Project Url: quark-engine/quark-engine
Introduction: Android Malware (Analysis | Scoring) System
Innovative & Interactive
- The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or pentest the targets.
- Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers to interact with staged results and perform creative analysis with Quark Script.
Dynamic & Static Analysis
- In Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g. objection).
Re-Usable & Sharable
- Once the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges.
More APIs to come
- Quark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios.
- See API document here.
In this section, we will show how to detect CWE-798 with Quark Script.
Step 1: Environments Requirements
- Quark requires Python 3.8 or above.
Step 2: Install Quark Engine
- Install Quark Engine by running:
$ pip3 install -U quark-engine
Step 3: Prepare Quark Script, Detection Rule and the Sample File
- Get the CWE-798 Quark Script and the detection rule here.
- Get the sampe file (ovaa.apk) here.
- Put the script, detection rule, and sample file in the same directory.
- Edit accordingly to the file names:
SAMPLE_PATH = "ovaa.apk" RULE_PATH = "findSecretKeySpec.json" # Now you are ready to run the script!
Step 4: Run the script
$ python3 CWE-798.py # You should now see the detection result in the terminal. Found hard-coded AES key 49u5gh249gh24985ghf429gh4ch8f23f
- Check the document for more examples.
The Honeynet Project
Google Summer Of Code
Quark-Engine has been participating in the GSoC under the Honeynet Project!
Stay tuned for the upcoming GSoC! Join the Honeynet Slack chat for more info.
Core Values of Quark Engine Team
- We love battle fields. We embrace uncertainties. We challenge impossibles. We rethink everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others first.