Check for Android 5.x lockscreen vulnerability - CVE-2015-3860

[Fuzion24]

http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-bypass/
this is patched by https://android.googlesource.com/platform/frameworks/base/+/8fba7e6931245a17215e0e740e78b45f6b66d590

One possible idea: Include an AXML in the application, open framework-res parse the relevant axml and check for the existence of android:maxLength="500"

[edgarvperes]

The relevant xml layout file is actually located in SystemUI.apk.

[Fuzion24]

Yea, the problem here is that there are no good on device axml parsing libraries available.
All of the third party libraries that I've looked at are a bit janky/fragile.

Input is definitely welcome here.

[edgarvperes]

I think the AXML parsing code from Apktool(https://github.com/iBotPeaches/Apktool) is good enough (it was able to properly convert the keyguard_password_view.xml from CM13 to a regular XML).
I'm not familiar with that project, but the relevant class seems to be "brut.apktool/apktool-lib/src/main/java/brut/androlib/res/decoder/AXmlResourceParser.java".

[Fuzion24]

That code doesn't implement pull parsing. You'd have to write it out to a file somewhere and then read it back in with some standard xml parsing.

I have a fork of that code that does this, but it is kind of defunct at this point.

[edgarvperes]

Is there anything particularly wrong with https://github.com/xgouchet/AXML?
I managed to create a vulnerability test in a separated project using that library.
If that's acceptable I can try to fork this project and submit a pull request later but I'm not sure how to include the AXML licence (I think it needs to be included in some sort of About screen, doesn't it?).

[Fuzion24]

The license is MIT, so there is no conflict with the license here. If you wanted to open a pull request, I'd be happy to look at it and merge it.

Cheers,
Ryan

[edgarvperes]

I mean, I think we should provide attribution to the author of the library and include its license in some activity in the APK, not only in the source code.
Here's some discussion on that subject:
https://www.quora.com/Does-the-MIT-license-require-attribution-in-a-binary-only-distribution

[Fuzion24]

Sure. I'll leave that to your discretion.