移动护士站 1.69版本 | 静态分析 _南明离火移动安全分析平台

安全声明：本平台专为移动应用安全风险研究与合规评估设计，严禁用于任何非法用途。如有疑问或建议，欢迎加入微信群交流。

应用图标

应用评分

文件基本信息

文件名称

移动护士站.apk

文件大小

5.28MB

MD5

30025a4c88cb1b71e1c0db087a062464

SHA1

df799d5e5a3a13dc25c858e8cf4897b5e95a1155

SHA256

e888a6773937ea8f1733c5e9aeecdaf9e0ad9b555dbf91790e9770dee2b4d484

病毒检测

无法判定

应用基础信息

应用名称

移动护士站

包名

com.kyee.mobilenursestation

主活动

com.kyee.nursestation.controller.WelcomeActivity

目标SDK

19

最小SDK

8

版本号

1.69

子版本号

150919369

加固信息

未加壳

组件导出状态统计

查看 Activity 组件

查看 Service 组件

查看 Receiver 组件

查看 Provider 组件

扫描与分析选项

重新扫描管理规则动态分析

反编译与源码导出

Manifest文件查看

APK文件成为会员，解锁下载

Java源代码查看 -- 下载

文件结构与资源列表

应用签名证书信息

二进制文件已签名
v1 签名: True
v2 签名: False
v3 签名: False
v4 签名: False
主题: ST=shanghai, L=shanghai, O=kingyee, CN=kyee
签名算法: rsassa_pkcs1v15
有效期自: 2014-01-20 07:35:38+00:00
有效期至: 2039-01-14 07:35:38+00:00
发行人: ST=shanghai, L=shanghai, O=kingyee, CN=kyee
序列号: 0x1fce3096
哈希算法: sha256
证书MD5: 218b1cee22d4e84f04ceebbd6c6f339f
证书SHA1: 3c12af57c8885ed4ebc82e105ce5e0bfcdf10905
证书SHA256: c1e85ee7c5204f0ecfa85025189f77453a4c10d83ea78047f19a194ca4e9c7ee
证书SHA512: 500c267f92a429abebbc3413591972b31457c7783bb971bd14ebcc2731f811a12039a99025724c51eac650df062750e93f240cf0a91e4df8c45e8f9c263d7dfd
找到 1 个唯一证书

权限声明与风险分级

权限名称	安全等级	权限内容	权限描述	关联代码
android.permission.WAKE_LOCK	危险	防止手机休眠	允许应用程序防止手机休眠，在手机屏幕关闭后后台进程仍然运行。
android.permission.VIBRATE	普通	控制振动器	允许应用程序控制振动器，用于消息通知振动功能。	显示文件 com/honeywell/decodemanager/DecodeManager.java com/kyee/nursestation/utils/SoundManagerUtil.java
android.permission.SYSTEM_ALERT_WINDOW	危险	弹窗	允许应用程序弹窗。恶意程序可以接管手机的整个屏幕。	显示文件 com/kyee/nursestation/controller/NurseStationActivity.java
android.permission.BLUETOOTH	危险	创建蓝牙连接	允许应用程序查看或创建蓝牙连接。	显示文件 com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/utils/CommonUtil.java com/kyee/nursestation/utils/datacontrol/DataController.java
android.permission.BLUETOOTH_ADMIN	危险	管理蓝牙	允许程序发现和配对新的蓝牙设备。
android.permission.WRITE_EXTERNAL_STORAGE	危险	读取/修改/删除外部存储内容	允许应用程序写入外部存储。	显示文件 com/honeywell/imagingmanager/ImagingManager.java com/kyee/apkupdate/AppUpdateManager.java com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/utils/DBHelperUtilView.java com/kyee/nursestation/utils/FileUtil.java com/kyee/nursestation/utils/LoadUtil.java org/codehaus/jackson/JsonFactory.java
android.permission.RECEIVE_BOOT_COMPLETED	普通	开机自启	允许应用程序在系统完成启动后即自行启动。这样会延长手机的启动时间，而且如果应用程序一直运行，会降低手机的整体速度。	显示文件 com/kyee/nursestation/utils/scancontrol/BCRSBroadCastReceiver.java com/kyee/nursestation/utils/scancontrol/BNBroadCastReceiver.java com/kyee/nursestation/utils/scancontrol/BroadCastReceiver_BN.java com/kyee/nursestation/utils/scancontrol/BroadCastReceiver_DJ.java com/kyee/nursestation/utils/scancontrol/BroadCastReceiver_LX.java com/kyee/nursestation/utils/scancontrol/BroadCastReceiver_Saga.java com/kyee/nursestation/utils/scancontrol/EMHBroadCastReceiver.java com/kyee/nursestation/utils/scancontrol/ScanUtil.java
android.permission.MOUNT_FORMAT_FILESYSTEMS	危险	格式化外部存储设备	允许应用程序格式化可移除的存储设备。
android.permission.MOUNT_UNMOUNT_FILESYSTEMS	危险	装载和卸载文件系统	允许应用程序装载和卸载可移动存储器的文件系统。
android.permission.DISABLE_KEYGUARD	危险	禁用键盘锁	允许应用程序停用键锁和任何关联的密码安全设置。例如，在手机上接听电话时停用键锁，在通话结束后重新启用键锁。
android.permission.INTERNET	危险	完全互联网访问	允许应用程序创建网络套接字。	显示文件 com/kyee/apkupdate/AppUpdateManager.java com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/utils/LoadUtil.java de/tavendo/autobahn/Wamp.java de/tavendo/autobahn/WampConnection.java de/tavendo/autobahn/WebSocketConnection.java org/codehaus/jackson/JsonFactory.java
android.permission.ACCESS_NETWORK_STATE	普通	获取网络状态	允许应用程序查看所有网络的状态。	显示文件 cn/com/kyee/KingYeeWebSocketClient.java com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/utils/CommonUtil.java com/kyee/nursestation/utils/datacontrol/DataController.java
android.permission.READ_LOGS	危险	读取系统日志文件	允许应用程序从系统的各日志文件中读取信息。这样应用程序可以发现您的手机使用情况，这些信息还可能包含用户个人信息或保密信息，造成隐私数据泄露。
android.permission.ACCESS_WIFI_STATE	普通	查看Wi-Fi状态	允许应用程序查看有关Wi-Fi状态的信息。	显示文件 cn/com/kyee/KingYeeWebSocketClient.java
com.honeywell.decode.permission.DECODE	未知	未知权限	来自 android 引用的未知权限。
android.permission.BCREADER	未知	未知权限	来自 android 引用的未知权限。
android.permission.CAMERA	危险	拍照和录制视频	允许应用程序拍摄照片和视频，且允许应用程序收集相机在任何时候拍到的图像。
android.permission.GET_TASKS	危险	检索当前运行的应用程序	允许应用程序检索有关当前和最近运行的任务的信息。恶意应用程序可借此发现有关其他应用程序的保密信息。	显示文件 com/honeywell/decodemanager/DecodeManager.java

