Info Call to dynamic code loading API

Description

List of all dynamic code loading API calls in the application. Loading code from untrsuted sources could allow the execution of malicious code in the context of the current application.

Recommendation

This entry is informative, no recommendations applicable.

Technical details

Method com.microsoft.appcenter.utils.storage.StorageHelper$InternalStorage.read() calling method java.lang.System.getProperty()


    public static String read(java.io.File p8)
    {
        try {
            java.io.BufferedReader v4_1 = new java.io.BufferedReader(new java.io.FileReader(p8));
            try {
                String v3 = System.getProperty("line.separator");
                StringBuilder v0_1 = new StringBuilder();
            } catch (String v5_1) {
                v4_1.close();
                throw v5_1;
            }
            while(true) {
                String v2 = v4_1.readLine();
                if (v2 == null) {
                    break;
                }
                v0_1.append(v2).append(v3);
            }
            v4_1.close();
            String v5_2 = v0_1.toString();
            return v5_2;
        } catch (java.io.IOException v1) {
            com.microsoft.appcenter.utils.AppCenterLog.error("AppCenter", new StringBuilder().append("Could not read file ").append(p8.getAbsolutePath()).toString(), v1);
            v5_2 = 0;
            return v5_2;
        }
    }

Method android.support.multidex.MultiDex.install() calling method java.lang.System.getProperty()


    public static void install(android.content.Context p11)
    {
        android.util.Log.i("MultiDex", "install");
        if (!android.support.multidex.MultiDex.IS_VM_MULTIDEX_CAPABLE) {
            if (android.os.Build$VERSION.SDK_INT >= 4) {
                try {
                    android.content.pm.ApplicationInfo v1 = android.support.multidex.MultiDex.getApplicationInfo(p11);
                } catch (RuntimeException v3_0) {
                    android.util.Log.e("MultiDex", "Multidex installation failure", v3_0);
                    throw new RuntimeException(new StringBuilder().append("Multi dex installation failed (").append(v3_0.getMessage()).append(").").toString());
                }
                if (v1 != null) {
                    String v0 = v1.sourceDir;
                    if (!android.support.multidex.MultiDex.installedApk.contains(v0)) {
                        android.support.multidex.MultiDex.installedApk.add(v0);
                        if (android.os.Build$VERSION.SDK_INT > 20) {
                            android.util.Log.w("MultiDex", new StringBuilder().append("MultiDex is not guaranteed to work in SDK version ").append(android.os.Build$VERSION.SDK_INT).append(": SDK version higher than ").append(20).append(" should be backed by ").append("runtime with built-in multidex capabilty but it\'s not the ").append("case here: java.vm.version=\"").append(System.getProperty("java.vm.version")).append("\"").toString());
                        }
                        try {
                            ClassLoader v5 = p11.getClassLoader();
                        } catch (RuntimeException v3_1) {
                            android.util.Log.w("MultiDex", "Failure while trying to obtain Context class loader. Must be running in test mode. Skip patching.", v3_1);
                        }
                        if (v5 != null) {
                            try {
                                android.support.multidex.MultiDex.clearOldDexDir(p11);
                            } catch (Throwable v6) {
                                android.util.Log.w("MultiDex", "Something went wrong when trying to clear old MultiDex extraction, continuing without cleaning.", v6);
                            }
                            java.io.File v2_1 = new java.io.File(v1.dataDir, android.support.multidex.MultiDex.SECONDARY_FOLDER_NAME);
                            java.util.List v4_0 = android.support.multidex.MultiDexExtractor.load(p11, v1, v2_1, 0);
                            if (!android.support.multidex.MultiDex.checkValidZipFiles(v4_0)) {
                                android.util.Log.w("MultiDex", "Files were not valid zip files.  Forcing a reload.");
                                java.util.List v4_1 = android.support.multidex.MultiDexExtractor.load(p11, v1, v2_1, 1);
                                if (!android.support.multidex.MultiDex.checkValidZipFiles(v4_1)) {
                                    throw new RuntimeException("Zip files were not valid.");
                                } else {
                                    android.support.multidex.MultiDex.installSecondaryDexes(v5, v2_1, v4_1);
                                }
                            } else {
                                android.support.multidex.MultiDex.installSecondaryDexes(v5, v2_1, v4_0);
                            }
                            android.util.Log.i("MultiDex", "install done");
                        } else {
                            android.util.Log.e("MultiDex", "Context class loader is null. Must be running in test mode. Skip patching.");
                        }
                    } else {
                    }
                }
            } else {
                throw new RuntimeException(new StringBuilder().append("Multi dex installation failed. SDK ").append(android.os.Build$VERSION.SDK_INT).append(" is unsupported. Min SDK version is ").append(4).append(".").toString());
            }
        } else {
            android.util.Log.i("MultiDex", "VM has multidex support, MultiDex support library is disabled.");
        }
        return;
    }

