automatic import of python-quark-engine

3 files changed, 482 insertions, 0 deletions

diff --git a/.gitignore b/.gitignore
index e69de29..e62547a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1 @@
+/quark-engine-23.3.1.tar.gz
diff --git a/python-quark-engine.spec b/python-quark-engine.spec
new file mode 100644
index 0000000..c2db8a0
--- /dev/null
+++ b/python-quark-engine.spec
@@ -0,0 +1,480 @@
+%global _empty_manifest_terminate_build 0
+Name:		python-quark-engine
+Version:	23.3.1
+Release:	1
+Summary:	An Obfuscation-Neglect Android Malware Scoring System
+License:	GNU General Public License v3 (GPLv3)
+URL:		https://github.com/quark-engine/quark-engine
+Source0:	https://mirrors.nju.edu.cn/pypi/web/packages/e2/68/ff845f0740e3ab05b10abfd97712420885fc907df1249474a6966cf2e67c/quark-engine-23.3.1.tar.gz
+BuildArch:	noarch
+
+Requires:	python3-prettytable
+Requires:	python3-androguard
+Requires:	python3-tqdm
+Requires:	python3-colorama
+Requires:	python3-graphviz
+Requires:	python3-prompt-toolkit
+Requires:	python3-plotly
+Requires:	python3-rzpipe
+Requires:	python3-click
+
+%description
+<p align="center">
+    <a href="https://www.blackhat.com/asia-21/arsenal/schedule/index.html#quark-engine-storyteller-of-android-malware-22458">
+        <img alt="Black Hat Arsenal" src="https://img.shields.io/badge/Black%20Hat%20Arsenal-Asia%202021-blue">
+    </a>
+    <a href="https://conference.hitb.org/hitb-lockdown002/sessions/quark-engine-an-obfuscation-neglect-android-malware-scoring-system/">
+        <img alt="HITB" src="https://img.shields.io/badge/HITB-Lockdown%20002-red">
+    </a>
+    <a href="https://www.youtube.com/watch?v=SOH4eqrv9_g&ab_channel=ROOTCONHackingConference">
+        <img alt="rootcon" src="https://img.shields.io/badge/ROOTCON-2020-orange">
+    </a>
+    <a href="https://www.youtube.com/watch?v=XK-yqHPnsvc&ab_channel=DEFCONConference">
+        <img alt="defcon" src="https://img.shields.io/badge/DEFCON%2028-BTV-blue">
+    </a><br>
+    <a href="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml">
+        <img alt="build status" src="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml/badge.svg">
+    </a>
+    <a href="https://codecov.io/gh/quark-engine/quark-engine">
+        <img alt="codecov" src="https://codecov.io/gh/quark-engine/quark-engine/branch/master/graph/badge.svg">
+    </a>
+    <a href="https://github.com/18z/quark-rules/blob/master/LICENSE">
+        <img alt="license" src="https://img.shields.io/badge/License-GPLv3-blue.svg">
+    </a>
+    <a href="https://www.python.org/downloads/release/python-360/">
+        <img alt="python version" src="https://img.shields.io/badge/python-3.8-blue.svg">
+    </a>
+    <a href="https://pypi.org/project/quark-engine/">
+        <img alt="PyPi Download" src="https://pepy.tech/badge/quark-engine">
+    </a><br>
+    <a href="https://twitter.com/quarkengine">
+        <img alt="Twitter" src="https://img.shields.io/twitter/follow/quarkengine?style=social">
+    </a><br>
+    <img src="https://i.imgur.com/8GwkWei.png"/>
+</p>
+
+# Quark Script - Dig Vulnerabilities in the BlackBox
+
+### Innovative & Interactive
+
+*   The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or **pentest** the targets.
+*   Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers to **interact** with staged results and perform **creative** analysis with Quark Script.
+
+### Dynamic & Static Analysis
+
+*   In Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g. [objection](https://github.com/sensepost/objection)).
+
+### Re-Usable & Sharable
+
+*   Once the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges.
+
+### More APIs to come
+
+*   Quark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios.
