Thomas,

We are getting "Index out of range errors" on some APKs. Unfortunately, I am not permitted to send the APKs to you for debugging. However, we can send you the output after running the APKs through androwarn. Is it possible to update androwarn to provide more debugging information, particularly with "index out of range" errors? Here is the output from the latest APK with this error:

Traceback (most recent call last): File "/home/test/androwarn/androwarn.py", line 116, in main(options, arguments) File "/home/test/androwarn/androwarn.py", line 99, in main data = perform_analysis(APK_FILE, a, d, x, no_connection) File "/home/test/androwarn/androwarn/analysis/analysis.py", line 120, in perform_analysis ( 'suspicious_connection_establishment', gather_suspicious_connection_establishment(x) ), File "/home/test/androwarn/androwarn/search/malicious_behaviours/remote_connection.py", line 68, in gather_suspicious_connection_establishment result.extend( detect_Socket_use(x) ) File "/home/test/androwarn/androwarn/search/malicious_behaviours/remote_connection.py", line 52, in detect_Socket_use remote_port = get_register_value(2, registers) File "/home/test/androwarn/androwarn/core/core.py", line 426, in get_register_value dict = registers[index] IndexError: list index out of range

We are also getting "IndexError: list index out of range" errors but I cannot send the app for this. We have also seen a "ValueError: invalid literal for int() with base 10: 'android.intent.action.PACKAGE_ADDED 11'" error but cannot find the app that generated this error.

When using androwarn to analyze an approximately 23MB Xamarin application, I received an IndexError on line 426 of core.py. The full traceback is below:

Traceback (most recent call last):
  File "androwarn.py", line 116, in <module>
    main(options, arguments)
  File "androwarn.py", line 99, in main
    data = perform_analysis(APK_FILE, a, d, x, no_connection)
  File ".../androwarn/analysis/analysis.py", line 120, in perform_analysis
    ( 'suspicious_connection_establishment',	 gather_suspicious_connection_establishment(x) ),
  File ".../androwarn/search/malicious_behaviours/remote_connection.py", line 68, in gather_suspicious_connection_establishment
    result.extend( detect_Socket_use(x) )
  File ".../androwarn/search/malicious_behaviours/remote_connection.py", line 52, in detect_Socket_use
    remote_port		= get_register_value(2, registers)
  File ".../androwarn/core/core.py", line 426, in get_register_value
    dict = registers[index]
IndexError: list index out of range

We were able to work around this temporarily by wrapping the offending block in a try/except and returning ERROR_VALUE_NOT_FOUND.

Can you please share us the structure of the code that is written for androwarn. I am trying to find malicous apk file but I am unable to run them with this tools. Hoping to hear soon from you.

I got an error using Androwarn on the following Android app:

https://play.google.com/store/apps/details?id=com.vaytek.crossfireremote

Note that I am using Python 2.7.

Traceback (most recent call last): File "/data/androwarn/androwarn.py", line 116, in main(options, arguments) File "/data/androwarn/androwarn.py", line 95, in main a, d, x = AnalyzeAPK(APK_FILE) File "/data/androwarn/androwarn/analysis/analysis.py", line 48, in AnalyzeAPK a = APK(filename, raw) File "/data/androwarn/androguard/core/bytecodes/apk.py", line 163, in init self.xml[i] = minidom.parseString( AXMLPrinter( self.zip.read( i ) ).getBuff() ) File "/data/androwarn/androguard/core/bytecodes/apk.py", line 877, in init self.buff += "<%s%s\n" % ( self.getPrefix( self.axml.getPrefix() ), self.axml.getName() ) File "/data/androwarn/androguard/core/bytecodes/apk.py", line 749, in getName return self.sb.getRaw(self.m_name) File "/data/androwarn/androguard/core/bytecodes/apk.py", line 556, in getRaw data += unichr( self.getShort(self.m_strings, offset) ) File "/data/androwarn/androguard/core/bytecodes/apk.py", line 567, in getShort value = array[offset/4].get_value() IndexError: list index out of range

After installing the requirements. I start the program as explained in the Readme file. But I faced this error message :

Traceback (most recent call last):
  File "androwarn.py", line 30, in <module>
    from androguard.misc import AnalyzeAPK
ImportError: No module named androguard.misc

when I run the command line python androwarn.py -i 0a7f7.apk -r html -v 3,I get the following message