Method android.support.multidex.MultiDex.<clinit>() calling method java.lang.System.getProperty()


    static MultiDex()
    {
        android.support.multidex.MultiDex.SECONDARY_FOLDER_NAME = new StringBuilder().append("code_cache").append(java.io.File.separator).append("secondary-dexes").toString();
        android.support.multidex.MultiDex.installedApk = new java.util.HashSet();
        android.support.multidex.MultiDex.IS_VM_MULTIDEX_CAPABLE = android.support.multidex.MultiDex.isVMMultidexCapable(System.getProperty("java.vm.version"));
        return;
    }

Method mono.MonoPackageManager.LoadApplication() calling method java.lang.System.loadLibrary()


    public static void LoadApplication(android.content.Context p11, android.content.pm.ApplicationInfo p12, String[] p13)
    {
        try {
            if ((p11 instanceof android.app.Application)) {
                mono.MonoPackageManager.Context = p11;
            }
        } catch (int v0_2) {
            throw v0_2;
        }
        if (!mono.MonoPackageManager.initialized) {
            p11.registerReceiver(new mono.android.app.NotifyTimeZoneChanges(), new android.content.IntentFilter("android.intent.action.TIMEZONE_CHANGED"));
            System.loadLibrary("monodroid");
            int v0_4 = java.util.Locale.getDefault();
            int v0_7 = new StringBuilder().append(v0_4.getLanguage()).append("-").append(v0_4.getCountry()).toString();
            String[] v1_7 = p11.getFilesDir().getAbsolutePath();
            String[] v5_0 = p11.getCacheDir().getAbsolutePath();
            String[] v6_0 = mono.MonoPackageManager.getNativeLibraryPath(p11);
            ClassLoader v4 = p11.getClassLoader();
            String v2_3 = android.os.Environment.getExternalStorageDirectory();
            String v7_6 = new java.io.File(v2_3, new StringBuilder().append("Android/data/").append(p11.getPackageName()).append("/files/.__override__").toString()).getAbsolutePath();
            String v9_9 = new java.io.File(v2_3, new StringBuilder().append("../legacy/Android/data/").append(p11.getPackageName()).append("/files/.__override__").toString()).getAbsolutePath();
            String v2_4 = mono.MonoPackageManager.getNativeLibraryPath(p12);
            String[] v3_5 = new String[3];
            v3_5[0] = v1_7;
            v3_5[1] = v5_0;
            v3_5[2] = v6_0;
            String[] v5_1 = new String[2];
            v5_1[0] = v7_6;
            v5_1[1] = v9_9;
            mono.android.Runtime.init(v0_7, p13, v2_4, v3_5, v4, v5_1, mono.MonoPackageManager_Resources.Assemblies, p11.getPackageName());
            mono.android.app.ApplicationRegistration.registerApplications();
            mono.MonoPackageManager.initialized = 1;
        }
        return;
    }

Method android.support.multidex.MultiDex$V4.install() calling method dalvik.system.DexFile.loadDex()


    private static void install(ClassLoader p13, java.util.List p14)
    {
        int v5 = p14.size();
        reflect.Field v10 = android.support.multidex.MultiDex.access$300(p13, "path");
        StringBuilder v9_1 = new StringBuilder(((String) v10.get(p13)));
        String[] v4 = new String[v5];
        java.io.File[] v3 = new java.io.File[v5];
        java.util.zip.ZipFile[] v6 = new java.util.zip.ZipFile[v5];
        dalvik.system.DexFile[] v2 = new dalvik.system.DexFile[v5];
        java.util.ListIterator v8 = p14.listIterator();
        while (v8.hasNext()) {
            java.io.File v0_1 = ((java.io.File) v8.next());
            String v1 = v0_1.getAbsolutePath();
            v9_1.append(58).append(v1);
            int v7 = v8.previousIndex();
            v4[v7] = v1;
            v3[v7] = v0_1;
            v6[v7] = new java.util.zip.ZipFile(v0_1);
            v2[v7] = dalvik.system.DexFile.loadDex(v1, new StringBuilder().append(v1).append(".dex").toString(), 0);
        }
        v10.set(p13, v9_1.toString());
        android.support.multidex.MultiDex.access$400(p13, "mPaths", v4);
        android.support.multidex.MultiDex.access$400(p13, "mFiles", v3);
        android.support.multidex.MultiDex.access$400(p13, "mZips", v6);
        android.support.multidex.MultiDex.access$400(p13, "mDexs", v2);
        return;
    }

Method com.google.android.gms.dynamite.zzh.<init>() calling method dalvik.system.PathClassLoader.<init>()


    zzh(String p1, ClassLoader p2)
    {
        super(p1, p2);
        return;
    }