Jamaal Speights - devblog

Symantec Quarantined VBN file decoder

2013-06-13T03:39:00.002-07:00

pyqextract.py will decode Symantec quarantined vbn files. Like many others I couldn't get qextract.exe to work so I wrote my own. This decoder removes the magic bytes Symantec adds to each file that is quarantined. The "magic bytes" break the IAT, data/code segments by offsetting everything in the executable.

Usage: $ python pyqextract.py 5BB7429F.VBN out.exe

Download pyqextract.py

Another Python for Android Project

2012-01-20T00:25:00.000-08:00

This project looks better than SL4A + Py4A. More to come.
http://python-for-android.readthedocs.org/en/latest/index.html

Running Volatility Memory Forensics Framework on your android phone!

2012-01-07T01:55:00.000-08:00

In this post i'll quickly show you how to build your own python egg distribution package for your Android phone and PY4A. Volatility will be our example distribution package we will use. You can use the steps below to build your own python egg files for other modules like Pycrypto for example.

Volatility = The best Memory Forensics Framework
Android with sl4a = Best mobile phone OS + Python!

Please read my past posts on getting python running on your android.

1) Get the android-ndk, uncompress it and setup exports like this:

ff@shoryuken:~$ wget http://dl.google.com/android/ndk/android-ndk-r7-linux-x86.tar.bz2

ff@shoryuken:~$ tar xjvf android-ndk-r7-linux-x86.tar.bz2

ff@shoryuken:~$ mkdir android-toolchain

ff@shoryuken:~$ export ANDROID_NDK=~/android-ndk-r7

ff@shoryuken:~$ export ANDROID_NDK_TOOLCHAIN_ROOT=~/android-toolchain

ff@shoryuken:~$ $ANDROID_NDK/build/tools/make-standalone-toolchain.sh --platform=android-14 --install-dir=$ANDROID_NDK_TOOLCHAIN_ROOT

Auto-config: --toolchain=arm-linux-androideabi-4.4.3

Copying prebuilt binaries...

Copying sysroot headers and libraries...

Copying libstdc++ headers and libraries...

Copying files to: /home/ff/android-toolchain

Cleaning up...

Done.

2) Grab the Standalone library for compiling modules from http://code.google.com/p/python-for-android/downloads/list in this case we're getting http://python-for-android.googlecode.com/files/python-lib_r16.zip

From your $HOME directory

--> ff@shoryuken:~$ wget http://python-for-android.googlecode.com/files/python-lib_r16.zip

Unzip python-lib_r16.zip

ff@shoryuken:~$ unzip python-lib_r16.zip

Archive: python-lib_r16.zip

inflating: setup.sh

inflating: python.sh

---------snip-------------------------------------

3) Make sure python-setuptools is installed and grab volatility and uncompress

ff@shoryuken:~$ sudo apt-get install python-setuptools

ff@shoryuken:~$ wget https://www.volatilesystems.com/volatility/2.0/volatility-2.0.tar.gz

ff@shoryuken:~$ tar zxvf volatility-2.0.tar.gz

volatility-2.0/

volatility-2.0/contrib/

volatility-2.0/contrib/plugins/

volatility-2.0/contrib/plugins/disablewarnings.py

volatility-2.0/contrib/plugins/example.py

volatility-2.0/contrib/plugins/verinfo.py

volatility-2.0/contrib/plugins/psdispscan.py

---------snip-------------------------------------

4) Building the volatility egg,...