+*   **See API document [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#introduce-of-quark-script-apis).**
+
+# CWE Showcases
+*   [CWE-020](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-20-in-android-application-diva-apk)  Improper Input Validation 
+*   [CWE-022](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-22-in-android-application-ovaa-apk-and-insecurebankv2-apk)  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 
+*   [CWE-023](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-23-in-android-application-ovaa-apk-and-insecurebankv2-apk)  Relative Path Traversal
+*   [CWE-089](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-89-in-android-application-androgoat-apk)  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 
+*   [CWE-094](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-94-in-android-application-ovaa-apk)  Improper Control of Generation of Code ('Code Injection') 
+*   [CWE-295](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-295-in-android-application-insecureshop-apk)  Improper Certificate Validation 
+*   [CWE-312](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-312-in-android-application-ovaa-apk)  Cleartext Storage of Sensitive Information 
+*   [CWE-319](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-319-in-android-application-ovaa-apk)  Cleartext Transmission of Sensitive Information 
+*   [CWE-327](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-327-in-android-application-injuredandroid-apk)  Use of a Broken or Risky Cryptographic Algorithm 
+*   [CWE-328](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-328-in-android-application-allsafe-apk)  Use of Weak Hash 
+*   [CWE-338](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-338-in-android-application-pivva-apk)  Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 
+*   [CWE-489](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-489-in-android-application-allsafe-apk-androgoat-apk-pivaa-apk)  Active Debug Code 
+*   [CWE-532](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-532-in-android-application-dvba-apk)  Insertion of Sensitive Information into Log File 
+*   [CWE-749](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-749-in-android-application-mstg-android-java-apk)  Exposed Dangerous Method or Function 
+*   [CWE-780](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-780-in-android-application-mstg-android-java-apk)  Use of RSA Algorithm without OAEP 
+*   [CWE-798](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk)  Use of Hard-coded Credentials 
+*   [CWE-921](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-921-in-android-application-ovaa-apk)  Storage of Sensitive Data in a Mechanism without Access Control 
+*   [CWE-926](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-926-in-android-application-dvba-apk)  Improper Export of Android Application Components 
+ 
+# Quick Start
+
+In this section, we will show how to detect CWE-798 with Quark Script.
+
+### Step 1: Environments Requirements
+
+*   Quark requires Python 3.8 or above.
+
+### Step 2: Install Quark Engine
+
+*   Install Quark Engine by running:
+
+```bash
+$ pip3 install -U quark-engine
+```
+
+### Step 3: Prepare Quark Script, Detection Rule and the Sample File
+
+1.  Get the CWE-798 Quark Script and the detection rule [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk).
+2.  Get the sampe file (ovaa.apk) [here](https://github.com/dark-warlord14/ovaa/releases/tag/1.0).
+3.  Put the script, detection rule, and sample file in the same directory.
+4.  Edit accordingly to the file names:
+
+```bash
+SAMPLE_PATH = "ovaa.apk"
+RULE_PATH = "findSecretKeySpec.json"
+# Now you are ready to run the script!
+```
+
+### Step 4: Run the script
+
+```bash
+$ python3 CWE-798.py
+
+# You should now see the detection result in the terminal.
+Found hard-coded AES key 49u5gh249gh24985ghf429gh4ch8f23f
+```
+
+*   **Check the [document](https://quark-engine.readthedocs.io/en/latest/quark_script.html#quark-script) for more examples.**
+
+# Acknowledgments
+
+### The Honeynet Project
+
+<a href="https://www.honeynet.org"> <img style="border: 0.2px solid black" width=115 height=150 src="https://i.imgur.com/znu7cMJ.png" alt="Honeynet.org logo"> </a>
+
+### Google Summer Of Code
+
+Quark-Engine has been participating in the GSoC under the Honeynet Project!
+
+*   2021:
+    *   [YuShiang Dang](https://twitter.com/YushianhD): [New Rule Generation Technique & Make Quark Everywhere Among Security Open Source Projects](https://quark-engine.github.io/2021/08/17/GSoC-2021-YuShiangDang/)
+    *   [Sheng-Feng Lu](https://twitter.com/haeter525): [Replace the core library of Quark-Engine](https://quark-engine.github.io/2021/08/17/GSoC-2021-ShengFengLu/)
+
+Stay tuned for the upcoming GSoC! Join the [Honeynet Slack chat](https://gsoc-slack.honeynet.org/) for more info.