证书安全合规分析

高危

1

警告

0

信息

1

标题	严重程度	描述信息
已签名应用	信息	应用程序已使用代码签名证书进行签名
应用程序存在Janus漏洞	高危	应用程序使用了v1签名方案进行签名，如果只使用v1签名方案，那么它就容易受到安卓5.0-8.0上的Janus漏洞的攻击。在安卓5.0-7.0上运行的使用了v1签名方案的应用程序，以及同时使用了v2/v3签名方案的应用程序也同样存在漏洞。

Manifest 配置安全分析

高危

1

警告

9

信息

0

屏蔽

0

序号	问题	严重程度	描述信息	操作
1	应用程序可以安装在有漏洞的已更新 Android 版本上 Android 2.2-2.2.3, [minSdk=8]	警告	该应用程序可以安装在具有多个未修复漏洞的旧版本 Android 上。这些设备不会从 Google 接收合理的安全更新。支持 Android 版本 => 10、API 29 以接收合理的安全更新。	对应用 com.kyee.mobilenursestation 屏蔽 vulnerable_os_version 规则
2	应用程序数据可以被备份 [android:allowBackup=true]	警告	这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。	对应用 com.kyee.mobilenursestation 屏蔽 app_allowbackup 规则
3	Activity (com.kyee.nursestation.controller.UserLoginActivity) 未被保护。存在一个intent-filter。	警告	发现 Activity与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity是显式导出的。	对应用 com.kyee.mobilenursestation 屏蔽 activity_exported_intent_filter_exists 规则
4	Activity (com.kyee.nursestation.controller.NurseStationActivity) is vulnerable to StrandHogg 2.0	高危	已发现活动存在 StrandHogg 2.0 栈劫持漏洞的风险。漏洞利用时，其他应用程序可以将恶意活动放置在易受攻击的应用程序的活动栈顶部，从而使应用程序成为网络钓鱼攻击的易受攻击目标。可以通过将启动模式属性设置为“singleInstance”并设置空 taskAffinity (taskAffinity="") 来修复此漏洞。您还可以将应用的目标 SDK 版本 (19) 更新到 29 或更高版本以在平台级别修复此问题。	对应用 com.kyee.mobilenursestation 屏蔽 activity_task_hijacking2 规则
5	Activity (com.kyee.nursestation.controller.NurseStationActivity) 未被保护。 [android:exported=true]	警告	发现 Activity与设备上的其他应用程序共享，因此使其对设备上的任何其他应用程序都可访问。	对应用 com.kyee.mobilenursestation 屏蔽 activity_explicitly_exported 规则
6	Activity (com.kyee.nursestation.views.menu.checkout.CheckoutDetailActivity) 未被保护。存在一个intent-filter。	警告	发现 Activity与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity是显式导出的。	对应用 com.kyee.mobilenursestation 屏蔽 activity_exported_intent_filter_exists 规则
7	Broadcast Receiver (com.kyee.nursestation.utils.scancontrol.BNBroadCastReceiver) 未被保护。存在一个intent-filter。	警告	发现 Broadcast Receiver与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Broadcast Receiver是显式导出的。	对应用 com.kyee.mobilenursestation 屏蔽 receiver_exported_intent_filter_exists 规则
8	Broadcast Receiver (com.kyee.nursestation.utils.scancontrol.EMHBroadCastReceiver) 未被保护。存在一个intent-filter。	警告	发现 Broadcast Receiver与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Broadcast Receiver是显式导出的。	对应用 com.kyee.mobilenursestation 屏蔽 receiver_exported_intent_filter_exists 规则
9	高优先级的Intent (1000) [android:priority]	警告	通过设置一个比另一个Intent更高的优先级，应用程序有效地覆盖了其他请求。	对应用 com.kyee.mobilenursestation 屏蔽 high_intent_priority_found 规则
10	高优先级的Intent (1000) [android:priority]	警告	通过设置一个比另一个Intent更高的优先级，应用程序有效地覆盖了其他请求。	对应用 com.kyee.mobilenursestation 屏蔽 high_intent_priority_found 规则

