问题描述

部署并使用工具cognicrypt_SAST

步骤

1、部署java环境，实测 17.0.19 可以

sdk install java 17.0.19-tem 
sdk use java 17.0.19-tem 

2、克隆仓库

git clone https://github.com/CROSSINGTUD/CryptoAnalysis.git

3、下载工具对应的jar包到项目主目录下面

# 从https://github.com/CROSSINGTUD/CryptoAnalysis/releases网址中下载
wget https://github.com/CROSSINGTUD/CryptoAnalysis/releases/download/5.0.1/HeadlessAndroidScanner-5.0.1-jar-with-dependencies.jar # 下载分析APK的包
wget https://github.com/CROSSINGTUD/CryptoAnalysis/releases/download/5.0.1/HeadlessJavaScanner-5.0.1-jar-with-dependencies.jar # 下载分析jar的包

其实也可以自己构建，项目目录下面运行

mvn clean package -DskipTests
# 输出会在 apps/ 目录下面

4、运行检测

将jar包、apk文件，规则文件夹（CogniCrypt_SAST/Crypto-API-Rules/JavaCryptographicArchitecture/src）提前准备好

# 检测jar包
java -jar HeadlessJavaScanner-x.y.z-jar-with-dependencies.jar \
  --appPath <YourApp.jar> \
  --rulesDir ./CrySL-Rules/ \
  --reportFormat CMD,SARIF \
  --reportPath ./output/
# 实际例子
java -jar \
/home/myeeygo/cryptographicTools/CogniCrypt_SAST/HeadlessJavaScanner-5.0.1-jar-with-dependencies.jar \
  --appPath /home/myeeygo/cryptographicTools/CogniCrypt_SAST/CryptoAnalysisTargets/CryptoMisuseExamples/target/CryptoMisuseExamples-0.0.1-SNAPSHOT.jar \
  --rulesDir /home/myeeygo/cryptographicTools/CogniCrypt_SAST/Crypto-API-Rules/JavaCryptographicArchitecture/src \
  --reportFormat CMD,SARIF \
  --reportPath ./output/

# 检测APK文件
java -jar HeadlessAndroidScanner-x.y.z-jar-with-dependencies.jar \
--apkFile <YourApp.apk> \
--platformDirectory <path_to_platforms_directory> 
--rulesDir ./CrySL-Rules/ \
--reportFormat CMD,SARIF \
--reportPath ./output/
# 例子
java -jar HeadlessAndroidScanner-5.0.1-jar-with-dependencies.jar \
--apkFile /home/myeeygo/cryptographicTools/CogniCrypt_SAST/apkc_myeeygo/test_build_app/two/build/app.apk \
--platformDirectory /home/myeeygo/android-sdk/platforms \
--rulesDir /home/myeeygo/cryptographicTools/CogniCrypt_SAST/Crypto-API-Rules/JavaCryptographicArchitecture/src \
--reportFormat CMD,SARIF \
--reportPath ./output/