LiSa improvements

.gitignore

@@ -40,3 +40,7 @@ web_frontend/build
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+
+# data directory
+data/db/*
+data/storage/*

docker-compose.yml

@@ -13,7 +13,7 @@ services:
       - worker
     networks:
       lisanet:
-        ipv4_address: 172.42.0.10
+        ipv4_address: 172.42.0.20
     restart: on-failure
 
   worker:
@@ -47,7 +47,7 @@ services:
       - api
     networks:
       lisanet:
-        ipv4_address: 172.42.0.12
+        ipv4_address: 172.42.0.22
 
   rabbitmq:
     image: rabbitmq:latest
@@ -58,7 +58,7 @@ services:
       - 5672:5672
     networks:
       lisanet:
-        ipv4_address: 172.42.0.13
+        ipv4_address: 172.42.0.23
 
   mariadb:
     image: mariadb:latest
@@ -72,7 +72,7 @@ services:
       - "./data/db:/var/lib/mysql"
     networks:
       lisanet:
-        ipv4_address: 172.42.0.14
+        ipv4_address: 172.42.0.24
     restart: always
 
 networks:

lisa/analysis/static_analysis.py

@@ -59,8 +59,8 @@ def _r2_info(self):
             'language': info['bin']['lang'],
             'stripped': info['bin']['stripped'],
             'relocations': info['bin']['relocs'],
-            'min_opsize': info['bin']['minopsz'],
-            'max_opsize': info['bin']['maxopsz'],
+            'min_opsize': info['core']['minopsz'],
+            'max_opsize': info['core']['maxopsz'],
             'entry_point': entry_point[0]['vaddr']
         }
 

lisa/config.py

@@ -76,6 +76,6 @@
     }
 }
 
-celery_broker = 'pyamqp://lisa:lisa@172.42.0.13//'
-celery_backend = 'db+mysql+pymysql://lisa:lisa@172.42.0.14/lisadb'
-sql_backend = 'mysql+pymysql://lisa:lisa@172.42.0.14/lisadb'
+celery_broker = 'pyamqp://lisa:lisa@172.42.0.23//'
+celery_backend = 'db+mysql+pymysql://lisa:lisa@172.42.0.24/lisadb'
+sql_backend = 'mysql+pymysql://lisa:lisa@172.42.0.24/lisadb'

lisa/core/qemu_guest.py

@@ -75,8 +75,18 @@ def send_command(self, command):
         if not self._is_running:
             return None
 
-        self._proc.sendline(command)
-        self._proc.expect(self._prompt)
+        # some architectures do not support commands with more than 16 digits
+        # the command will be splitted in smaller chunks in order to be processed properly by QEMU
+        n=12
+        chunks = [command[i:i+n] for i in range(0, len(command), n)]
+        for chunk in chunks:
+            self._proc.sendline(chunk+'\\')
+
+        self._proc.sendline(' ')
+        try:
+            self._proc.expect(self._prompt)
+        except:
+            print("[WARNING] Expecting "+self._prompt)
         return self._proc.before
 
     def start_vm(self, disable_ipv6=True):
@@ -119,7 +129,7 @@ def run_and_analyze(self, exec_time, capture_pcap=True):
         """
         log.debug('Starting analysis module and target binary.')
 
-        self.send_command('tcpdump -i eth0 -w /stap/capture.pcap &')
+        self.send_command('tcpdump -U -i eth0 -w /stap/capture.pcap &')
 
         time.sleep(1)
 

requirements.txt

@@ -5,7 +5,7 @@ pexpect==4.2.1
 geoip2==2.9.0
 flask==1.0.2
 flask-cors===3.0.9
-celery==5.2.2
+celery==5.1.2
 rabbitmq==0.2.0
 sqlalchemy==1.3.0
 pymysql==0.9.3