+
+# Core Values of Quark Engine Team
+
+*   We love **battle fields**. We embrace **uncertainties**. We challenge **impossibles**. We **rethink** everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others **first**.
+
+
+%package -n python3-quark-engine
+Summary:	An Obfuscation-Neglect Android Malware Scoring System
+Provides:	python-quark-engine
+BuildRequires:	python3-devel
+BuildRequires:	python3-setuptools
+BuildRequires:	python3-pip
+%description -n python3-quark-engine
+<p align="center">
+    <a href="https://www.blackhat.com/asia-21/arsenal/schedule/index.html#quark-engine-storyteller-of-android-malware-22458">
+        <img alt="Black Hat Arsenal" src="https://img.shields.io/badge/Black%20Hat%20Arsenal-Asia%202021-blue">
+    </a>
+    <a href="https://conference.hitb.org/hitb-lockdown002/sessions/quark-engine-an-obfuscation-neglect-android-malware-scoring-system/">
+        <img alt="HITB" src="https://img.shields.io/badge/HITB-Lockdown%20002-red">
+    </a>
+    <a href="https://www.youtube.com/watch?v=SOH4eqrv9_g&ab_channel=ROOTCONHackingConference">
+        <img alt="rootcon" src="https://img.shields.io/badge/ROOTCON-2020-orange">
+    </a>
+    <a href="https://www.youtube.com/watch?v=XK-yqHPnsvc&ab_channel=DEFCONConference">
+        <img alt="defcon" src="https://img.shields.io/badge/DEFCON%2028-BTV-blue">
+    </a><br>
+    <a href="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml">
+        <img alt="build status" src="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml/badge.svg">
+    </a>
+    <a href="https://codecov.io/gh/quark-engine/quark-engine">
+        <img alt="codecov" src="https://codecov.io/gh/quark-engine/quark-engine/branch/master/graph/badge.svg">
+    </a>
+    <a href="https://github.com/18z/quark-rules/blob/master/LICENSE">
+        <img alt="license" src="https://img.shields.io/badge/License-GPLv3-blue.svg">
+    </a>
+    <a href="https://www.python.org/downloads/release/python-360/">
+        <img alt="python version" src="https://img.shields.io/badge/python-3.8-blue.svg">
+    </a>
+    <a href="https://pypi.org/project/quark-engine/">
+        <img alt="PyPi Download" src="https://pepy.tech/badge/quark-engine">
+    </a><br>
+    <a href="https://twitter.com/quarkengine">
+        <img alt="Twitter" src="https://img.shields.io/twitter/follow/quarkengine?style=social">
+    </a><br>
+    <img src="https://i.imgur.com/8GwkWei.png"/>
+</p>
+
+# Quark Script - Dig Vulnerabilities in the BlackBox
+
+### Innovative & Interactive
+
+*   The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or **pentest** the targets.
+*   Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers to **interact** with staged results and perform **creative** analysis with Quark Script.
+
+### Dynamic & Static Analysis
+
+*   In Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g. [objection](https://github.com/sensepost/objection)).
+
+### Re-Usable & Sharable
+
+*   Once the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges.
+
+### More APIs to come
+
+*   Quark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios.