Change into the volatility directory

ff@shoryuken:~$ cd volatility-2.0/
We need to update setup.py and setup.cfg. Add the following to the top of the setup.py file in the volatility-2.0 directory.

from py4a import patch_distutils
patch_distutils()

So the setup.py file should look like this....

ff@shoryuken:~/volatility-2.0$ cat setup.py | less

---------snip-------------------------------------

# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA

from py4a import patch_distutils #Add these 2 lines to the top of the setp.py file

patch_distutils()

try:

from setuptools import setup

except ImportError:

---------snip-------------------------------------

Edit your setup.cfg file to it looks like this:

ff@shoryuken:~/volatility-2.0$ cat setup.cfg

[egg_info]

tag_build =

tag_date = 0

tag_svn_revision = 0

[bdist_egg]

plat-name=linux-armv

Source the python-lib setup.sh file from the volatility and build the egg..
ff@shoryuken:~/volatility-2.0$ source ../python-lib/setup.sh

Build the egg file...

ff@shoryuken:~/volatility-2.0$ python2.6 setup.py bdist_egg

running bdist_egg

running egg_info

writing volatility.egg-info/PKG-INFO

writing top-level names to volatility.egg-info/top_level.txt

writing dependency_links to volatility.egg-info/dependency_links.txt

reading manifest file 'volatility.egg-info/SOURCES.txt'

reading manifest template 'MANIFEST.in'

---------snip-------------------------------------

In ~/volatility-2.0/dist you should see the file "volatility-2.0-py2.6.egg"
ff@shoryuken:~/volatility-2.0/dist$ ls

volatility-2.0-py2.6.egg

5) Running Volatility on your android phone

Push the egg to your phone. We place the file into the /sdcard/Download directory like so..

ff@shoryuken:~$ ~/android-sdks/platform-tools/adb push ~/volatility-2.0/dist/volatility-2.0-py2.6.egg /sdcard/Download

Open Python for Android on your phone and click Import Modules

Under the Import Module menu select volatility-2.0-py2.6.egg file.

You should get a message letting you know the module imported correctly.

Copy the main vol.py script to your phone

ff@shoryuken:~/volatility-2.0/dist$~/android-sdks/platform-tools/adb push ~/volatility-2.0/vol.py /sdcard/sl4a/scripts/

Save the following script into a file called runvol.py:

ff@shoryuken:~/volatility-2.0/dist$ cat runvol.py

import android

import os

import sys

droid = android.Android()

cmd = "vol.py -h"

#print os.path.realpath(os.path.dirname(sys.argv[0]))

os.system("/data/data/com.googlecode.pythonforandroid/files/python/bin/python /mnt/sdcard/sl4a/scripts/vol.py -f /mnt/sdcard/Download/xp.dmp pslist")

#os.system("/mnt/sdcard/sl4a/scripts/vol.py -h")

#print sys.executable

Dumping Memory with Qemu

In this example I've made an memory image from Windows XP running on Qemu using pmemsave from the Qemu monitor. I saved the memory image file to xp.dmp. The script will run pslist against the xp.dmp file. For more information on getting a memory image using QEMU read http://web.cs.du.edu/~mitchell/forensics/projects/memory/Setup.pdf

To help you out some in order to get the image size we take the windows XP memory image SIZE times (1024^2) = mem_size. So for example if we have a windows image running in qemu thats using 128megs of memory, from the Qemu Monitor we would type: (CTRL-ALT-2 to enter Qemus monitor, CTRL-ALT-1 to switch back to the OS)

(qemu) pmemsave 0 134217728 xp.dmp

How did we get the number 134217728? 128 * (1024^2) = 134217728

Above the command "pmemsave 0 134217728 xp.dmp" breaks down like this

-> pmemsave - the command to save memory

-> 0 is the first offset in memory to start from

-> 134217728 (basically 128M)

-> xp.dmp (output file)

Next we need to copy this memory image to your phone....

Coping the memory image to your phones Download directory

ff@shoryuken:~$ ~/android-sdks/platform-tools/adb push xp.dmp /sdcard/Download/xp.dmp

Copy the runvol.py script (above) to /sdcard/sl4a/scripts/

ff@shoryuken:~$ ~/android-sdks/platform-tools/adb push runvol.py /sdcard/sl4a/scripts/

Open sl4a and click runvol.py

When you click on runvol.py select the black terminal box to the left and you should be reward with something like this!