可浏览 Activity 组件分析

ACTIVITY	INTENT

网络通信安全风险分析

序号	范围	严重级别	描述

API调用分析

API功能	源码文件
调用java反射机制	显示文件 com/kyee/nursestation/utils/CommonUtil.java com/kyee/nursestation/utils/DBHelperUtil.java com/kyee/nursestation/utils/DBHelperUtilView.java com/kyee/nursestation/utils/LoadUtil.java com/kyee/nursestation/utils/createutil/templates/NursingTemplates.java com/kyee/nursestation/utils/createutil/util/CreateViewUtil.java com/kyee/nursestation/utils/datacontrol/JsonHelper.java com/kyee/nursestation/views/menu/healthedu/EduAddChildItemAdapter.java com/kyee/nursestation/views/menu/orders/OrdersAdpter.java org/codehaus/jackson/map/deser/BasicDeserializerFactory.java org/codehaus/jackson/map/deser/SettableAnyProperty.java org/codehaus/jackson/map/deser/SettableBeanProperty.java org/codehaus/jackson/map/deser/std/ClassDeserializer.java org/codehaus/jackson/map/deser/std/EnumDeserializer.java org/codehaus/jackson/map/deser/std/StdKeyDeserializer.java org/codehaus/jackson/map/deser/std/StdKeyDeserializers.java org/codehaus/jackson/map/ext/OptionalHandlerFactory.java org/codehaus/jackson/map/introspect/AnnotatedClass.java org/codehaus/jackson/map/introspect/AnnotatedField.java org/codehaus/jackson/map/introspect/AnnotatedMethod.java org/codehaus/jackson/map/introspect/AnnotatedMethodMap.java org/codehaus/jackson/map/introspect/BasicBeanDescription.java org/codehaus/jackson/map/introspect/BasicClassIntrospector.java org/codehaus/jackson/map/introspect/MemberKey.java org/codehaus/jackson/map/introspect/MethodFilter.java org/codehaus/jackson/map/introspect/VisibilityChecker.java org/codehaus/jackson/map/ser/AnyGetterWriter.java org/codehaus/jackson/map/ser/BasicSerializerFactory.java org/codehaus/jackson/map/ser/BeanPropertyWriter.java org/codehaus/jackson/map/ser/PropertyBuilder.java org/codehaus/jackson/map/ser/std/JsonValueSerializer.java org/codehaus/jackson/map/util/ClassUtil.java
组件-> 启动 Activity	显示文件 com/honeywell/aidc/BarcodeReader.java com/honeywell/decodemanager/DecodeManager.java com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/controller/NurseStationActivity.java com/kyee/nursestation/controller/UserLoginActivity.java com/kyee/nursestation/controller/WelcomeActivity.java com/kyee/nursestation/global/CustomApplication.java com/kyee/nursestation/utils/createutil/util/ConfigViewUpdateManager.java com/kyee/nursestation/views/menu/BloodAdviceFragment.java com/kyee/nursestation/views/menu/GeneralSignsFragment.java com/kyee/nursestation/views/menu/bloodAdvice/pats/BloodPatListAdapter.java com/kyee/nursestation/views/menu/bloodAdvice/remind/RemindAdapter.java com/kyee/nursestation/views/menu/checkout/CheckoutAdapter.java com/kyee/nursestation/views/menu/vitalsigns/VitalSignsFragmentMain.java
一般功能-> IPC通信	显示文件 com/honeywell/IExecutor.java com/honeywell/aidc/AidcManager.java com/honeywell/aidc/BarcodeReader.java com/honeywell/aidc/DecodeIntent.java com/honeywell/decodeconfigcommon/IDecodeComplete.java com/honeywell/decodeconfigcommon/IDecoderService.java com/honeywell/decodemanager/DecodeManager.java com/honeywell/imagingmanager/ImagingManager.java com/honeywell/iqimagemanager/IQImageManager.java com/honeywell/scanintent/ScanIntent.java com/kyee/apkupdate/AppUpdateService.java com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/controller/NurseStationActivity.java com/kyee/nursestation/controller/UserLoginActivity.java com/kyee/nursestation/controller/WelcomeActivity.java com/kyee/nursestation/global/CustomApplication.java com/kyee/nursestation/utils/SynchronousDataService.java com/kyee/nursestation/utils/createutil/util/ConfigViewUpdateManager.java com/kyee/nursestation/utils/scancontrol/BCRSBroadCastReceiver.java com/kyee/nursestation/utils/scancontrol/BNBroadCastReceiver.java com/kyee/nursestation/utils/scancontrol/BroadCastReceiver_BN.java com/kyee/nursestation/utils/scancontrol/BroadCastReceiver_DJ.java com/kyee/nursestation/utils/scancontrol/BroadCastReceiver_LX.java com/kyee/nursestation/utils/scancontrol/BroadCastReceiver_Saga.java com/kyee/nursestation/utils/scancontrol/EMHBroadCastReceiver.java com/kyee/nursestation/utils/scancontrol/ScanUtil.java com/kyee/nursestation/utils/scancontrol/ScanUtil_Motorola.java com/kyee/nursestation/views/menu/BloodAdviceFragment.java com/kyee/nursestation/views/menu/GeneralSignsFragment.java com/kyee/nursestation/views/menu/LoginInfoFragment.java com/kyee/nursestation/views/menu/NurseTaskFragment.java com/kyee/nursestation/views/menu/bloodAdvice/activity/BloodAdviceActivity.java com/kyee/nursestation/views/menu/bloodAdvice/pats/BloodPatListAdapter.java com/kyee/nursestation/views/menu/bloodAdvice/remind/BloodPushInfoHandler.java com/kyee/nursestation/views/menu/bloodAdvice/remind/BloodPushRemindHandler.java com/kyee/nursestation/views/menu/bloodAdvice/remind/PrepareBloodService.java com/kyee/nursestation/views/menu/bloodAdvice/remind/PrepareBloodTimer.java com/kyee/nursestation/views/menu/bloodAdvice/remind/RemindAdapter.java com/kyee/nursestation/views/menu/bloodAdvice/remind/RemindService.java com/kyee/nursestation/views/menu/bloodAdvice/remind/RemindTimer.java com/kyee/nursestation/views/menu/checkout/CheckoutAdapter.java com/kyee/nursestation/views/menu/checkout/CheckoutDetailActivity.java com/kyee/nursestation/views/menu/vitalsigns/VitalSignsFragmentMain.java
