mirror of
https://github.com/advanced-threat-research/GhidraScripts
synced 2026-06-08 13:03:27 +00:00
Updated the MalpediaFlossed scripts
Added support for version 1.1 of the MalpediaFlossed JSON file, and split the script into two: one to use with the JSON version locally, and one to connect with the web api (hosted by Malpedia or a self hosted one)
This commit is contained in:
ThisIsLibra
@@ -0,0 +1,536 @@
|
||||
//A script to load the Malpedia FLOSSED JSON dataset, and compare it with the strings from the current program. Strings which aren't part of the Malpedia dataset are then printed out, as these are more likely to be unique to warrant interest.
|
||||
//@author Max 'Libra' Kersten for Trellix
|
||||
//@category
|
||||
//@keybinding
|
||||
//@menupath
|
||||
//@toolbar
|
||||
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Type;
|
||||
import java.nio.file.Files;
|
||||
import java.util.ArrayList;
|
||||
import java.util.HashMap;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
import com.google.gson.Gson;
|
||||
import com.google.gson.GsonBuilder;
|
||||
import com.google.gson.JsonArray;
|
||||
import com.google.gson.JsonDeserializationContext;
|
||||
import com.google.gson.JsonDeserializer;
|
||||
import com.google.gson.JsonElement;
|
||||
import com.google.gson.JsonObject;
|
||||
import com.google.gson.JsonParseException;
|
||||
|
||||
import ghidra.app.script.GhidraScript;
|
||||
import ghidra.program.model.data.StringDataInstance;
|
||||
import ghidra.program.model.listing.Data;
|
||||
import ghidra.program.util.DefinedDataIterator;
|
||||
|
||||
public class MalpediaFlossedCheckLocal extends GhidraScript {
|
||||
|
||||
/**
|
||||
* The strings present within the current program
|
||||
*/
|
||||
private static List<String> STRINGS_FROM_CURRENT_PROGRAM;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
private List<String> missingStrings;
|
||||
|
||||
/**
|
||||
* Defines if the case of the strings should be taken into account
|
||||
*/
|
||||
private boolean isCaseSensitive;
|
||||
|
||||
/**
|
||||
* The minimum length of a string, for it to be considered useful
|
||||
*/
|
||||
private static final int MINIMUM_STRING_LENGTH = 4;
|
||||
|
||||
@Override
|
||||
protected void run() throws Exception {
|
||||
// Determine if case sensitivity is desired
|
||||
isCaseSensitive = askYesNo("Match strings case sensitive?",
|
||||
"Do you want the strings to be matched case sensitive?");
|
||||
|
||||
// Obtain the JSON file's location
|
||||
File jsonFile = askFile("Select the extracted Malpedia FLOSS data set", "Select");
|
||||
|
||||
// Initialise the missed strings list
|
||||
missingStrings = new ArrayList<>();
|
||||
|
||||
// Get all strings from the currently open program
|
||||
STRINGS_FROM_CURRENT_PROGRAM = getStringsFromCurrentProgram(MINIMUM_STRING_LENGTH);
|
||||
|
||||
// Parse the JSON file into a Java object
|
||||
MalpediaFlossed flossed = parse(jsonFile);
|
||||
|
||||
// Print the about data from the JSON file
|
||||
printAbout(flossed.getAbout());
|
||||
|
||||
// Get the mapping from the object
|
||||
Map<String, MalpediaFlossedString> flossedObject = flossed.getStringMapping();
|
||||
|
||||
/*
|
||||
* Create the message about the non-occurring strings, depending on the case
|
||||
* sensitivity
|
||||
*/
|
||||
String message = "Strings not occurring in the Malpedia string set (this check is case ";
|
||||
if (isCaseSensitive == false) {
|
||||
message += "in";
|
||||
}
|
||||
message += "sensitive):";
|
||||
// Print said message
|
||||
println(message);
|
||||
|
||||
/*
|
||||
* Get a list of strings from the flossed object, since the keys are the
|
||||
* strings. To easily iterate over the strings and to be able to fetch results,
|
||||
* an ArrayList is used, rather than the set.