Ignore the Traceback error for now, however if you've gotten this far you've installed Volatility on your phone! We can update the script to run "volshell"

In the runvol.py script change:

os.system("/data/data/com.googlecode.pythonforandroid/files/python/bin/python /mnt/sdcard/sl4a/scripts/vol.py -f /mnt/sdcard/Download/xp.dmp pslist")

To..

os.system("/data/data/com.googlecode.pythonforandroid/files/python/bin/python /mnt/sdcard/sl4a/scripts/vol.py -f /mnt/sdcard/Download/xp.dmp volshell")

And repush the script to your phone

ff@shoryuken:~/android-sdks/platform-tools$ ./adb push runvol.py /sdcard/sl4a/scripts/
On your phone rerun the runvol.py script and type hh() and ps() for example like so

This post showed you how to build and import a python egg file for The Volatility Framework running on your android phone with python 4 android. Now you can do memory forensics from anywhere!

The Mobile Malware mini dump

2012-01-05T14:51:00.000-08:00

If you're researching malware on android this page is a wonderful resource for malware samples.

http://contagiominidump.blogspot.com/

App Inventor for Android

2012-01-03T13:38:00.001-08:00

I came across this on the way, it looks promising.

http://www.appinventorbeta.com/about/

How to increase the internal partition size an emulated android device

2012-01-01T16:57:00.000-08:00

By default the Android emulator will run only using a small amount of memory and you'll run out quick. Here's how to increase the memory size without recreating your emulation avd

-partition-size 512

Example Script

ff@shoryuken:~/android-sdks/tools$ more phoneup.sh

#Phone up script
#device A
sudo umount /home/ff/android-sdks/tools/a
sudo mount -o loop smsAC /home/ff/android-sdks/tools/a
./emulator -partition-size 512 -avd smsA -sdcard ./smsAC &
ff@shoryuken:~/android-sdks/tools$

QR Code Generator

2012-01-01T09:23:00.000-08:00

Use http://zxing.appspot.com/ to create your own 2D barcodes

Creating an Android Emulator Quickly

2011-12-31T13:04:00.000-08:00

Here's how to setup an Android Phone emulator, make sure the SDK + tools are installed (see my first post). You might have multiple Android SDK target versions to see which Android versions you have installed run the following:

ff@shoryuken:~/android-sdks/tools$ ./android list
Available Android targets:
----------
id: 1 or "android-7"
Name: Android 2.1
Type: Platform
API level: 7
Revision: 3
Skins: WQVGA400, WQVGA432, HVGA, WVGA800 (default), WVGA854, QVGA
ABIs : armeabi
----------
id: 2 or "android-14"
Name: Android 4.0
Type: Platform
API level: 14
Revision: 3
Skins: WQVGA400, WQVGA432, HVGA, WVGA800 (default), WXGA720, WSVGA, WVGA854, QVGA, WXGA800
ABIs : no ABIs.
----------
id: 3 or "android-15"
Name: Android 4.0.3
Type: Platform
API level: 15
Revision: 1
Skins: WQVGA400, WQVGA432, HVGA, WVGA800 (default), WXGA720, WSVGA, WVGA854, QVGA, WXGA800
ABIs : armeabi-v7a
----------
id: 4 or "Google Inc.:Google APIs:15"
Name: Google APIs
Type: Add-On
Vendor: Google Inc.
Revision: 1
Description: Android + Google APIs
Based on Android 4.0.3 (API level 15)
Libraries:
* com.google.android.media.effects (effects.jar)
Collection of video effects
* com.android.future.usb.accessory (usb.jar)
API for USB Accessories
* com.google.android.maps (maps.jar)
API for Google Maps
Skins: WVGA854, WQVGA400, WSVGA, WXGA720, HVGA, WQVGA432, QVGA, WVGA800 (default), WXGA800
ABIs : armeabi-v7a
Available Android Virtual Devices:
Name: galaxy
Path: /home/ff/.android/avd/galaxy.avd
Target: Android 4.0.3 (API level 15)
ABI: armeabi-v7a
Skin: WVGA800