一般功能-> 文件操作	显示文件 com/honeywell/decodeconfigcommon/SymbologyConfigDoc.java com/honeywell/decodemanager/DecodeManager.java com/honeywell/imagingmanager/ImagingManager.java com/honeywell/test/ImagingManagerTest.java com/kyee/apkupdate/AppUpdateManager.java com/kyee/apkupdate/AppUpdateUtil.java com/kyee/apkupdate/MD5Util.java com/kyee/nursestation/controller/NurseStationActivity.java com/kyee/nursestation/controller/UserLoginActivity.java com/kyee/nursestation/global/CustomApplication.java com/kyee/nursestation/utils/CommonUtil.java com/kyee/nursestation/utils/ConfigureLog4J.java com/kyee/nursestation/utils/DBHelperUtilView.java com/kyee/nursestation/utils/FileUtil.java com/kyee/nursestation/utils/HttpUtils.java com/kyee/nursestation/utils/LoadUtil.java com/kyee/nursestation/utils/SynchronousDataService.java com/kyee/nursestation/utils/createutil/util/ConfigViewUpdateManager.java com/kyee/nursestation/utils/datacontrol/URLConnection.java com/kyee/nursestation/views/menu/CareRecordFragment.java com/kyee/nursestation/views/menu/SettingFragment.java de/mindpipe/android/logging/log4j/LogConfigurator.java de/tavendo/autobahn/ByteBufferInputStream.java de/tavendo/autobahn/ByteBufferOutputStream.java de/tavendo/autobahn/NoCopyByteArrayOutputStream.java de/tavendo/autobahn/WampReader.java de/tavendo/autobahn/WampWriter.java de/tavendo/autobahn/WebSocketConnection.java de/tavendo/autobahn/WebSocketReader.java de/tavendo/autobahn/WebSocketWriter.java org/codehaus/jackson/JsonFactory.java org/codehaus/jackson/JsonGenerator.java org/codehaus/jackson/JsonLocation.java org/codehaus/jackson/JsonNode.java org/codehaus/jackson/JsonParser.java org/codehaus/jackson/JsonProcessingException.java org/codehaus/jackson/ObjectCodec.java org/codehaus/jackson/PrettyPrinter.java org/codehaus/jackson/format/DataFormatDetector.java org/codehaus/jackson/format/DataFormatMatcher.java org/codehaus/jackson/format/InputAccessor.java org/codehaus/jackson/impl/ByteSourceBootstrapper.java org/codehaus/jackson/impl/Indenter.java org/codehaus/jackson/impl/JsonGeneratorBase.java org/codehaus/jackson/impl/JsonParserBase.java org/codehaus/jackson/impl/JsonParserMinimalBase.java org/codehaus/jackson/impl/ReaderBasedParser.java org/codehaus/jackson/impl/ReaderBasedParserBase.java org/codehaus/jackson/impl/StreamBasedParserBase.java org/codehaus/jackson/impl/Utf8Generator.java org/codehaus/jackson/impl/Utf8StreamParser.java org/codehaus/jackson/impl/WriterBasedGenerator.java org/codehaus/jackson/io/BaseReader.java org/codehaus/jackson/io/InputDecorator.java org/codehaus/jackson/io/MergedStream.java org/codehaus/jackson/io/OutputDecorator.java org/codehaus/jackson/io/SegmentedStringWriter.java org/codehaus/jackson/io/UTF32Reader.java org/codehaus/jackson/io/UTF8Writer.java org/codehaus/jackson/map/DeserializationContext.java org/codehaus/jackson/map/DeserializationProblemHandler.java org/codehaus/jackson/map/JsonDeserializer.java org/codehaus/jackson/map/JsonMappingException.java org/codehaus/jackson/map/JsonSerializable.java org/codehaus/jackson/map/JsonSerializableWithType.java org/codehaus/jackson/map/JsonSerializer.java org/codehaus/jackson/map/KeyDeserializer.java org/codehaus/jackson/map/MappingIterator.java org/codehaus/jackson/map/MappingJsonFactory.java org/codehaus/jackson/map/ObjectMapper.java org/codehaus/jackson/map/ObjectReader.java org/codehaus/jackson/map/ObjectWriter.java org/codehaus/jackson/map/SerializerProvider.java org/codehaus/jackson/map/TypeDeserializer.java org/codehaus/jackson/map/TypeSerializer.java org/codehaus/jackson/map/deser/AbstractDeserializer.java org/codehaus/jackson/map/deser/BeanDeserializer.java org/codehaus/jackson/map/deser/JsonNodeDeserializer.java org/codehaus/jackson/map/deser/SettableAnyProperty.java org/codehaus/jackson/map/deser/SettableBeanProperty.java org/codehaus/jackson/map/deser/StdDeserializationContext.java org/codehaus/jackson/map/deser/StdDeserializer.java org/codehaus/jackson/map/deser/StdDeserializerProvider.java org/codehaus/jackson/map/deser/ValueInstantiator.java org/codehaus/jackson/map/deser/impl/CreatorProperty.java