# -*- coding: utf-8 -*- """Scan dex class descriptors for Shopee/SeaBank security SDK.""" import re import sys import zipfile TARGETS = ( "safemode", "SafeMode", "alc/", "ALC", "integrity", "rooted", "jailbroken", "RootBeer", "xposed", "frida", "isRoot", "detectRoot", ) def scan(apk_path): with zipfile.ZipFile(apk_path) as zf: for name in sorted(zf.namelist()): if not name.endswith(".dex"): continue data = zf.read(name) classes = set(re.findall(rb"L[a-zA-Z0-9_$/]+;", data)) hits = [] for raw in classes: s = raw.decode("ascii", "ignore") low = s.lower() if any(t.lower() in low for t in TARGETS): hits.append(s[1:-1].replace("/", ".")) if hits: print("=== %s ===" % name) for h in sorted(set(hits)): print(h) print() if __name__ == "__main__": scan(sys.argv[1])