Skip to main content

Dexofuzzy: Dalvik EXecutable Opcode Fuzzyhash

Project description

Dexofuzzy: Dalvik EXecutable Opcode Fuzzyhash

Dexofuzzy is a similarity digest hash for Android. It extracts Opcode Sequence from Dex file based on Ssdeep and generates hash that can be used for similarity comparison of Android App. Dexofuzzy created using Dex's opcode sequence can find similar apps by comparing hash.

License Latest Version Python Versions

Requirements

Dexofuzzy requires the following modules:

  • ssdeep 3.3 or later

Usage

usage: dexofuzzy [-h] [-f SAMPLE_FILENAME] [-d SAMPLE_DIRECTORY]
                 [-g N M][-s DEXOFUZZY DEXOFUZZY]
                 [-c CSV_FILENAME] [-j JSON_FILENAME]
                 [-l LOG_FILENAME]

Dexofuzzy - Dalvik EXecutable Opcode Fuzzyhash

optional arguments:
  -h, --help                     show this help message and exit
  -f SAMPLE_FILENAME, --file SAMPLE_FILENAME
                                 the sample to extract dexofuzzy
  -d SAMPLE_DIRECTORY, --directory SAMPLE_DIRECTORY
                                 the directory of samples to extract dexofuzzy
  -s DEXOFUZZY DEXOFUZZY, --score DEXOFUZZY DEXOFUZZY
                                 score the dexofuzzy of the sample
  -g N, --clustering N M         N-Gram Tokenizer and M-Partial Matching clustering based on the sample's dexofuzzy
                                 (must include the -d option by default)
  -c CSV_FILENAME, --csv CSV_FILENAME
                                 output as CSV format
  -j JSON_FILENAME, --json JSON_FILENAME
                                 output as json format
                                 (include method fuzzy or clustering)
  -l LOG_FILENAME, --error-log LOG_FILENAME
                                 output the error log

Python API

To compute a Dexofuzzy of dex file, use hash function:

  • dexofuzzy(dex_binary_data)
>>> import dexofuzzy
>>> with open('classes.dex', 'rb') as dex:
...     dex_data = dex.read()
>>> dexofuzzy.hash(dex_data)
'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
  • dexofuzzy_from_file(apk_file_path or dex_file_path)
>>> import dexofuzzy
>>> dexofuzzy.hash_from_file('Sample.apk')
'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
>>> dexofuzzy.hash_from_file('classes.dex')
'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'

The compare function returns the match between 2 hashes, an integer value from 0 (no match) to 100.

  • compare(dexofuzzy_1, dexofuzzy_2)
>>> import dexofuzzy
>>> with open('classes.dex', 'rb') as dex:
...     dex_data = dex.read()
>>> hash1 = dexofuzzy.hash(dex_data)
>>> hash1
'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
>>> hash2 = dexofuzzy.hash_from_file('classes2.dex')
>>> hash2
'48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5'
>>> dexofuzzy.compare(hash1, hash2)
50

Publication

License

Dexofuzzy is licensed under the terms of the Apache license. See LICENSE for more information.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

dexofuzzy-2.0.0.tar.gz (54.3 kB view hashes)

Uploaded Source

Built Distribution

dexofuzzy-2.0.0-py3-none-any.whl (57.1 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page