2

I am doing research with mobile apps and need to analyze their code after unzipping the .apk file. However, the process of unzipping naturally involves lots of IO, which doesn't make it scalable, I am thinking if it's possible to hold the unzipped data in memory, with several variables representing it, thus saving the trouble of writing to FS. I am loaded with thousands of apps to analyze, so being able to do something like this would significantly speed up my process. Is there anyone who can suggest a way out for me. I am using python. Thanks in advance

Daniel
  • 1,484
  • 5
  • 24
  • 42
  • there seem to be quite a few posts on stack overflow regarding this issue. http://stackoverflow.com/questions/10908877/extracting-a-zipfile-to-memory, http://stackoverflow.com/questions/5710867/python-downloading-and-unzipping-a-zip-file-without-writing-to-disk – dm03514 Jun 12 '13 at 00:09
  • Sounds like you want unzip code that doesn't save the data at all (as opposed to saving it in a memory buffer). Maybe just take https://android.googlesource.com/platform/frameworks/native/+/master/include/utils/ZipFileRO.h and tweak it? – fadden Jun 12 '13 at 00:55

3 Answers3

6

Hope you are using Linux:

$ cd /dev/shm
$ unzip /path/to/my.apk

that's it. Unzipped APK in memory.

electronix384128
  • 6,625
  • 11
  • 45
  • 67
Diego Torres Milano
  • 65,697
  • 9
  • 111
  • 134
  • that seems to be a quick way to work around this issue. Thanks! I did a quick google and find that, /dev/shm, /tmp, /var/tmp /run can all serve as temporary memory storage. But I am not quite sure how they differ from each other, and in my case which one should I use. specifically /tmp and /var/tmp is mounted on filesystem /dev/sda6, /run is on tmpfs, and /dev/shm is on none. what's the different among them, and how are they related to memory when they are literally mounted on a device in the case of /tmp and /var/tmp – Daniel Jun 12 '13 at 17:43
  • Check the filesystem type, if `tmpfs` it is in memory – Diego Torres Milano Jun 12 '13 at 21:22
  • how about /tmp and /var/tmp, on my computer it's /dev/sda6 – Daniel Jun 12 '13 at 21:34
  • df /tmp Filesystem 1K-blocks Used Available Use% Mounted on /dev/sda6 191425164 50784288 130910368 28% / xushunyi@xushunyi-Lenovo-G450:/dev$ df /var/tmp – Daniel Jun 12 '13 at 21:35
0

Yes, the python zipfile module lets you read files into memory. It reads file-like objects so the zipfile itself could be in memory also, if you find that useful.

tdelaney
  • 73,364
  • 6
  • 83
  • 116
0

A late entry...but all I had to do was rename the file to a .ZIP extension.

Prisoner ZERO
  • 13,848
  • 21
  • 92
  • 137