Repository navigation
Preserve Android configuration bytes in DEX - #2
Closed
pauljccode wants to merge 2 commits into
Closed
pauljccode wants to merge 2 commits into
pauljccode wants to merge 2 commits into
Conversation
Use the block form of gsub! so binary configuration bytes are inserted literally instead of being parsed as replacement backreferences. Cover staged and stageless generation with ordinary bytes, malformed named references, numbered references and whole-match references. Check the generated DEX data, length, signature and checksum. See rapid7#10636.
|
Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected. We've added the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Android payload generation passes binary configuration to
gsub!as a replacement string. Bytes such as\k<can raiseinvalid group name reference format;\1and\&can silently alter the DEX.Use the block form to insert bytes literally. Eight regression cases cover staged and stageless generation, checking configuration, surrounding data, length, SHA-1 signature and Adler-32 checksum.
Related: rapid7#10636. The exception also interrupted this Verify job.
Breaking Changes
None.
Verification Steps
bundle exec rspec spec/lib/msf/core/payload/android_spec.rb; expect eight examples and no failures.Test Evidence
Local isolated tests reproduce all six failures and pass with the correction. They use real DEX assets and archive generation, with controlled configuration input and stubbed JAR signing; no Android device was tested. The new spec is RuboCop-clean, with no new library offenses.
Verify at this branch's head passed all 14 jobs without failures or retries, including the new examples across Ruby 3.2–3.4.
Separate Meterpreter failures are addressed by rapid7/mettle#298, rapid7/mettle#299 and rapid7/metasploit-payloads#818. Combined acceptance passed all 23 applicable jobs, with one optional-build skip; it includes those additional corrections.
Environment
AI Usage Disclosure
Codex assisted with investigation, implementation, tests and this description.
Pre-Submission Checklist
Upstream: rapid7/metasploit-framework#21968.