-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
b5d015f
commit 3f82782
Showing
11 changed files
with
403 additions
and
495 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,5 +1,5 @@ | ||
[mypy] | ||
python_version = 3.6 | ||
python_version = 3.11 | ||
disallow_untyped_calls = True | ||
disallow_untyped_defs = True | ||
|
||
|
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,22 +1,23 @@ | ||
[tool.poetry] | ||
name = "pypeid" | ||
version = "0.1.1" | ||
version = "0.1.2" | ||
description = "Yet another implementation of PEiD with yara-python" | ||
authors = ["Koh Nakagawa <tsunekou1019@gmail.com>"] | ||
license = "Apache License 2.0" | ||
readme = "README.md" | ||
|
||
[tool.poetry.dependencies] | ||
python = "^3.7,<3.11" | ||
yara-python = "^4.2.0" | ||
python = "^3.11" | ||
yara-python = "^4.3.0" | ||
|
||
[tool.poetry.dev-dependencies] | ||
mypy = "^0.942" | ||
black = "^22.3.0" | ||
pytest = "^7.1.1" | ||
isort = "^5.10.1" | ||
pip-licenses = "^3.5.3" | ||
requests = "^2.27.1" | ||
|
||
[tool.poetry.group.dev.dependencies] | ||
mypy = "^1.1.1" | ||
pytest = "^7.2.2" | ||
black = "^23.1.0" | ||
isort = "^5.12.0" | ||
requests = "^2.28.2" | ||
|
||
[build-system] | ||
requires = ["poetry-core>=1.0.0"] | ||
requires = ["poetry-core"] | ||
build-backend = "poetry.core.masonry.api" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,7 +1,7 @@ | ||
# | ||
# (c) FFRI Security, Inc., 2020-2022 / Author: FFRI Security, Inc. | ||
# | ||
if __name__ == "__main__": | ||
from .cli import main | ||
|
||
main() | ||
# | ||
# (c) FFRI Security, Inc., 2020-2023 / Author: FFRI Security, Inc. | ||
# | ||
if __name__ == "__main__": | ||
from .cli import main | ||
|
||
main() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,17 +1,17 @@ | ||
# | ||
# (c) FFRI Security, Inc., 2020-2022 / Author: FFRI Security, Inc. | ||
# | ||
def main() -> None: | ||
import sys | ||
from .scanner import PEiDScanner, format_as_katc_peid | ||
|
||
if len(sys.argv) != 2: | ||
print(f"Usage: {sys.argv[0]} input_file") | ||
return | ||
peid_scanner = PEiDScanner() | ||
scan_result = peid_scanner.scan_file(sys.argv[1]) | ||
print(format_as_katc_peid(scan_result)) | ||
|
||
|
||
if __name__ == "__main__": | ||
main() | ||
# | ||
# (c) FFRI Security, Inc., 2020-2023 / Author: FFRI Security, Inc. | ||
# | ||
def main() -> None: | ||
import sys | ||
from .scanner import PEiDScanner, format_as_katc_peid | ||
|
||
if len(sys.argv) != 2: | ||
print(f"Usage: {sys.argv[0]} input_file") | ||
return | ||
peid_scanner = PEiDScanner() | ||
scan_result = peid_scanner.scan_file(sys.argv[1]) | ||
print(format_as_katc_peid(scan_result)) | ||
|
||
|
||
if __name__ == "__main__": | ||
main() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,85 +1,85 @@ | ||
# | ||
# (c) FFRI Security, Inc., 2020-2022 / Author: FFRI Security, Inc. | ||
# | ||
import sys | ||
import os | ||
import subprocess | ||
import requests | ||
import csv | ||
from typing import Optional | ||
from pypeid import PEiDScanner, format_as_katc_peid | ||
|
||
|
||
script_dir: str = os.path.dirname(os.path.abspath(__file__)) | ||
|
||
|
||
def get_katc_peid() -> None: | ||
try: | ||
res = requests.get( | ||
"https://github.com/K-atc/PEiD/releases/download/v0.1.1/PEiD" | ||
) | ||
with open(os.path.join(script_dir, "bin/PEiD"), "wb") as fout: | ||
fout.write(res.content) | ||
except requests.exceptions.RequestException as err: | ||
print("Error occurs", file=sys.stderr) | ||
print(f"{err}", file=sys.stderr) | ||
sys.exit(1) | ||
|
||
|
||
def katc_peid_exists() -> bool: | ||
return os.path.exists(os.path.join(script_dir, "bin/PEiD")) | ||
|
||
|
||
def is_katc_peid_prepared() -> bool: | ||
return ( | ||
os.path.exists(os.path.join(os.getcwd(), "rules.zip")) | ||
and os.path.exists(os.path.join(os.getcwd(), "rules")) | ||