org/codehaus/jackson/map/deser/impl/ExternalTypeHandler.java org/codehaus/jackson/map/deser/impl/PropertyBasedCreator.java org/codehaus/jackson/map/deser/impl/PropertyValue.java org/codehaus/jackson/map/deser/impl/UnwrappedPropertyHandler.java org/codehaus/jackson/map/deser/impl/ValueInjector.java org/codehaus/jackson/map/deser/std/AtomicBooleanDeserializer.java org/codehaus/jackson/map/deser/std/AtomicReferenceDeserializer.java org/codehaus/jackson/map/deser/std/BaseNodeDeserializer.java org/codehaus/jackson/map/deser/std/CalendarDeserializer.java org/codehaus/jackson/map/deser/std/ClassDeserializer.java org/codehaus/jackson/map/deser/std/CollectionDeserializer.java org/codehaus/jackson/map/deser/std/DateDeserializer.java org/codehaus/jackson/map/deser/std/EnumDeserializer.java org/codehaus/jackson/map/deser/std/EnumMapDeserializer.java org/codehaus/jackson/map/deser/std/EnumSetDeserializer.java org/codehaus/jackson/map/deser/std/FromStringDeserializer.java org/codehaus/jackson/map/deser/std/JavaTypeDeserializer.java org/codehaus/jackson/map/deser/std/JsonNodeDeserializer.java org/codehaus/jackson/map/deser/std/MapDeserializer.java org/codehaus/jackson/map/deser/std/ObjectArrayDeserializer.java org/codehaus/jackson/map/deser/std/PrimitiveArrayDeserializers.java org/codehaus/jackson/map/deser/std/StdDeserializer.java org/codehaus/jackson/map/deser/std/StdKeyDeserializer.java org/codehaus/jackson/map/deser/std/StdScalarDeserializer.java org/codehaus/jackson/map/deser/std/StdValueInstantiator.java org/codehaus/jackson/map/deser/std/StringCollectionDeserializer.java org/codehaus/jackson/map/deser/std/StringDeserializer.java org/codehaus/jackson/map/deser/std/ThrowableDeserializer.java org/codehaus/jackson/map/deser/std/TimestampDeserializer.java org/codehaus/jackson/map/deser/std/TokenBufferDeserializer.java org/codehaus/jackson/map/deser/std/UntypedObjectDeserializer.java org/codehaus/jackson/map/ext/CoreXMLDeserializers.java org/codehaus/jackson/map/ext/CoreXMLSerializers.java org/codehaus/jackson/map/ext/DOMDeserializer.java org/codehaus/jackson/map/ext/DOMSerializer.java org/codehaus/jackson/map/ext/JodaDeserializers.java org/codehaus/jackson/map/ext/JodaSerializers.java org/codehaus/jackson/map/jsontype/impl/AsArrayTypeDeserializer.java org/codehaus/jackson/map/jsontype/impl/AsArrayTypeSerializer.java org/codehaus/jackson/map/jsontype/impl/AsExternalTypeSerializer.java org/codehaus/jackson/map/jsontype/impl/AsPropertyTypeDeserializer.java org/codehaus/jackson/map/jsontype/impl/AsPropertyTypeSerializer.java org/codehaus/jackson/map/jsontype/impl/AsWrapperTypeDeserializer.java org/codehaus/jackson/map/jsontype/impl/AsWrapperTypeSerializer.java org/codehaus/jackson/map/jsontype/impl/TypeDeserializerBase.java org/codehaus/jackson/map/ser/BeanSerializer.java org/codehaus/jackson/map/ser/StdSerializerProvider.java org/codehaus/jackson/map/ser/StdSerializers.java org/codehaus/jackson/map/ser/impl/FailingSerializer.java org/codehaus/jackson/map/ser/impl/UnknownSerializer.java org/codehaus/jackson/map/ser/impl/UnwrappingBeanSerializer.java org/codehaus/jackson/map/ser/std/AsArraySerializerBase.java org/codehaus/jackson/map/ser/std/BeanSerializerBase.java org/codehaus/jackson/map/ser/std/CalendarSerializer.java org/codehaus/jackson/map/ser/std/CollectionSerializer.java org/codehaus/jackson/map/ser/std/DateSerializer.java org/codehaus/jackson/map/ser/std/EnumMapSerializer.java org/codehaus/jackson/map/ser/std/EnumSerializer.java org/codehaus/jackson/map/ser/std/EnumSetSerializer.java org/codehaus/jackson/map/ser/std/IndexedStringListSerializer.java org/codehaus/jackson/map/ser/std/InetAddressSerializer.java org/codehaus/jackson/map/ser/std/IterableSerializer.java org/codehaus/jackson/map/ser/std/JsonValueSerializer.java org/codehaus/jackson/map/ser/std/MapSerializer.java org/codehaus/jackson/map/ser/std/NonTypedScalarSerializerBase.java org/codehaus/jackson/map/ser/std/NullSerializer.java org/codehaus/jackson/map/ser/std/ObjectArraySerializer.java org/codehaus/jackson/map/ser/std/RawSerializer.java org/codehaus/jackson/map/ser/std/ScalarSerializerBase.java org/codehaus/jackson/map/ser/std/SerializableSerializer.java org/codehaus/jackson/map/ser/std/SerializableWithTypeSerializer.java org/codehaus/jackson/map/ser/std/SerializerBase.java org/codehaus/jackson/map/ser/std/StdArraySerializers.java org/codehaus/jackson/map/ser/std/StdContainerSerializers.java org/codehaus/jackson/map/ser/std/StdJdkSerializers.java org/codehaus/jackson/map/ser/std/StdKeySerializer.java org/codehaus/jackson/map/ser/std/StdKeySerializers.java org/codehaus/jackson/map/ser/std/StringCollectionSerializer.java org/codehaus/jackson/map/ser/std/StringSerializer.java