Traceback (most recent call last): File "androwarn.py", line 116, in main(options, arguments) File "androwarn.py", line 99, in main data = perform_analysis(APK_FILE, a, d, x, no_connection) File "/home/chenjun/androwarn/androwarn/analysis/analysis.py", line 94, in perform_analysis app_name, app_desc, app_icon = grab_application_name_description_icon(app_package_name, no_connection) File "/home/chenjun/androwarn/androwarn/search/application/application.py", line 67, in grab_application_name_description_icon response = urllib2.urlopen(req, timeout=REQUEST_TIMEOUT) File "/usr/lib/python2.7/urllib2.py", line 154, in urlopen return opener.open(url, data, timeout) File "/usr/lib/python2.7/urllib2.py", line 429, in open response = self._open(req, data) File "/usr/lib/python2.7/urllib2.py", line 447, in _open '_open', req) File "/usr/lib/python2.7/urllib2.py", line 407, in _call_chain result = func(*args) File "/usr/lib/python2.7/urllib2.py", line 1228, in http_open return self.do_open(httplib.HTTPConnection, req) File "/usr/lib/python2.7/urllib2.py", line 1198, in do_open raise URLError(err) urllib2.URLError: <urlopen error [Errno 101] Network is unreachable>

The running environment of my computer is ubuntu16.04 ,python2.7 and java1.7.How could I solve this problem? Thanks.

I just installed androwarn and try to scan apk fiile, but getting this error. Anyone know how to solve it?

Traceback (most recent call last): File "androwarn.py", line 116, in main(options, arguments) File "androwarn.py", line 95, in main a, d, x = AnalyzeAPK(APK_FILE) File "/root/androwarn/androwarn/analysis/analysis.py", line 48, in AnalyzeAPK a = APK(filename, raw) File "/root/androwarn/androguard/core/bytecodes/apk.py", line 163, in init self.xml[i] = minidom.parseString( AXMLPrinter( self.zip.read( i ) ).getBuff() ) File "/root/androwarn/androguard/core/bytecodes/apk.py", line 871, in init _type = self.axml.next() File "/root/androwarn/androguard/core/bytecodes/apk.py", line 622, in next self.doNext() File "/root/androwarn/androguard/core/bytecodes/apk.py", line 662, in doNext raise("ooo") TypeError: exceptions must be old-style classes or derived from BaseException, not str

I'm unable to run androwarn, do you know what is it connecting to?

The apk is copied from the SampleApplication directory

%> ./androwarn.py -v 1 -i mal.apk -r txt
Traceback (most recent call last):
  File "./androwarn.py", line 116, in <module>
    main(options, arguments)
  File "./androwarn.py", line 99, in main
    data = perform_analysis(APK_FILE, a, d, x, no_connection)
  File "/Users/xxxx/Library/Caches/shm/androwarn-master/androwarn/analysis/analysis.py", line 94, in perform_analysis
    app_name, app_desc, app_icon = grab_application_name_description_icon(app_package_name, no_connection)
  File "/Users/xxxx/Library/Caches/shm/androwarn-master/androwarn/search/application/application.py", line 67, in grab_application_name_description_icon
    response = urllib2.urlopen(req, timeout=REQUEST_TIMEOUT)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 154, in urlopen
    return opener.open(url, data, timeout)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 431, in open
    response = self._open(req, data)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 449, in _open
    '_open', req)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1227, in http_open
    return self.do_open(httplib.HTTPConnection, req)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1197, in do_open
    raise URLError(err)
urllib2.URLError: <urlopen error [Errno 65] No route to host>

I see today the Androwarn vulnerability categories include:

• Telephony identifiers exfiltration
• Device settings exfiltration
• Geolocation information leakage
• Connection interfaces information exfiltration
• Telephony services abuse
• Audio/video flow interception
• Remote connection establishment
• PIM data leakage
• External memory operations
• PIM data modification
• Arbitrary code execution
• Denial of Service

However, a few months ago I wrote down these categories:

• Telephony Identifiers Leakage
• Location Lookup
• Connection Interfaces Exfiltration
• Telephony Services Abuse
• Audio Video Eavesdropping
• Suspicious Connection Establishment
• Pim Data Leakage
• Code Execution

Have the categories changed?

