{"id":19938096,"url":"https://github.com/dweinstein/pscout","last_synced_at":"2025-10-13T05:04:19.453Z","repository":{"id":5362562,"uuid":"6549021","full_name":"dweinstein/pscout","owner":"dweinstein","description":"Mirror of PScout (http://pscout.csl.toronto.edu/).","archived":false,"fork":false,"pushed_at":"2014-08-25T22:07:08.000Z","size":6683,"stargazers_count":23,"open_issues_count":2,"forks_count":12,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-05-03T14:40:41.440Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Perl","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dweinstein.png","metadata":{"files":{"readme":"README","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2012-11-05T18:00:41.000Z","updated_at":"2021-09-28T04:39:31.000Z","dependencies_parsed_at":"2022-07-06T05:31:48.739Z","dependency_job_id":null,"html_url":"https://github.com/dweinstein/pscout","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/dweinstein/pscout","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dweinstein%2Fpscout","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dweinstein%2Fpscout/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dweinstein%2Fpscout/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dweinstein%2Fpscout/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dweinstein","download_url":"https://codeload.github.com/dweinstein/pscout/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dweinstein%2Fpscout/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279013694,"owners_count":26085390,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-13T02:00:06.723Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T23:38:21.474Z","updated_at":"2025-10-13T05:04:19.432Z","avatar_url":"https://github.com/dweinstein.png","language":"Perl","funding_links":[],"categories":[],"sub_categories":[],"readme":"------------------------------------------------------------\nPreparation\n------------------------------------------------------------\ntar -xvzf PScout.tar.gz in \u003cPScout_DIR\u003e\nsource bin/setup_env\n\nInstall XML::Simple (if not installed already)\nsudo perl -MCPAN -e shell\ninstall XML::Simple\n\nPScout directory contents:\n\u003cPScout_DIR\u003e/bin - various scripts used in the analysis\n\u003cPScout_DIR\u003e/soot - soot analysis programs of java class files\n\n\u003cPScout_DIR\u003e/results\n- \u003candroid_version\u003e_allmappings: API calls (both documented and undocumented) to permission mapping\n- \u003candroid_version\u003e_publishedapimapping: documented API calls to permission mapping\n- \u003candroid_version\u003e_intentpermissions: intents with permission\n- \u003candroid_version\u003e_contentproviderpermission: content provider (URI string \"content://\") with permission\n- \u003candroid_version\u003e_contentproviderfieldpermission: content provider (URI field) with permission\n\n------------------------------------------------------------\nHow to Run PScout:\n------------------------------------------------------------\nmkdir \u003cANDROID_CLASS_DIR\u003e\t\t# create new directory under \u003cPScout_DIR\u003e\ncd \u003cANDROID_CLASS_DIR\u003e\n../bin/setupanalysis.sh \u003cANDROID_DIR\u003e\t# \u003cANDROID_DIR\u003e is the root directory of the Android source code (should be already complied with lunch full-eng)\n\t\t\t\t\t# performs steps 1-3 described in the following \"Detailed Analysis Steps Section\"\ntestsetup\t\t\t\t# step 4 (a few seconds)\n../bin/dumpclass.sh\t\t\t# step 5 (~half a day)\n../bin/postprocess_1.sh \t\t# steps 6-11 (a few minutes)\n../bin/intentpermissioncheck.sh\t\t# step 12 (~half a day)\n../bin/postprocess_2.sh\t\t\t# step 12-16 (a few minutes)\n\n------------------------------------------------------------\nDetailed Analysis Step Descriptions\n------------------------------------------------------------\n1: Get the relevant class files from the android build \u003cANDROID_DIR\u003e root directory\n\nPut all classes in a new directory \u003cANDROID_CLASS_DIR\u003e under \u003cPScout_DIR\u003e\n../bin/getclasses.pl \u003cANDROID_DIR\u003e\n../bin/extractjar.sh\nrm -f *.jar\n\nCreate a list of class name\n../bin/createclasslist.sh under \u003cANDROID_CLASS_DIR\u003e\n\n----------\n2: Parse all AndroidManifest.xml files (in ANDROID_DIR) for permission information\n\nUnder \u003cANDROID_DIR\u003e run the following:\nfind -name AndroidManifest.xml \u003e