Code Analysis of the Hacking Team Repos

I took the recently published git repos from of Hacking Team from GitHub and ran them through a couple of static code analysis tools.

Manual analysis has successfully unfolded a few 0days. Hopefully these results may assist further research.

GitHub Repository	Code Climate	Codacy1	QuantifiedCode
hackedteam/GeoTrust
hackedteam/core-android
hackedteam/core-android-audiocapture
hackedteam/core-android-market
hackedteam/core-android-native
hackedteam/core-blackberry
hackedteam/core-ios
hackedteam/core-linux
hackedteam/core-macos
hackedteam/core-packer
hackedteam/core-symbian
hackedteam/core-win32
hackedteam/core-win64
hackedteam/core-winmobile
hackedteam/core-winphone
hackedteam/driver-macos
hackedteam/driver-win32
hackedteam/driver-win64
hackedteam/fuzzer-android
hackedteam/fuzzer-windows
hackedteam/gitosis-admin
hackedteam/libmelter
hackedteam/libpemelter
hackedteam/melter
hackedteam/poc-x
hackedteam/rcs-anonymizer
hackedteam/rcs-anonymizer-old
hackedteam/rcs-backdoor
hackedteam/rcs-collector
hackedteam/rcs-common
hackedteam/rcs-console
hackedteam/rcs-console-library
hackedteam/rcs-console-mobile
hackedteam/rcs-db
hackedteam/rcs-db-ext
hackedteam/scout-win
hackedteam/shshget
hackedteam/soldier-win
hackedteam/test-av
hackedteam/test-av2
hackedteam/vector-applet
hackedteam/vector-default
hackedteam/vector-dropper
hackedteam/vector-edk
hackedteam/vector-exploit
hackedteam/vector-ipa
hackedteam/vector-macos-root
hackedteam/vector-offline
hackedteam/vector-offline2
hackedteam/vector-recover
hackedteam/vector-rmi
hackedteam/vector-silent

¹ Codacy grades unknown programming languages with ‘F’

Image courtesy of clement127