Skip to content

Commit

Permalink
Merge pull request #93 from mikusjelly/master
Browse files Browse the repository at this point in the history
feat: 🎸 Support Android Dex, Dey file
  • Loading branch information
h2non authored Nov 30, 2020
2 parents 27da4bf + a1337e2 commit f60988a
Show file tree
Hide file tree
Showing 5 changed files with 27 additions and 0 deletions.
2 changes: 2 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -270,6 +270,8 @@ func main() {
#### Application

- **wasm** - `application/wasm`
- **dex** - `application/vnd.android.dex`
- **dey** - `application/vnd.android.dey`

## Benchmarks

Expand Down
Binary file added fixtures/sample.dex
Binary file not shown.
Binary file added fixtures/sample.dey
Binary file not shown.
2 changes: 2 additions & 0 deletions match_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,8 @@ func TestMatchFile(t *testing.T) {
{"mov"},
{"wasm"},
{"dwg"},
{"dex"},
{"dey"},
}

for _, test := range cases {
Expand Down
23 changes: 23 additions & 0 deletions matchers/application.go
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,14 @@ package matchers

var (
TypeWasm = newType("wasm", "application/wasm")
TypeDex = newType("dex", "application/vnd.android.dex")
TypeDey = newType("dey", "application/vnd.android.dey")
)

var Application = Map{
TypeWasm: Wasm,
TypeDex: Dex,
TypeDey: Dey,
}

// Wasm detects a Web Assembly 1.0 filetype.
Expand All @@ -18,3 +22,22 @@ func Wasm(buf []byte) bool {
buf[4] == 0x01 && buf[5] == 0x00 &&
buf[6] == 0x00 && buf[7] == 0x00
}

// Dex detects dalvik executable(DEX)
func Dex(buf []byte) bool {
// https://source.android.com/devices/tech/dalvik/dex-format#dex-file-magic
return len(buf) > 36 &&
// magic
buf[0] == 0x64 && buf[1] == 0x65 && buf[2] == 0x78 && buf[3] == 0x0A &&
// file sise
buf[36] == 0x70
}

// Dey Optimized Dalvik Executable(ODEX)
func Dey(buf []byte) bool {
return len(buf) > 100 &&
// dey magic
buf[0] == 0x64 && buf[1] == 0x65 && buf[2] == 0x79 && buf[3] == 0x0A &&
// dex
Dex(buf[40:100])
}

0 comments on commit f60988a

Please sign in to comment.