JavaFuzz Android
Android JavaFuzz Version. In order to compile type:
gradle build
Instrument Android APK
In order to instrument it you need:
- smali
- zip/unzip
- aapt
Once you have obtained the javafuzz.jar you have to dex it:
dx --dex --output=afuz.dex build/libs/javafuzz-1.0.jar
Uncompress it to obtain the necessary java xml resources:
unzip build/libs/javafuzz-1.0.jar
Then uncompress the apk you need to instruments in the same directory:
unzip your.apk
Instrument the code:
baksmali classes.dex
baksmali afuz.dex
smali out
cp out.dex classes.dex
Then build the final instrumented apk:
aapt remove your.apk classes.dex
aapt add your.apk classes.dex
aapt add your.apk gnu/getopt/MessagesBundle*
Run The Fuzzer
Transfer the instrumented apk to the "device":
adb push your.apk /sdcard/
mkdir -p /data/local/tmp
ANDROID_DATA=/data/local/tmp /system/bin/dalvikvm -Xss256k -Xmx100m \
-Xbootclasspath:/system/framework/core.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar \
-classpath /sdcard/your.apk javafuzz.JavaFuzz -c class.to.Test -v -m
Manual
NAME
JavaFuzz - Java Class Fuzzer
SYNOPSIS
JavaFuzz.jar [-v] -c class [-e type] [-l StringLength]...
DESCRIPTION
JavaFuzz is a java classes fuzzer based on the the Java Reflection
API. The reflection API represents, or reflects, the classes, interfaces,
and objects in the current Java Virtual Machine. Using the reflection
API JavaFuzz can contruct and invoke any given class (or list of classes).
After getting the types that a class accepts will construct the classes using
large values.
OPTIONS
-v Verbose - Fully Print Exceptions. Very usuafull and you better use
that if you want to spot any weird exceptions.
-m Fuzz methods of a Class, Can take Long time to finish
-c Classname
Input is Class name e.g java.net.URL , you cannot use -f at the same
time.
-f Read Class names from a file. Classnames should be on in each line.
-s You can set the fuzzing String, for example http://www.example.com
if you dont want repeats, use it with -l1
-e You can set the type you want to overflow with the MAX_VALUE on top
for example if you want to pass twice the size of a double to a class
which is defined to accept only double you do "-e double"
Warning: If you do that with an integer it will overflow and
become -2.
Values can be : int, double, float, long, short.
-r Number of recursions until constructs the class [Default 20]
If needs more it will set type to null and consider it Infinite.
Usually when trying to construct types that dont get any arguments
it will be fine, if it will try to construct classes that their
types accept arguments and so on... JavaFuzz will keep constructing
types until it gets the asked types.
-k Set the value for int,float,long,short,double
e.g. -k int=100 or -k double=20000 or -k int=19,float=49 and so on.
-a Set size of used array when fuzzing [Default 800]
This option can be maximum Integer.MAX_VALUE
-l Set length of used Strings when fuzzing [Default 1024]
This option can be maximum Integer.MAX_VALUE
-o Find if a specific class requires a cosntant and brute-force
all possible possitions until the constant is in the correct
positiont. [This option will add further delays]
-i JavaFuzz will ignore the specified method(s) helpful when you found a bug
in a method but you want to dig deeper. (Seperate methods with commas)
e.g. for java.awt.Image you could use -i getGraphics,getScaledInstance
-n JavaFuzz will fuzz the specified method(s) only
e.g. for java.awt.Font you could use -n applySize,pDispose
NOTE: You cannot use -i at the same time
-u Fuzz only high or low values respectively e.g. Integer high is +MAX_VALUE
and low value is -MAX_VALUE (or MIN_VALUE) [-u low or -u high]
- p Enforce a Constant and bruteforce the position. Thetype can
be int,double,float,short,string e.g. -p double=1
-g Use it when you want to replace a class, for example it could be used to replace
abstract classes or interfaces -g org.replace.this=org.with.this
the auto replacement mode can be invoked using -g org.replace.this={A}
and for complete automation use -ga
EXAMPLES
java -jar JavaFuzz.jar -c java.lang.String -v
java -jar JavaFuzz.jar -f classes.txt -v -e int
java -jar JavaFuzz.jar -c java.net.URL -e int -s http://www.example.com
BUGS
Version <= 0.3
It cannot construct classes with types :
a) Multidimensional array that is not int,double,float,short,long,string
b) Array that is not int,double,float,short,long,string
FIXES/UPDATES
Version >= 0.7
Enforce a Constant and bruteforce the position. The type can be int,double,float,short,string
flag is -p
Version >= 0.6
You can filter in and out method(s) and you can supply multiple types with -k
Minor error handling fixes
Version >= 0.5
The bugs listed in <=0.3 are fixed. If you find the same problem let me know
AUTHOR
Emmanouel Kellinis <me at cipher dot org dot uk>
License
The code is under GPLv2 unless specified otherwise in the single files.