In my case I would like to emulate id 4 ("id: 4 or "Google Inc.:Google APIs:15"
") so I would run the following command:

ff@shoryuken:~/android-sdks/tools$ ./android create avd -n phoneA -t 4
Created AVD 'phoneA' based on Google APIs (Google Inc.), ARM (armeabi-v7a) processor,
with the following hardware config:
hw.lcd.density=240
vm.heapSize=48
hw.ramSize=512

Now to run the emulator we type:
ff@shoryuken:~/android-sdks/tools$ ./emulator -avd phoneA &

We're done!

Getting the SDcard can be found here.
http://blog.jayway.com/2009/04/22/working-with-sd-cards-in-the-android-emulator/

The quick version is simply cd into the tools directory under the android sdk:

$ cd /home/ff/android-sdks/tools
$ ff@shoryuken:~/android-sdks/tools$./mksdcard 128M phoneAsdCard
$ ff@shoryuken:~/android-sdks/tools$ mkdir sdcardA
$ ff@shoryuken:~/android-sdks/tools$ sudo mount -o loop phoneAsdCard sdcardA/
$ ff@shoryuken:~/android-sdks/tools$ ./emulator -avd phoneA -sdcard ./phoneAsdCard

Reading Google Books offline in Ubuntu

2011-12-31T12:51:00.000-08:00

If you want to read your google ebooks, install the "Google Ebooks App" for Chrome found here:
https://chrome.google.com/webstore/detail/mmimngoggfoobjdlefbcabngfnmieonb

One installed click Launch App which will take you here. "http://books.google.com/ebooks/app"

Under each book, select "Make Available offline" and bookmark the page "http://books.google.com/ebooks/app"

The plugin will download your ebook and now you don't have to be online in order to read your books anymore while on your computer :)

Installing Scripting Layer for Android, Android SDK and Python Quickly on Ubuntu plus sending yourself an SMS

2011-12-20T20:23:00.000-08:00

If you have Attention deficit hyperactivity disorder like me or don't want to read 40 pages for something that should take 5 minutes to install this blog is for you. If you want to read 40 pages about stuff you really don't care about (apple press) just to install python on Android here's the link

Else lets go, If you're rocken linux get the sdk

#If need be read my first post on getting java 32bit or the 64bit version with ia32-lib installed

#Using the barcode scanner install SL4A and Python for Android Both programs need to be installed.

#Installing the SDK
$ tar zxvf android-sdk_r15-linux.tgz
$ android-sdk-linux/tools/android #execute the installer

#Select Tools, Android 4.0.3 and Extra, you should have around 14 packages in the bottom right hand corner to install.

#Once installed on the phone click on Settings -> Developer options

# Under Developer options Select USB debugging and Stay awake

#Back in Ubuntu in your home directory "cd" into ~/android-sdks/platform-tools directory and add the following script to a file called adbserver.sh, don't forget to chmod ug+x adbserver.sh

#adbserver.sh server script to start python server on android
./adb shell am start -a com.googlecode.android_scripting.action.LAUNCH_SERVER \

-n com.googlecode.android_scripting/.activity.ScriptingLayerServiceLauncher \

--ei com.googlecode.android_scripting.extra.USE_SERVICE_PORT 45001

port=`./adb logcat -d | grep "Bound to" | tail -n 1 | grep '127.0.0.1' | sed -e 's/.*://g'`

./adb forward tcp:9999 tcp:$port
export AP_PORT=9999
echo "server started on port:$port"

(for some reason the USE_SERVICE_PORT option doesn't work, however the script takes care of this)

#On the phone from the top window drop down you can see the server running. It's in dark grey and extremely hard to see.