org/codehaus/jackson/map/ser/std/TimeZoneSerializer.java org/codehaus/jackson/map/ser/std/ToStringSerializer.java org/codehaus/jackson/map/ser/std/TokenBufferSerializer.java org/codehaus/jackson/map/type/TypeBase.java org/codehaus/jackson/map/util/JSONPObject.java org/codehaus/jackson/map/util/JSONWrappedObject.java org/codehaus/jackson/node/ArrayNode.java org/codehaus/jackson/node/BaseJsonNode.java org/codehaus/jackson/node/BigIntegerNode.java org/codehaus/jackson/node/BinaryNode.java org/codehaus/jackson/node/BooleanNode.java org/codehaus/jackson/node/DecimalNode.java org/codehaus/jackson/node/DoubleNode.java org/codehaus/jackson/node/IntNode.java org/codehaus/jackson/node/LongNode.java org/codehaus/jackson/node/MissingNode.java org/codehaus/jackson/node/NullNode.java org/codehaus/jackson/node/ObjectNode.java org/codehaus/jackson/node/POJONode.java org/codehaus/jackson/node/TextNode.java org/codehaus/jackson/node/TreeTraversingParser.java org/codehaus/jackson/node/ValueNode.java org/codehaus/jackson/util/ByteArrayBuilder.java org/codehaus/jackson/util/DefaultPrettyPrinter.java org/codehaus/jackson/util/JsonGeneratorDelegate.java org/codehaus/jackson/util/JsonParserDelegate.java org/codehaus/jackson/util/JsonParserSequence.java org/codehaus/jackson/util/MinimalPrettyPrinter.java org/codehaus/jackson/util/TokenBuffer.java org/codehaus/jackson/util/VersionUtil.java
组件-> 启动 Service	显示文件 com/honeywell/aidc/AidcManager.java com/honeywell/decodemanager/DecodeManager.java com/honeywell/imagingmanager/ImagingManager.java com/honeywell/iqimagemanager/IQImageManager.java com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/controller/NurseStationActivity.java com/kyee/nursestation/controller/UserLoginActivity.java com/kyee/nursestation/controller/WelcomeActivity.java com/kyee/nursestation/views/menu/LoginInfoFragment.java com/kyee/nursestation/views/menu/bloodAdvice/remind/BloodPushInfoHandler.java com/kyee/nursestation/views/menu/bloodAdvice/remind/BloodPushRemindHandler.java com/kyee/nursestation/views/menu/bloodAdvice/remind/PrepareBloodTimer.java com/kyee/nursestation/views/menu/bloodAdvice/remind/RemindTimer.java
加密解密-> 信息摘要算法	com/kyee/apkupdate/MD5Util.java
网络通信-> HTTP请求、连接和会话	com/kyee/nursestation/utils/CommonUtil.java com/kyee/nursestation/utils/HttpUtils.java com/kyee/nursestation/utils/datacontrol/URLConnection.java
网络通信-> HTTP建立连接	显示文件 com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/utils/CommonUtil.java com/kyee/nursestation/utils/HttpUtils.java com/kyee/nursestation/utils/LoadUtil.java com/kyee/nursestation/utils/datacontrol/DataController.java com/kyee/nursestation/utils/datacontrol/URLConnection.java de/tavendo/autobahn/Wamp.java de/tavendo/autobahn/WampConnection.java de/tavendo/autobahn/WebSocketConnection.java
网络通信-> DefaultHttpClient Connection	显示文件 com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/utils/CommonUtil.java com/kyee/nursestation/utils/HttpUtils.java com/kyee/nursestation/utils/LoadUtil.java com/kyee/nursestation/utils/datacontrol/URLConnection.java
隐私数据-> 屏幕截图，截取自己应用内部界面	com/honeywell/test/ImagingView.java
一般功能-> 加载so文件	显示文件 com/example/Native/Native.java com/honeywell/decodemanager/barcode/Decoder.java com/honeywell/imagingmanager/Imaging.java com/honeywell/ioctl/HoneywellIOCTL.java com/hsm/barcode/Decoder.java
一般功能-> 获取系统服务(getSystemService)	显示文件 cn/com/kyee/KingYeeWebSocketClient.java com/honeywell/decodemanager/DecodeManager.java com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/controller/NurseStationActivity.java com/kyee/nursestation/utils/CommonUtil.java com/kyee/nursestation/utils/LoadUtil.java com/kyee/nursestation/utils/SoundManagerUtil.java com/kyee/nursestation/utils/createutil/widget/ComboBox.java com/kyee/nursestation/utils/datacontrol/DataController.java com/kyee/nursestation/utils/widget/SelectPicPopupWindow.java
一般功能-> 获取活动网路信息	com/kyee/apkupdate/AppUpdateUtil.java com/kyee/nursestation/utils/datacontrol/DataController.java
进程操作-> 获取运行的进程\服务	com/honeywell/decodemanager/DecodeManager.java com/kyee/nursestation/utils/LoadUtil.java
组件-> 发送广播	com/honeywell/decodemanager/DecodeManager.java com/kyee/nursestation/utils/scancontrol/ScanUtil_Motorola.java
进程操作-> 获取进程pid	com/honeywell/decodemanager/DecodeManager.java
一般功能-> 获取WiFi相关信息	cn/com/kyee/KingYeeWebSocketClient.java
进程操作-> 杀死进程	com/kyee/nursestation/global/CustomApplication.java
加密解密-> Crypto加解密组件	de/tavendo/autobahn/WampCraConnection.java
加密解密-> Base64 加密	de/tavendo/autobahn/WampCraConnection.java de/tavendo/autobahn/WebSocketWriter.java
网络通信-> TCP套接字	de/tavendo/autobahn/WebSocketReader.java de/tavendo/autobahn/WebSocketWriter.java
一般功能-> 设置手机铃声，媒体音量	com/kyee/nursestation/utils/SoundManagerUtil.java