manifestlist\n\u003cPScout_DIR\u003e/bin/parseandroidmanifest.pl \u003e manifestpermission\n\ngrep ^contents:// manifestpermission | grep -v grantUriPermissions | sort -u \u003e contentproviderpermission\nsed -i 's/^contents/content/' contentproviderpermission\nmv contentproviderpermission \u003cANDROID_CLASS_DIR\u003e\n\ngrep ^PROVIDER: manifestpermission | sort -u \u003e providerauth\nmv providerauth \u003cANDROID_CLASS_DIR\u003e\n\ngrep ^Intent: manifestpermission | sort -u \u003e intentpermission\nsed -i 's/^Intent://' intentpermission\nmv intentpermission \u003cANDROID_CLASS_DIR\u003e\n\nNote: At this point, unless otherwise specified, all commands in future steps should be executed under \u003cANDROID_CLASS_DIR\u003e\n\n----------\n3: Generate list of permissions to be analyzed by PScout\n\nCreate list of permissions available to 3rd party applications\n../bin/parsepermission.pl \u003cANDROID_DIR\u003e/frameworks/base/core/res/AndroidManifest.xml \u003e permissions\n\nOutput files:\n- permissions\n\n----------\n4: Testing setup\n\nrunsoot dump.DumpClass com.android.internal.telephony.gsm.GSMPhone under \u003cANDROID_CLASS_DIR\u003e\n\nIf you see Exception in thread \"main\" java.lang.RuntimeException: couldn't find class: com.android.internal.telephony.gsm.GSMPhone$1 (is your soot-class-path set properly?) do the following:\n../bin/compileemptyclass.pl com.android.internal.telephony.gsm.GSMPhone\\$1\n\nIf setting is correct, there should be no errors.\n\n----------\n5: SOOT dump class information (this step should take ~day to finish)\n\n../bin/dumpclass.sh\n\nOutput files:i\n- classhierarchy\n- rawcallgraph\n- permissionstringusage\n- message\n- handlemessageswitch\n- rpcmethod\n- clearrestoreuid\n- urifield\n\nNote:\n- modify the classlist file to change the list of class files to be processed (useful if computer died(?) in the middle of an analysis)\n- the file 'processed' stores the list of classes examined so far\n- run 'wc processed' to get an idea on the progress (# of lines = # classes processed)\n\n----------\n6: Build basic call graph\n\n../bin/buildcallgraph.pl | sort -u \u003e callgraph\n\nOutput files:\n- callgraph\n\n----------\n7: Create message sending edges\n../bin/analyzemessages.pl \u003e sendmessagecallgraphedges\n\nOutput files\n- sendmessagecallgraphedges\n\n----------\n8: AIDL RPC\n../bin/createrpcedge.pl \u003e aidlcallgraphedges\n../bin/removerpcedge.pl \u003e callgraphnorpc\n\n----------\n9: String permission checks\n../bin/analyzepermissionusage.pl \u003e pchk\n../bin/formatpermissioncheck.pl\n\nOutput files:\n- stringpermissioncheck\n- sendreceivepermissioncheck\n\n----------\n10: Uri permission checks\n../bin/analyzeurifield.pl \u003e contentprovidercheck\n\nOutputfiles:\n- contentprovidercheck\n- contentproviderfieldpermission\n\n----------\n11: SOOT Intents with \"dynamic\" send/receive permission\n../bin/intentwithpermission.sh\n../bin/analyzeintent.pl \u003e intentwithdynamicpermission\ncat intentpermission intentwithdynamicpermission \u003e intentpermissions\n\nOutputfiles:\n- intentwithdynamicpermission\n- intentpermissions\n\n----------\n12: SOOT Intent permission check (~day)\n../bin/intentpermissioncheck.sh\n../bin/analyzeintentcheck.pl \u003e intentpermissioncheck\n\nOutputfiles:\n- intentpermissioncheck\n\n----------\n13: API mapping\n\ncp \u003cANDROID_DIR\u003e/frameworks/base/api/current.xml \u003cANDROID_CLASS_DIR\u003e\nNote: when analyzing android 4.0, copy current.txt instead\n\n../bin/broadcaststickycheck.pl \u003e broadcaststickycheck\n../bin/apimapping.pl \u003e API\n\nOutput files:\n- permissionreachedprovider\n\n----------\n14: New content permission requirement found from first apimapping.pl pass\n\n../bin/analyzereachedprovider.pl \u003e reachedcontentproviderpermission\n../bin/analyzeurifield.pl \u003e contentproviderdynamiccheck\n\n----------\n15: Second (final) API mapping\n\n../bin/apimapping.pl \u003e API\ngrep -e ^Permission -e Callers: -e ^\\\u003c API \u003e allmappings\n\nOutput files:\n- allmappings\n- publishedapimapping\n\n----------\n16: Generate some basic stats\n\n../bin/generatestats.pl \u003e stats\n\nOutput files:\n- stats\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdweinstein%2Fpscout","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdweinstein%2Fpscout","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdweinstein%2Fpscout/lists"}