|
||||
*/
|
||||
List<String> stringKeys = new ArrayList<>(flossedObject.keySet());
|
||||
|
||||
// Iterate over all strings within the current program
|
||||
for (int i = 0; i < STRINGS_FROM_CURRENT_PROGRAM.size(); i++) {
|
||||
// Get the current string
|
||||
String currentString = STRINGS_FROM_CURRENT_PROGRAM.get(i);
|
||||
// If the list of flossed strings does not contain the current string
|
||||
if (stringKeys.contains(currentString) == false) {
|
||||
// It is added to the list of missing strings
|
||||
missingStrings.add(currentString);
|
||||
// Printed for the analyst to see
|
||||
println("\t" + currentString);
|
||||
}
|
||||
}
|
||||
|
||||
// If no missing strings were found, print a message related to that
|
||||
if (missingStrings.isEmpty()) {
|
||||
println("All strings of this binary occur within the Malpedia string set!");
|
||||
}
|
||||
|
||||
/*
|
||||
* If you want to print the matches for every file, and the top matches in
|
||||
* descending order, use the commented code below.
|
||||
*/
|
||||
// Map<String, Integer> familyCountMapping = new HashMap<>();
|
||||
// for (Map.Entry<String, MalpediaFlossedString> entry : flossedObject.entrySet()) {
|
||||
// String key = entry.getKey();
|
||||
// MalpediaFlossedString value = entry.getValue();
|
||||
//
|
||||
// println("Match found for \"" + key + "\"");
|
||||
// String message = "\tRelates to:\n";
|
||||
// List<String> familiesFromIds = getFamiliesByIds(flossed.getFamilyIdMapping(), value.getFamilies());
|
||||
// for (String family : familiesFromIds) {
|
||||
// message += "\t\t" + family + "\n";
|
||||
//
|
||||
// if (familyCountMapping.containsKey(family)) {
|
||||
// Integer count = familyCountMapping.get(family);
|
||||
// count++;
|
||||
// familyCountMapping.put(family, count);
|
||||
// } else {
|
||||
// familyCountMapping.put(family, 1);
|
||||
// }
|
||||
// }
|
||||
// if (familiesFromIds.size() < 10) {
|
||||
// println(message);
|
||||
// }
|
||||
//
|
||||
// }
|
||||
//
|
||||
// Map<String, Integer> valuesDescending = familyCountMapping.entrySet().stream()
|
||||
// .sorted(Map.Entry.comparingByValue(Comparator.reverseOrder())).collect(Collectors.toMap(
|
||||
// Map.Entry::getKey, Map.Entry::getValue, (oldValue, newValue) -> oldValue, LinkedHashMap::new));
|
||||
//
|
||||
// for (Map.Entry<String, Integer> entry : valuesDescending.entrySet()) {
|
||||
// println(entry.getKey() + " : " + entry.getValue());
|
||||
// }
|
||||
//
|
||||
// println(valuesDescending.toString());
|
||||
}
|
||||
|
||||
/**
|
||||
* This is a helper function to get all families for a given ID, as a lookup for
|
||||
* later use.