安全漏洞检测

高危

1

警告

5

信息

1

安全

0

屏蔽

0

序号	问题	等级	参考标准	文件位置	操作
1	应用程序记录日志信息,不得记录敏感信息	信息	CWE: CWE-532: 通过日志文件的信息暴露 OWASP MASVS: MSTG-STORAGE-3	升级会员：解锁高级权限	对应用 com.kyee.mobilenursestation 屏蔽 android_logging 规则仅对这些文件屏蔽 android_logging 规则
2	文件可能包含硬编码的敏感信息，如用户名、密码、密钥等	警告	CWE: CWE-312: 明文存储敏感信息 OWASP Top 10: M9: Reverse Engineering OWASP MASVS: MSTG-STORAGE-14	升级会员：解锁高级权限	对应用 com.kyee.mobilenursestation 屏蔽 android_hardcoded 规则仅对这些文件屏蔽 android_hardcoded 规则
3	启用了调试配置。生产版本不能是可调试的	高危	CWE: CWE-919: 移动应用程序中的弱点 OWASP Top 10: M1: Improper Platform Usage OWASP MASVS: MSTG-RESILIENCE-2	升级会员：解锁高级权限	对应用 com.kyee.mobilenursestation 屏蔽 android_aar_jar_debug_enabled 规则仅对这些文件屏蔽 android_aar_jar_debug_enabled 规则
4	MD5是已知存在哈希冲突的弱哈希	警告	CWE: CWE-327: 使用已被攻破或存在风险的密码学算法 OWASP Top 10: M5: Insufficient Cryptography OWASP MASVS: MSTG-CRYPTO-4	升级会员：解锁高级权限	对应用 com.kyee.mobilenursestation 屏蔽 android_md5 规则仅对这些文件屏蔽 android_md5 规则
5	应用程序使用不安全的随机数生成器	警告	CWE: CWE-330: 使用不充分的随机数 OWASP Top 10: M5: Insufficient Cryptography OWASP MASVS: MSTG-CRYPTO-6	升级会员：解锁高级权限	对应用 com.kyee.mobilenursestation 屏蔽 android_insecure_random 规则仅对这些文件屏蔽 android_insecure_random 规则
6	应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据	警告	CWE: CWE-276: 默认权限不正确 OWASP Top 10: M2: Insecure Data Storage OWASP MASVS: MSTG-STORAGE-2	升级会员：解锁高级权限	对应用 com.kyee.mobilenursestation 屏蔽 android_read_write_external 规则仅对这些文件屏蔽 android_read_write_external 规则
7	应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库	警告	CWE: CWE-89: SQL命令中使用的特殊元素转义处理不恰当（'SQL 注入'） OWASP Top 10: M7: Client Code Quality	升级会员：解锁高级权限	对应用 com.kyee.mobilenursestation 屏蔽 android_sql_raw_query 规则仅对这些文件屏蔽 android_sql_raw_query 规则

Native库安全分析

No Shared Objects found.

序号	动态库	NX(堆栈禁止执行)	PIE	STACK CANARY(栈保护)	RELRO	RPATH（指定SO搜索路径）	RUNPATH（指定SO搜索路径）	FORTIFY(常用函数加强检查)	SYMBOLS STRIPPED(裁剪符号表)

文件分析

序号	问题	文件

敏感权限分析

恶意软件常用权限 6/30

android.permission.WAKE_LOCK
android.permission.VIBRATE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.CAMERA
android.permission.GET_TASKS

其它常用权限 7/46

android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MOUNT_FORMAT_FILESYSTEMS
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE

恶意软件常用权限 是被已知恶意软件广泛滥用的权限。
其它常用权限 是已知恶意软件经常滥用的权限。

IP地理位置

恶意域名检测

域名	状态	中国境内	位置信息	解析
api.wamp.ws	安全	否	IP地址: 89.31.143.90 国家: Germany 地区: Bayern 城市: Starnberg 查看: Google 地图

手机号提取

URL链接分析

URL信息	源码文件
http://132.147.160.62/CisServer/	com/kyee/nursestation/controller/UserLoginActivity.java
http://202.120.40.105:8001/CisServer/	com/kyee/nursestation/global/CustomApplication.java
http://api.wamp.ws/ http://api.wamp.ws/error# http://api.wamp.ws/error#generic http://api.wamp.ws/error#internal http://api.wamp.ws/procedure# http://api.wamp.ws/topic#	de/tavendo/autobahn/Wamp.java
http://api.wamp.ws/procedure#auth http://api.wamp.ws/procedure#authreq	de/tavendo/autobahn/WampCraConnection.java
https://git-wip-us.apache.org/repos/asf?p=incubator-cordova-android.git;a=blob;f=framework/res/xml/plugins.xml javascript:try{cordova.fireDocumentEvent('pause');}catch(e){console.log('exception http://api.wamp.ws/error#generic javascript:cordova.fireDocumentEvent('searchbutton'); http://logging.apache.org/log4j/1.2/faq.html#noconfig http://api.wamp.ws/topic# javascript:try{ http://132.147.160.62/CisServer/ http://api.wamp.ws/procedure# file:/// javascript:cordova.fireDocumentEvent('menubutton'); http://202.120.40.105:8001/CisServer/ http://api.wamp.ws/procedure#authreq http://logging.apache.org/log4j/1.2/faq.html#unload. javascript:try{cordova.require('cordova/channel').onDestroy.fire();}catch(e){console.log('exception http://api.wamp.ws/error# http://api.wamp.ws/procedure#auth javascript:try{cordova.fireDocumentEvent('resume');}catch(e){console.log('exception javascript:cordova.fireDocumentEvent('backbutton'); http://api.wamp.ws/ http://api.wamp.ws/error#internal	自研引擎分析结果

Firebase配置检测

邮箱地址提取

第三方追踪器

名称	类别	网址

敏感凭证泄露

已显示 4 个secrets

1、 "elder_nusing_username" : "姓名"
2、 "medicine_first_patlookuser" : "日常照顾者"
3、 "user_name" : "请输入用户名"
4、 "user_password" : "请输入密码"

字符串信息

建议导出为TXT，方便查看。

活动列表

显示 6 个 activities

服务列表

显示 4 个 services

广播接收者列表

显示 2 个 receivers

内容提供者列表

第三方SDK

SDK名称	开发者	描述信息
File Provider	Android	FileProvider 是 ContentProvider 的特殊子类，它通过创建 content://Uri 代替 file:///Uri 以促进安全分享与应用程序关联的文件。

污点分析

当apk较大时，代码量会很大，造成数据流图（ICFG）呈现爆炸式增长，所以该功能比较耗时，请先喝杯咖啡，耐心等待……

规则名称	描述信息	操作
病毒分析	使用安卓恶意软件常用的API进行污点分析	开始分析
漏洞挖掘	漏洞挖掘场景下的污点分析	开始分析
隐私合规	隐私合规场景下的污点分析：组件内污点传播、组件间污点传播、组件与库函数之间的污点传播	开始分析
密码分析	分析加密算法是否使用常量密钥、静态初始化的向量（IV）、加密模式是否使用ECB等	开始分析
Callback	因为Android中系统级的Callback并不会出现显式地进行回调方法的调用，所以如果需要分析Callback方法需要在声明文件中将其声明，这里提供一份AndroidCallbacks.txt文件，里面是一些常见的原生回调接口或类，如果有特殊接口需求，可以联系管理员	开始分析