[+] Androwarn version 1.6

[+] Loading the APK file... Requested API level 31 is larger than maximum we have, returning API level 28 instead. Traceback (most recent call last): File "/home/shan/.local/bin/androwarn", line 8, in sys.exit(main()) File "/home/shan/.local/lib/python3.8/site-packages/androwarn/androwarn.py", line 86, in main data = perform_analysis(options.input, a, d, x, options.with_playstore_lookup) File "/home/shan/.local/lib/python3.8/site-packages/androwarn/warn/analysis/analysis.py", line 65, in perform_analysis ( 'device_settings_harvesting', gather_device_settings_harvesting(x) ), File "/home/shan/.local/lib/python3.8/site-packages/androwarn/warn/search/malicious_behaviours/device_settings.py", line 102, in gather_device_settings_harvesting result.extend( detect_log(x) ) File "/home/shan/.local/lib/python3.8/site-packages/androwarn/warn/search/malicious_behaviours/device_settings.py", line 44, in detect_log for registers in data_flow_analysis(structural_analysis_results, x): File "/home/shan/.local/lib/python3.8/site-packages/androwarn/warn/core/core.py", line 412, in data_flow_analysis registers = backtrace_registers_before_call(x, parent_method, calling_offset) File "/home/shan/.local/lib/python3.8/site-packages/androwarn/warn/core/core.py", line 214, in backtrace_registers_before_call bc = method.get_code().get_bc() AttributeError: 'MethodAnalysis' object has no attribute 'get_code'

hello, I just need some information as i have install the androwarn but i am not sure that how i can use it on some application from google store or some application on my laptop? python3 androwarn.py -i ...... now what should i type after -i, i am confused can anyone help me out and make me understand this.

I got the following Androwarn "Suspicious Connection Establishment" finding:

"This application opens a Socket and connects it to the remote address ' returned no addresses for ; port is out of range' on the 'N/A' port".

Can you elaborate on 'returned no addresses for', 'port is out of range', and 'N/A' port? Also, is it possible to get the file and line number for this finding?

Thanks, Steve

hello, am new to python & don't know how to fix this issue...can anybody tell me how to solve it?

kali@kali:~/androwarn$ python androwarn.py -i SampleApplication.apk -r html -v 3 [+] Androwarn version 1.6

[+] Loading the APK file... Traceback (most recent call last): File "androwarn.py", line 96, in main() File "androwarn.py", line 82, in main a, d, x = AnalyzeAPK(options.input) File "/home/kali/.local/lib/python3.8/site-packages/androguard/misc.py", line 63, in AnalyzeAPK a = APK(_file, raw=raw) File "/home/kali/.local/lib/python3.8/site-packages/androguard/core/bytecodes/apk.py", line 274, in init self.__raw = bytearray(read(filename)) File "/home/kali/.local/lib/python3.8/site-packages/androguard/util.py", line 13, in read with open(filename, 'rb' if binary else 'r') as f: FileNotFoundError: [Errno 2] No such file or directory: 'SampleApplication.apk'

Some antivirus vendors seem to be flagging AndroWarn as a virus, see here: https://www.virustotal.com/gui/file/db851627421f19842feb04a62b8b2beac1b44173c0c4b94f35546cdbce229fba/detection

Hi,

I've run into an Androwarn bug on following app:

https://play.google.com/store/apps/details?id=com.aisense.otter

Traceback (most recent call last):
File "/data/androwarn_1.6/androwarn-master/androwarn.py", line 96, in <module>
main()
File "/data/androwarn_1.6/androwarn-master/androwarn.py", line 91, in main
dump_analysis_results(data,sys.stdout)
File "/data/androwarn_1.6/androwarn-master/warn/report/report.py", line 93, in dump_analysis_results
flush_simple_string(wrapper.fill(element), file_descriptor)
File "/data/androwarn_1.6/androwarn-master/warn/report/report.py", line 67, in flush_simple_string
file.write("%s\n" % string)
UnicodeEncodeError: 'ascii' codec can't encode character '\u02ce' in position 68: ordinal not in range(128)

Can this be fixed or possibly ignored in the code so the analysis can complete?

Thanks in advance!