|
||||
*
|
||||
* @param familyIdMapping The family-ID mapping
|
||||
* @param ids a list of IDs
|
||||
* @return all matching families to all IDs
|
||||
*/
|
||||
private List<String> getFamiliesByIds(Map<Integer, String> familyIdMapping, List<Integer> ids) {
|
||||
Set<String> families = new HashSet<>();
|
||||
|
||||
for (Integer id : ids) {
|
||||
if (familyIdMapping.containsKey(id)) {
|
||||
String family = familyIdMapping.get(id);
|
||||
families.add(family);
|
||||
}
|
||||
}
|
||||
|
||||
List<String> output = new ArrayList<>(families);
|
||||
output.sort(String::compareToIgnoreCase);
|
||||
return output;
|
||||
}
|
||||
|
||||
/**
|
||||
* Prints the about message of the Malpedia data set
|
||||
*
|
||||
* @param about the data set in Java object form
|
||||
*/
|
||||
private void printAbout(MalpediaFlossedAbout about) {
|
||||
println("About the Malpedia Flossed JSON data set:");
|
||||
println("\tAuthor: " + about.getAuthor());
|
||||
println("\tDated flossed: " + about.getDateFlossed());
|
||||
println("\tDate published: " + about.getDatePublished());
|
||||
println("\tFLOSS version: " + about.getFlossVersion());
|
||||
println("\tProcessed strings: " + about.getNumberOfProcessedStrings());
|
||||
println("\tReference: " + about.getReference());
|
||||
println("\tSource: " + about.getSource());
|
||||
println();
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all defined strings from the current program. Only strings equal to, or
|
||||
* longer than, the given minimum size are returned
|
||||
*
|
||||
* @param minimumLength the minimum length of the string to be included in the
|
||||
* matches
|
||||
* @return all strings that are at least as long as the minimum length
|
||||
*/
|
||||
private List<String> getStringsFromCurrentProgram(int minimumLength) {
|
||||
// Create a set to store all strings in
|
||||
Set<String> strings = new HashSet<>();
|
||||
|
||||
// Get a data iterator
|
||||
DefinedDataIterator ddi = DefinedDataIterator.definedStrings(currentProgram);
|
||||
// Iterate over the data iterator
|
||||
for (Data d : ddi) {
|
||||
// Get an instance of the currently selected data
|
||||
StringDataInstance sdi = StringDataInstance.getStringDataInstance(d);
|
||||
// Get the string value of said string
|
||||
String s = sdi.getStringValue();
|
||||
|
||||
// If the string is not null nor empty
|
||||
if (s != null && s.isEmpty() == false) {
|
||||
/*
|
||||
* If the length of the string is equal to, or larger than the predefined
|
||||
* minimum length
|
||||
*/
|
||||
if (s.length() >= minimumLength) {
|
||||
/*
|
||||
* If there is no casing check, convert the string to lower case, for easier
|
||||
* checking later on
|
||||
*/
|
||||
if (isCaseSensitive == false) {
|
||||
s = s.toLowerCase();
|
||||
}
|
||||
// Add the string to the set
|
||||
strings.add(s);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Sets do not contain duplicate items by their nature, but cannot always be
|
||||
* accessed in the same way as a list can (i.e. when sorting, given the
|
||||
* hashset's nature).
|
||||
*
|
||||
* The unique strings from the list, are stored in a newly created array list,
|
||||
* which maintains the order. Next, they are sorted alphabetically, ignoring the
|
||||
* casing during sorting to avoid an order where A-Za-z would occur, but rather
|
||||
* any casing of A through Z.
|
||||
*/
|
||||
List<String> output = new ArrayList<>(strings);
|
||||
output.sort(String::compareToIgnoreCase);
|
||||
return output;
|
||||
}
|
||||
|
||||
/**
|
||||
* A parsing function, which contains a custom GSON parser to properly parse the
|
||||
* Malpedia JSON set
|
||||
*
|
||||
* @param jsonFile the Malpedia JSON file, as a Java File object
|
||||
* @return the custom Java object with all results
|
||||
* @throws IOException
|
||||
*/
|
||||
private MalpediaFlossed parse(File jsonFile) throws IOException {
|
||||
/*
|
||||
* Create a custom JSON deserializer
|
||||
*/
|
||||
JsonDeserializer<MalpediaFlossed> deserializer = new JsonDeserializer<MalpediaFlossed>() {