and os.path.exists(os.path.join(os.getcwd(), "yara")) | ||
) | ||
|
||
|
||
def get_katc_peid_output(path: str) -> Optional[str]: | ||
peid_exe = os.path.join(script_dir, "bin/PEiD") | ||
output_lines = ( | ||
subprocess.run([peid_exe, path], stdout=subprocess.PIPE, check=True) | ||
.stdout.decode("utf-8") | ||
.split("\n")[:-1] | ||
) | ||
|
||
if any("WARN" in l for l in output_lines): | ||
print("Error occurs.", file=sys.stderr) | ||
return None | ||
|
||
return "\n".join( | ||
l | ||
for l in output_lines | ||
if "INFO" not in l and "=>" not in l and "RULES_FILE" not in l | ||
) | ||
|
||
|
||
def _main() -> None: | ||
if len(sys.argv) != 2: | ||
print(f"Usage: {sys.argv[0]} input_csv") | ||
sys.exit(1) | ||
|
||
if not katc_peid_exists(): | ||
get_katc_peid() | ||
|
||
if not is_katc_peid_prepared(): | ||
subprocess.run([os.path.join(script_dir, "bin/PEiD"), "--prepare"], check=True) | ||
|
||
target_csv = sys.argv[1] | ||
peid_scanner = PEiDScanner() | ||
with open(target_csv, "r") as fin: | ||
reader = csv.reader(fin) | ||
next(reader) | ||
for path, _, _ in reader: | ||
expected = get_katc_peid_output(path) | ||
actual = format_as_katc_peid(peid_scanner.scan_file(path)) | ||
if expected != actual: | ||
print(f"different from Katc version of PEiD @ {path}") | ||
print("OK!") | ||
|
||
|
||
if __name__ == "__main__": | ||
_main() | ||
# | ||
# (c) FFRI Security, Inc., 2020-2023 / Author: FFRI Security, Inc. | ||
# | ||
import sys | ||
import os | ||
import subprocess | ||
import requests | ||
import csv | ||
from typing import Optional | ||
from pypeid import PEiDScanner, format_as_katc_peid | ||
|
||
|
||
script_dir: str = os.path.dirname(os.path.abspath(__file__)) | ||
|
||
|
||
def get_katc_peid() -> None: | ||
try: | ||
res = requests.get( | ||
"https://github.com/K-atc/PEiD/releases/download/v0.1.1/PEiD" | ||
) | ||
with open(os.path.join(script_dir, "bin/PEiD"), "wb") as fout: | ||
fout.write(res.content) | ||
except requests.exceptions.RequestException as err: | ||
print("Error occurs", file=sys.stderr) | ||
print(f"{err}", file=sys.stderr) | ||
sys.exit(1) | ||
|
||
|
||
def katc_peid_exists() -> bool: | ||
return os.path.exists(os.path.join(script_dir, "bin/PEiD")) | ||
|
||
|
||
def is_katc_peid_prepared() -> bool: | ||
return ( | ||
os.path.exists(os.path.join(os.getcwd(), "rules.zip")) | ||
and os.path.exists(os.path.join(os.getcwd(), "rules")) | ||
and os.path.exists(os.path.join(os.getcwd(), "yara")) | ||
) | ||
|
||
|
||
def get_katc_peid_output(path: str) -> Optional[str]: | ||
peid_exe = os.path.join(script_dir, "bin/PEiD") | ||
output_lines = ( | ||
subprocess.run([peid_exe, path], stdout=subprocess.PIPE, check=True) | ||
.stdout.decode("utf-8") | ||
.split("\n")[:-1] | ||
) | ||
|
||
if any("WARN" in l for l in output_lines): | ||
print("Error occurs.", file=sys.stderr) | ||
return None | ||
|
||
return "\n".join( | ||
l | ||
for l in output_lines | ||
if "INFO" not in l and "=>" not in l and "RULES_FILE" not in l | ||
) | ||
|
||
|
||
def _main() -> None: | ||
if len(sys.argv) != 2: | ||
print(f"Usage: {sys.argv[0]} input_csv") | ||
sys.exit(1) | ||
|
||
if not katc_peid_exists(): | ||
get_katc_peid() | ||
|
||
if not is_katc_peid_prepared(): | ||
subprocess.run([os.path.join(script_dir, "bin/PEiD"), "--prepare"], check=True) | ||
|
||
target_csv = sys.argv[1] | ||
peid_scanner = PEiDScanner() | ||
with open(target_csv, "r") as fin: | ||
reader = csv.reader(fin) | ||
next(reader) | ||
for path, _, _ in reader: | ||
expected = get_katc_peid_output(path) | ||
actual = format_as_katc_peid(peid_scanner.scan_file(path)) | ||
if expected != actual: | ||
print(f"different from Katc version of PEiD @ {path}") | ||
print("OK!") | ||
|
||
|
||
if __name__ == "__main__": | ||
_main() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters