mescloud/_apk_work/extract_strings.py

# -*- coding: utf-8 -*-
import os, re, sys, collections

DEX_DIR = r"D:\IdeaProjects\mes-ahdy\mescloud\_apk_work\unzipped"
OUT = r"D:\IdeaProjects\mes-ahdy\mescloud\_apk_work\extracted"
os.makedirs(OUT, exist_ok=True)

CN = re.compile(r"[\u4e00-\u9fff]{2,}")
# printable ascii strings
ASCII = re.compile(rb"[\x20-\x7e]{6,}")
UTF16 = re.compile(rb"(?:[\x20-\x7e]\x00){4,}")

keywords = (
    "Activity", "Fragment", "menu", "Menu", "pda", "PDA", "http", "mes",
    "scan", "Scan", "login", "Login", "com.", "/a/", "api"
)

all_cn = collections.Counter()
ascii_hits = collections.Counter()
utf16_cn = collections.Counter()
urls = set()
classes = set()

def walk_files():
    for root, dirs, files in os.walk(DEX_DIR):
        for f in files:
            p = os.path.join(root, f)
            if f.endswith((".dex", ".xml", ".lst", ".txt", ".properties")) or "classes" in f:
                yield p
            elif f.endswith(".arsc"):
                yield p

for path in walk_files():
    data = open(path, "rb").read()
    # utf-8 / latin
    try:
        text = data.decode("utf-8", "ignore")
    except Exception:
        text = ""
    for m in CN.findall(text):
        if 2 <= len(m) <= 40:
            all_cn[m] += 1
    for m in ASCII.findall(data):
        s = m.decode("ascii", "ignore")
        if any(k in s for k in keywords):
            ascii_hits[s] += 1
        if s.startswith("http") or s.startswith("/a/") or "mes/" in s:
            urls.add(s)
        if "Activity" in s or "Fragment" in s:
            classes.add(s)
    for m in UTF16.findall(data):
        try:
            s = m.decode("utf-16le", "ignore")
        except Exception:
            continue
        for c in CN.findall(s):
            if 2 <= len(c) <= 40:
                utf16_cn[c] += 1
        if s.startswith("http") or "/a/" in s:
            urls.add(s)

def dump(name, items, n=None):
    path = os.path.join(OUT, name)
    with open(path, "w", encoding="utf-8") as f:
        for i, item in enumerate(items):
            if n is not None and i >= n:
                break
            if isinstance(item, tuple):
                f.write("%s\t%s\n" % (item[0], item[1]))
            else:
                f.write("%s\n" % item)
    print("wrote", path, "count", min(len(items), n or len(items)))

dump("cn_strings.txt", all_cn.most_common())
dump("utf16_cn.txt", utf16_cn.most_common())
dump("ascii_hits.txt", ascii_hits.most_common(3000))
dump("urls.txt", sorted(urls))
dump("classes.txt", sorted(classes))
print("cn unique", len(all_cn), "utf16 unique", len(utf16_cn), "urls", len(urls), "classes", len(classes))