Binary static analysis of application structure to identify vulnerabilities

A computing device for detecting vulnerabilities in a software package that includes two or more build files, the computing device comprising:

• one or more processors;
• a display;
• memory storing the software package;
• and
• a software vulnerability analysis application stored in memory and containing instructions that, when executed by the one or more processors, are to cause the processors to:
• receive electronic transmission of the software package at the computing device,
• unpackage, by the computing device, the software package to extract the two or more build files including an application file and one or more resource files,
• scan, by the computing device, the build files to identify strings, and based on that scan,
• label at least one of the identified strings as an orphaned string based on it appearing in one of the resource files and it not being referenced in the application file by:
• identifying said at least one of the identified strings in said one of the resource files;
• and
• scanning the application file for said at least one of the identified strings and determining that no match appears in the application file, and
• label at least one of the identified strings as a hardcoded string based on it appearing in the application file and not in any of the resource files, and
• output the detected vulnerabilities in the software package by displaying on the display a graphical user interface containing respective lists of the orphaned strings and the hardcoded strings.

A method of detecting vulnerabilities in a software package that includes two or more build files, the method comprising:

• receiving electronic transmission of the software package at a computing device;
• unpackaging, by the computing device, the software package to extract the two or more build files including an application file and one or more resource files;
• scanning, by the computing device, the build files to identify strings and based on that scanning
• labelling at least one of the identified strings as an orphaned string based on it appearing in one of the resource files and it not being referenced in the application file, and
• labelling at least one of the identified strings as a hardcoded string based on it appearing in the application file and not in any of the resource files by:
• identifying said at least one of the identified strings in the application file;
• and
• scanning the resource files for said at least one of the identified strings and determining that no match appears in the resource files;
• and
• outputting the detected vulnerabilities in the software package by displaying a graphical user interface containing respective lists of the orphaned strings and the hardcoded strings.

A computing device for detecting vulnerabilities in a software package that includes two or more build files, the computing device comprising:

• one or more processors;
• a display;
• memory storing the software package;
• and
• a software vulnerability analysis application stored in memory and containing instructions that, when executed by the one or more processors, are to cause the processors to:
• receive electronic transmission of the software package at the computing device,
• unpackage, by the computing device, the software package to extract the two or more build files including an application file and one or more resource files,
• scan, by the computing device, the build files to identify strings, and based on that scan,
• label at least one of the identified strings as an orphaned string based on it appearing in one of the resource files and it not being referenced in the application file, and
• label at least one of the identified strings as a hardcoded string based on it appearing in the application file and not in any of the resource files by:
• identifying said at least one of the identified strings in the application file;
• and
• scanning the resource files for said at least one of the identified strings and determining that no match appears in the resource files, and
• output the detected vulnerabilities in the software package by displaying on the display a graphical user interface containing respective lists of the orphaned strings and the hardcoded strings.