+*   **See API document [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#introduce-of-quark-script-apis).**
+
+# CWE Showcases
+*   [CWE-020](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-20-in-android-application-diva-apk)  Improper Input Validation 
+*   [CWE-022](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-22-in-android-application-ovaa-apk-and-insecurebankv2-apk)  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 
+*   [CWE-023](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-23-in-android-application-ovaa-apk-and-insecurebankv2-apk)  Relative Path Traversal
+*   [CWE-089](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-89-in-android-application-androgoat-apk)  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 
+*   [CWE-094](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-94-in-android-application-ovaa-apk)  Improper Control of Generation of Code ('Code Injection') 
+*   [CWE-295](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-295-in-android-application-insecureshop-apk)  Improper Certificate Validation 
+*   [CWE-312](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-312-in-android-application-ovaa-apk)  Cleartext Storage of Sensitive Information 
+*   [CWE-319](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-319-in-android-application-ovaa-apk)  Cleartext Transmission of Sensitive Information 
+*   [CWE-327](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-327-in-android-application-injuredandroid-apk)  Use of a Broken or Risky Cryptographic Algorithm 
+*   [CWE-328](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-328-in-android-application-allsafe-apk)  Use of Weak Hash 
+*   [CWE-338](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-338-in-android-application-pivva-apk)  Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 
+*   [CWE-489](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-489-in-android-application-allsafe-apk-androgoat-apk-pivaa-apk)  Active Debug Code 
+*   [CWE-532](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-532-in-android-application-dvba-apk)  Insertion of Sensitive Information into Log File 
+*   [CWE-749](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-749-in-android-application-mstg-android-java-apk)  Exposed Dangerous Method or Function 
+*   [CWE-780](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-780-in-android-application-mstg-android-java-apk)  Use of RSA Algorithm without OAEP 
+*   [CWE-798](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk)  Use of Hard-coded Credentials 
+*   [CWE-921](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-921-in-android-application-ovaa-apk)  Storage of Sensitive Data in a Mechanism without Access Control 
+*   [CWE-926](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-926-in-android-application-dvba-apk)  Improper Export of Android Application Components 
+ 
+# Quick Start
+
+In this section, we will show how to detect CWE-798 with Quark Script.
+
+### Step 1: Environments Requirements
+
+*   Quark requires Python 3.8 or above.
+
+### Step 2: Install Quark Engine
+
+*   Install Quark Engine by running:
+
+```bash
+$ pip3 install -U quark-engine
+```
+
+### Step 3: Prepare Quark Script, Detection Rule and the Sample File
+
+1.  Get the CWE-798 Quark Script and the detection rule [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk).
+2.  Get the sampe file (ovaa.apk) [here](https://github.com/dark-warlord14/ovaa/releases/tag/1.0).
+3.  Put the script, detection rule, and sample file in the same directory.
+4.  Edit accordingly to the file names:
+
+```bash
+SAMPLE_PATH = "ovaa.apk"
+RULE_PATH = "findSecretKeySpec.json"
+# Now you are ready to run the script!
+```
+
+### Step 4: Run the script
+
+```bash
+$ python3 CWE-798.py
+
+# You should now see the detection result in the terminal.
+Found hard-coded AES key 49u5gh249gh24985ghf429gh4ch8f23f
+```
+
+*   **Check the [document](https://quark-engine.readthedocs.io/en/latest/quark_script.html#quark-script) for more examples.**
+
+# Acknowledgments
+
+### The Honeynet Project
+
+<a href="https://www.honeynet.org"> <img style="border: 0.2px solid black" width=115 height=150 src="https://i.imgur.com/znu7cMJ.png" alt="Honeynet.org logo"> </a>
+
+### Google Summer Of Code
+
+Quark-Engine has been participating in the GSoC under the Honeynet Project!
+
+*   2021:
+    *   [YuShiang Dang](https://twitter.com/YushianhD): [New Rule Generation Technique & Make Quark Everywhere Among Security Open Source Projects](https://quark-engine.github.io/2021/08/17/GSoC-2021-YuShiangDang/)
+    *   [Sheng-Feng Lu](https://twitter.com/haeter525): [Replace the core library of Quark-Engine](https://quark-engine.github.io/2021/08/17/GSoC-2021-ShengFengLu/)
+
+Stay tuned for the upcoming GSoC! Join the [Honeynet Slack chat](https://gsoc-slack.honeynet.org/) for more info.
+
+# Core Values of Quark Engine Team
+
+*   We love **battle fields**. We embrace **uncertainties**. We challenge **impossibles**. We **rethink** everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others **first**.
