will automatically pass the preset prompt to User Prompts Then, by passing the following prompt manually, we ask Quark Agent to Used Quark APIs/Tools that LLM used: To highlight the analysis result, we ask Quark Agent to colorize the Used Quark APIs/Tools that LLM used: All APIs above are treated as tools within LangChain, enabling them to
Showcase: Enhance Summary Report with Quark AgentQuark Agent can enhance the summary report by refining Quark's risk Here's an example that enhances the summary report of Demo VideoDecode the PromptsNow, let's explain what happens after running Quark Agent. Generate a summary report We ask Quark Agent to generate a summary report for Assign a role to the agent To make Quark Agent's responses more precise and relevant to malware Enhance the summary report Then, the agent is ready to enhance the summary report. We then ask it
Here is the summary report enhanced by Quark Agent. We added the tool
|
|
Modifications in docs/source/quark_script.rst: Quark ScriptEcosystem for Mobile Security ToolsInnovative & InteractiveThe goal of Quark Script aims to provide an innovative way for mobile Based on Quark, we integrate decent tools as Quark Script APIs and make Dynamic & Static AnalysisIn Quark script, we integrate not only static analysis tools (e.g. Quark Re-Usable & SharableOnce the user creates a Quark script for specific analysis scenario. The More APIs to comeQuark Script is now in a beta version. We'll keep releasing practical Quickstart| In this tutorial, we will learn how to install and run Quark Script Step 1: Environments Requirements
Step 2: Install Quark Engine
Step 3: Prepare Quark Script, Detection Rule and the Sample File
SAMPLE_PATH = "ovaa.apk"
RULE_PATH = "findSecretKeySpec.json"Now you are ready to run the script! Step 4: Run the scriptYou should now see the detection result in the terminal. Introduce of Quark Script APIsfindMethodInAPK(samplePath, targetMethod) |
zinwang
changed the title
4 participants
Refer to Issue #728 .