diff --git a/app/src/main/assets/stagefright/stagefright_media_files.zip b/app/src/main/assets/stagefright/stagefright_media_files.zip new file mode 100644 index 0000000..3c9753a Binary files /dev/null and b/app/src/main/assets/stagefright/stagefright_media_files.zip differ diff --git a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-1.mp4 b/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-1.mp4 deleted file mode 100644 index 9e665ea..0000000 Binary files a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-1.mp4 and /dev/null differ diff --git a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-2.mp4 b/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-2.mp4 deleted file mode 100644 index e01cae6..0000000 Binary files a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-2.mp4 and /dev/null differ diff --git a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-3.mp4 b/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-3.mp4 deleted file mode 100644 index 9838036..0000000 Binary files a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-3.mp4 and /dev/null differ diff --git a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-4.mp4 b/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-4.mp4 deleted file mode 100644 index 14f88d8..0000000 Binary files a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1538-4.mp4 and /dev/null differ diff --git a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1539.mp4 b/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1539.mp4 deleted file mode 100644 index de871b6..0000000 Binary files a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-1539.mp4 and /dev/null differ diff --git a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3824.mp4 b/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3824.mp4 deleted file mode 100644 index 4ff2220..0000000 Binary files a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3824.mp4 and /dev/null differ diff --git a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3828.mp4 b/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3828.mp4 deleted file mode 100644 index 033902d..0000000 Binary files a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3828.mp4 and /dev/null differ diff --git a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3829.mp4 b/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3829.mp4 deleted file mode 100644 index 71062bc..0000000 Binary files a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3829.mp4 and /dev/null differ diff --git a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3864.mp4 b/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3864.mp4 deleted file mode 100644 index fc0af68..0000000 Binary files a/app/src/main/assets/stagefright/stagefright_media_files/CVE-2015-3864.mp4 and /dev/null differ diff --git a/app/src/main/assets/stagefright/stagefright_media_files/sf-itunes-poc.mp4 b/app/src/main/assets/stagefright/stagefright_media_files/sf-itunes-poc.mp4 deleted file mode 100644 index 6cff8e2..0000000 Binary files a/app/src/main/assets/stagefright/stagefright_media_files/sf-itunes-poc.mp4 and /dev/null differ diff --git a/app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/framework/media/StageFright.java b/app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/framework/media/StageFright.java index ff81276..2ecf4b9 100644 --- a/app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/framework/media/StageFright.java +++ b/app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/framework/media/StageFright.java @@ -16,6 +16,7 @@ import fuzion24.device.vulnerability.vulnerabilities.helper.TestResult; import static fuzion24.device.vulnerability.vulnerabilities.helper.BinaryAssets.extractAsset; +import static fuzion24.device.vulnerability.vulnerabilities.helper.BinaryAssets.extractZipAsset; import static fuzion24.device.vulnerability.vulnerabilities.helper.CrashCheck.execute; /** @@ -39,9 +40,13 @@ public static List getTests(Context context) { try { File dataDir = context.getFilesDir(); - AssetManager assetManager = context.getAssets(); - final String stageFrightAssetPath = "stagefright/stagefright_media_files"; - String[] stagefrightMediaFiles = assetManager.list(stageFrightAssetPath); + + final String stageFrightAssetPath = "stagefright/stagefright_media_files.zip"; + final String extractionDir = dataDir.getAbsolutePath() + File.separator + "stagefright_media" + File.separator; + + extractZipAsset(context, stageFrightAssetPath, extractionDir); + + File stagefrightMediaFilesFolder = new File(extractionDir); List tests = new ArrayList(); @@ -50,18 +55,14 @@ public static List getTests(Context context) { extractedBinaryTester); exec("chmod 700 " + extractedBinaryTester); - for (final String mediaFile : stagefrightMediaFiles) { - - final String extractedAssetPath = dataDir.getAbsolutePath() + File.separator + mediaFile; - - extractAsset(context, - stageFrightAssetPath + File.separator + mediaFile, - extractedAssetPath); + Log.d(TAG, "Is directory: " + stagefrightMediaFilesFolder.isDirectory()); + File[] mediaFiles = stagefrightMediaFilesFolder.listFiles(); + for (final File mediaFile : stagefrightMediaFilesFolder.listFiles()) { tests.add(new VulnerabilityTest() { @Override public String getCVEorID() { - return FilenameUtils.removeExtension(mediaFile); + return FilenameUtils.removeExtension(mediaFile.getName()); } @Override @@ -75,7 +76,7 @@ public List getSupportedArchitectures() { @Override public boolean isVulnerable(Context context) throws Exception { - TestResult result = execute(context, 5, extractedBinaryTester, extractedAssetPath); + TestResult result = execute(context, 5, extractedBinaryTester, mediaFile.getAbsolutePath()); Log.d(TAG, "Test result: " + result.toString()); if (result.isOk()) { return false; diff --git a/app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/helper/BinaryAssets.java b/app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/helper/BinaryAssets.java index 8d0745f..89237bf 100644 --- a/app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/helper/BinaryAssets.java +++ b/app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/helper/BinaryAssets.java @@ -10,6 +10,8 @@ import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; +import java.util.zip.ZipEntry; +import java.util.zip.ZipInputStream; public class BinaryAssets { @@ -23,7 +25,7 @@ public static String extractAsset(Context ctx, String name) throws IOException { AssetManager assetManager = ctx.getAssets(); InputStream asset = assetManager.open(name); ByteArrayOutputStream fos = new ByteArrayOutputStream(); - copy(asset,fos); + copy(asset, fos); return fos.toString(); } @@ -36,6 +38,7 @@ public static void extractAsset(Context ctx, String name, String destination, bo f.delete(); } } + catch(Exception e) {e.printStackTrace();} AssetManager assetManager = ctx.getAssets(); @@ -44,6 +47,40 @@ public static void extractAsset(Context ctx, String name, String destination, bo copy(asset,fos); } + public static void extractZipAsset(Context ctx, String zipAsset, String destination) throws IOException { + AssetManager assetManager = ctx.getAssets(); + InputStream asset = assetManager.open(zipAsset); + ZipInputStream zis = new ZipInputStream(asset); + + File extractionDir = new File(destination); + + boolean directionCreationSucceeded = extractionDir.mkdirs(); + + ZipEntry ze = null; + byte[] buffer = new byte[8192]; + while ((ze = zis.getNextEntry()) != null) { + + if(ze.isDirectory()){ + continue; + } + + //Strip everything from the last '/' + String zeName = ze.getName(); + String fileName = zeName; + if(zeName.lastIndexOf('/') != -1){ + fileName = zeName.substring(zeName.lastIndexOf('/'), zeName.length()); + } + + String fileExtractionPath = destination + fileName; + FileOutputStream fos = new FileOutputStream(fileExtractionPath); + int len; + while ((len = zis.read(buffer)) != -1) { + fos.write(buffer, 0, len); + } + fos.close(); + } + } + private static final int BUFFER_SIZE = 2 * 1024 * 1024; public static void copy(InputStream input, OutputStream output) throws IOException { try {