+
+
+%package help
+Summary:	Development documents and examples for quark-engine
+Provides:	python3-quark-engine-doc
+%description help
+<p align="center">
+    <a href="https://www.blackhat.com/asia-21/arsenal/schedule/index.html#quark-engine-storyteller-of-android-malware-22458">
+        <img alt="Black Hat Arsenal" src="https://img.shields.io/badge/Black%20Hat%20Arsenal-Asia%202021-blue">
+    </a>
+    <a href="https://conference.hitb.org/hitb-lockdown002/sessions/quark-engine-an-obfuscation-neglect-android-malware-scoring-system/">
+        <img alt="HITB" src="https://img.shields.io/badge/HITB-Lockdown%20002-red">
+    </a>
+    <a href="https://www.youtube.com/watch?v=SOH4eqrv9_g&ab_channel=ROOTCONHackingConference">
+        <img alt="rootcon" src="https://img.shields.io/badge/ROOTCON-2020-orange">
+    </a>
+    <a href="https://www.youtube.com/watch?v=XK-yqHPnsvc&ab_channel=DEFCONConference">
+        <img alt="defcon" src="https://img.shields.io/badge/DEFCON%2028-BTV-blue">
+    </a><br>
+    <a href="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml">
+        <img alt="build status" src="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml/badge.svg">
+    </a>
+    <a href="https://codecov.io/gh/quark-engine/quark-engine">
+        <img alt="codecov" src="https://codecov.io/gh/quark-engine/quark-engine/branch/master/graph/badge.svg">
+    </a>
+    <a href="https://github.com/18z/quark-rules/blob/master/LICENSE">
+        <img alt="license" src="https://img.shields.io/badge/License-GPLv3-blue.svg">
+    </a>
+    <a href="https://www.python.org/downloads/release/python-360/">
+        <img alt="python version" src="https://img.shields.io/badge/python-3.8-blue.svg">
+    </a>
+    <a href="https://pypi.org/project/quark-engine/">
+        <img alt="PyPi Download" src="https://pepy.tech/badge/quark-engine">
+    </a><br>
+    <a href="https://twitter.com/quarkengine">
+        <img alt="Twitter" src="https://img.shields.io/twitter/follow/quarkengine?style=social">
+    </a><br>
+    <img src="https://i.imgur.com/8GwkWei.png"/>
+</p>
+
+# Quark Script - Dig Vulnerabilities in the BlackBox
+
+### Innovative & Interactive
+
+*   The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or **pentest** the targets.
+*   Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers to **interact** with staged results and perform **creative** analysis with Quark Script.
+
+### Dynamic & Static Analysis
+
+*   In Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g. [objection](https://github.com/sensepost/objection)).
+
+### Re-Usable & Sharable
+
+*   Once the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges.
+
+### More APIs to come
+
+*   Quark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios.
+*   **See API document [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#introduce-of-quark-script-apis).**
+
+# CWE Showcases
+*   [CWE-020](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-20-in-android-application-diva-apk)  Improper Input Validation 
+*   [CWE-022](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-22-in-android-application-ovaa-apk-and-insecurebankv2-apk)  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 
+*   [CWE-023](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-23-in-android-application-ovaa-apk-and-insecurebankv2-apk)  Relative Path Traversal
+*   [CWE-089](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-89-in-android-application-androgoat-apk)  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 
+*   [CWE-094](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-94-in-android-application-ovaa-apk)  Improper Control of Generation of Code ('Code Injection') 
+*   [CWE-295](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-295-in-android-application-insecureshop-apk)  Improper Certificate Validation 
+*   [CWE-312](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-312-in-android-application-ovaa-apk)  Cleartext Storage of Sensitive Information 
+*   [CWE-319](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-319-in-android-application-ovaa-apk)  Cleartext Transmission of Sensitive Information 
+*   [CWE-327](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-327-in-android-application-injuredandroid-apk)  Use of a Broken or Risky Cryptographic Algorithm 
+*   [CWE-328](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-328-in-android-application-allsafe-apk)  Use of Weak Hash 
+*   [CWE-338](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-338-in-android-application-pivva-apk)  Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 
+*   [CWE-489](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-489-in-android-application-allsafe-apk-androgoat-apk-pivaa-apk)  Active Debug Code 
+*   [CWE-532](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-532-in-android-application-dvba-apk)  Insertion of Sensitive Information into Log File 
+*   [CWE-749](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-749-in-android-application-mstg-android-java-apk)  Exposed Dangerous Method or Function 
+*   [CWE-780](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-780-in-android-application-mstg-android-java-apk)  Use of RSA Algorithm without OAEP 
+*   [CWE-798](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk)  Use of Hard-coded Credentials 
+*   [CWE-921](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-921-in-android-application-ovaa-apk)  Storage of Sensitive Data in a Mechanism without Access Control 
+*   [CWE-926](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-926-in-android-application-dvba-apk)  Improper Export of Android Application Components 
+ 
+# Quick Start
+
+In this section, we will show how to detect CWE-798 with Quark Script.