#If you click on the server listing, it will bring you to the following screen showing the server port on 42409

#We need to move android.py from the phone to python2.6 ubuntu's python2.6 dist-packages directory. Make sure python2.6 is installed.
$ ./adb pull /sdcard/com.googlecode.pythonforandroid/extras/python/android.py .
$ sudo cp android.py /usr/local/lib/python2.6/dist-packages/

#Add the following to hellosms.py and run it using python2.6
import android
droid = android.Android()
droid.smsSend("9999999999", "testing") #replace 9999999999 with your number

$ python2.6 hellosms.py

#You should get a text from yourself to yourself and you're done! I hope this helps.

Getting Eclipse and ADT working on Ubuntu 64

2011-12-15T23:20:00.000-08:00

Getting Eclipse to run on Ubuntu 11.10 64bit with the Android Development Tools (32bit).

This is how I was able to get the Android Development Tools working on my Ubuntu 11.10 64bit machine. The problem is that when you install eclipse using apt-get, you'll get the 64bit version, however the android sdk needs a 32bit version of java. We can solve this issue by installing both the 64bit and 32bit versions of Java, this is how I did it.

#install the ia32-libs so you can run 32bit apps and shit
$ apt-get --reinstall install ia32-libs-multiarch ia32-libs

#install eclipse, this will install the 64bit version
$ apt-get install eclipse

#Get Oracles 32bit and 64 bit version of JDK
http://www.oracle.com/technetwork/java/javase/downloads/jdk-7u2-download-1377129.html

#Decompress each tarball and rename the 64 bit folder and move both the /usr/lib/jvm
$ mv jdk1.7.0_02/ /usr/lib/jvm/ <---mv 32bit version to /usr/lib/jvm
$ mv jdk1.7.0_02/ jdk64_1.7.0_0 <---rename 64bit version
$ mv jdk64_1.7.0_0 /usr/lib/jvm <---mv 64 bit version

#Chown dem bitches
$ chown -R root:root /usr/lib/jvm/jdk1.7.0_02/
$ chown -R root:root /usr/lib/jvm/jdk64_1.7.0_02/

#Select the JDK using the following steps from http://www.webupd8.org/2011/09/how-to-install-oracle-java-7-jdk-in.html
$ add-apt-repository ppa:nilarimogard/webupd8
$ apt-get update
$ apt-get install update-java

#run update-java so Android SDK will us 32bit version
$ update-java (and select the 32 bit version (jdk1.7.0_02))

#update /etc/eclipse.ini to make eclipse run the 64 version of java
#nano /etc/eclipse.ini add the first two lines below
#-vm
#/usr/lib/jvm/jdk64_1.7.0_02/bin

$ cat /etc/eclipse.ini
-vm
/usr/lib/jvm/jdk64_1.7.0_02/bin
-startup
plugins/org.eclipse.equinox.launcher_1.2.0.dist.jar
--launcher.library
plugins/org.eclipse.equinox.launcher.gtk.linux.x86_64_1.1.100.dist
-showsplash
org.eclipse.platform
--launcher.XXMaxPermSize
256m
--launcher.defaultAction
openFile
-vmargs
-Xms40m
-Xmx384m
-Dorg.eclipse.equinox.p2.reconciler.dropins.directory=/usr/share/eclipse/dropins

#Run eclipse and install ADT (Android Development Tools) http://developer.android.com/sdk/eclipse-adt.html

#If you get the following error after installing ADT Software being installed: Android Development Tools 11.0.0.v201105251008-128486 (com.android.ide.eclipse.adt.feature.group 11.0.0.v201105251008-128486) Missing requirement: Android Development Tools 11.0.0.v201105251008-128486 (com.android.ide.eclipse.adt.feature.group 11.0.0.v201105251008-128486) requires 'org.eclipse.wst.sse.core 0.0.0' but it could not be found
Here is the fix
http://stackoverflow.com/questions/6482268/eclipse-indigo-cannot-install-android-adt-plugin

#Next read http://developer.android.com/sdk/adding-components.html to get the SDK and other comopnents working

#b00m