+
+### Step 1: Environments Requirements
+
+*   Quark requires Python 3.8 or above.
+
+### Step 2: Install Quark Engine
+
+*   Install Quark Engine by running:
+
+```bash
+$ pip3 install -U quark-engine
+```
+
+### Step 3: Prepare Quark Script, Detection Rule and the Sample File
+
+1.  Get the CWE-798 Quark Script and the detection rule [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk).
+2.  Get the sampe file (ovaa.apk) [here](https://github.com/dark-warlord14/ovaa/releases/tag/1.0).
+3.  Put the script, detection rule, and sample file in the same directory.
+4.  Edit accordingly to the file names:
+
+```bash
+SAMPLE_PATH = "ovaa.apk"
+RULE_PATH = "findSecretKeySpec.json"
+# Now you are ready to run the script!
+```
+
+### Step 4: Run the script
+
+```bash
+$ python3 CWE-798.py
+
+# You should now see the detection result in the terminal.
+Found hard-coded AES key 49u5gh249gh24985ghf429gh4ch8f23f
+```
+
+*   **Check the [document](https://quark-engine.readthedocs.io/en/latest/quark_script.html#quark-script) for more examples.**
+
+# Acknowledgments
+
+### The Honeynet Project
+
+<a href="https://www.honeynet.org"> <img style="border: 0.2px solid black" width=115 height=150 src="https://i.imgur.com/znu7cMJ.png" alt="Honeynet.org logo"> </a>
+
+### Google Summer Of Code
+
+Quark-Engine has been participating in the GSoC under the Honeynet Project!
+
+*   2021:
+    *   [YuShiang Dang](https://twitter.com/YushianhD): [New Rule Generation Technique & Make Quark Everywhere Among Security Open Source Projects](https://quark-engine.github.io/2021/08/17/GSoC-2021-YuShiangDang/)
+    *   [Sheng-Feng Lu](https://twitter.com/haeter525): [Replace the core library of Quark-Engine](https://quark-engine.github.io/2021/08/17/GSoC-2021-ShengFengLu/)
+
+Stay tuned for the upcoming GSoC! Join the [Honeynet Slack chat](https://gsoc-slack.honeynet.org/) for more info.
+
+# Core Values of Quark Engine Team
+
+*   We love **battle fields**. We embrace **uncertainties**. We challenge **impossibles**. We **rethink** everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others **first**.
+
+
+%prep
+%autosetup -n quark-engine-23.3.1
+
+%build
+%py3_build
+
+%install
+%py3_install
+install -d -m755 %{buildroot}/%{_pkgdocdir}
+if [ -d doc ]; then cp -arf doc %{buildroot}/%{_pkgdocdir}; fi
+if [ -d docs ]; then cp -arf docs %{buildroot}/%{_pkgdocdir}; fi
+if [ -d example ]; then cp -arf example %{buildroot}/%{_pkgdocdir}; fi
+if [ -d examples ]; then cp -arf examples %{buildroot}/%{_pkgdocdir}; fi
+pushd %{buildroot}
+if [ -d usr/lib ]; then
+	find usr/lib -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+if [ -d usr/lib64 ]; then
+	find usr/lib64 -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+if [ -d usr/bin ]; then
+	find usr/bin -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+if [ -d usr/sbin ]; then
+	find usr/sbin -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+touch doclist.lst
+if [ -d usr/share/man ]; then
+	find usr/share/man -type f -printf "/%h/%f.gz\n" >> doclist.lst
+fi
+popd
+mv %{buildroot}/filelist.lst .
+mv %{buildroot}/doclist.lst .
+
+%files -n python3-quark-engine -f filelist.lst
+%dir %{python3_sitelib}/*
+
+%files help -f doclist.lst
+%{_docdir}/*
+
+%changelog
+* Wed Apr 12 2023 Python_Bot <Python_Bot@openeuler.org> - 23.3.1-1
+- Package Spec generated
diff --git a/sources b/sources
new file mode 100644
index 0000000..f1d3733
--- /dev/null
+++ b/sources
@@ -0,0 +1 @@
+40e536231fa01608f790f30bf3b05073  quark-engine-23.3.1.tar.gz