|
||||
@Override
|
||||
public MalpediaFlossed deserialize(JsonElement json, Type typeOfT, JsonDeserializationContext context)
|
||||
throws JsonParseException {
|
||||
JsonObject jsonObject = json.getAsJsonObject();
|
||||
|
||||
Map<Integer, String> familyToIdMapping = new HashMap<>();
|
||||
JsonObject familyToIdJson = jsonObject.get("family_to_id").getAsJsonObject();
|
||||
Set<String> familyKeySet = familyToIdJson.keySet();
|
||||
for (String family : familyKeySet) {
|
||||
Integer value = familyToIdJson.get(family).getAsInt();
|
||||
familyToIdMapping.put(value, family);
|
||||
}
|
||||
|
||||
JsonObject aboutJson = jsonObject.get("about").getAsJsonObject();
|
||||
String author = aboutJson.get("author").getAsString();
|
||||
String date_flossed = aboutJson.get("date_flossed").getAsString();
|
||||
String date_published = aboutJson.get("date_published").getAsString();
|
||||
String floss_version = aboutJson.get("floss_version").getAsString();
|
||||
String info = aboutJson.get("info").getAsString();
|
||||
String license = aboutJson.get("license").getAsString();
|
||||
int num_families = aboutJson.get("num_families").getAsInt();
|
||||
int num_processed_strings = aboutJson.get("num_processed_strings").getAsInt();
|
||||
int num_samples_flossed = aboutJson.get("num_samples_flossed").getAsInt();
|
||||
int num_total_strings = aboutJson.get("num_total_strings").getAsInt();
|
||||
String reference = aboutJson.get("reference").getAsString();
|
||||
String source = aboutJson.get("source").getAsString();
|
||||
|
||||
MalpediaFlossedAbout about = new MalpediaFlossedAbout(author, date_flossed, date_published,
|
||||
floss_version, info, license, num_families, num_processed_strings, num_samples_flossed,
|
||||
num_total_strings, reference, source);
|
||||
|
||||
Map<String, MalpediaFlossedString> stringMap = new HashMap<>();
|
||||
|
||||
JsonObject stringsJson = jsonObject.get("strings").getAsJsonObject();
|
||||
Set<String> stringKeySet = stringsJson.keySet();
|
||||
|
||||
// Iterate over all strings in the JSON file
|
||||
for (String string : stringKeySet) {
|
||||
// If a string does not match the minimum length, its omitted
|
||||
if (string.length() < MINIMUM_STRING_LENGTH) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// Declare a variable to store a copy of the string in
|
||||
String stringCopy;
|
||||
// Check if the copy of the string should be made lower case
|
||||
if (isCaseSensitive == false) {
|
||||
stringCopy = string.toLowerCase();
|
||||
} else {
|
||||
stringCopy = string;
|
||||
}
|
||||
|
||||
/*
|
||||
* If the current program's strings does not not contain this string, it is
|
||||
* skipped. The non-matching strings aren't required, and parsing them will
|
||||
* result in a long runtime of the script without any advantages. It also
|
||||
* creates an out of heap space error within Ghidra, depending on how much
|
||||
* memory one allocated to the JVM during startup.
|
||||
*/
|
||||
if (STRINGS_FROM_CURRENT_PROGRAM.contains(stringCopy) == false) {
|
||||
continue;
|
||||
}
|
||||
|
||||
JsonObject stringJsonObject = stringsJson.get("string").getAsJsonObject();
|
||||
|
||||
List<String> encodings = new ArrayList<>();
|
||||
JsonArray encodingsJson = stringJsonObject.get("encodings").getAsJsonArray();
|
||||
for (int i = 0; i < encodingsJson.size(); i++) {
|
||||
String encoding = encodingsJson.get(i).getAsString();
|
||||
encodings.add(encoding);
|
||||
}
|
||||
|
||||
List<String> tags = new ArrayList<>();
|
||||
JsonArray tagsJson = stringJsonObject.get("tags").getAsJsonArray();
|
||||
for (int i = 0; i < tagsJson.size(); i++) {
|
||||
String tag = tagsJson.get(i).getAsString();
|
||||
tags.add(tag);
|
||||
}
|
||||
|
||||
List<Integer> families = new ArrayList<>();
|
||||
|
||||
JsonArray familiesJson = stringJsonObject.get("families").getAsJsonArray();
|
||||
for (int i = 0; i < familiesJson.size(); i++) {
|
||||
Integer family = familiesJson.get(i).getAsInt();
|
||||
families.add(family);
|
||||
}
|
||||
|
||||
Integer familyCount = stringJsonObject.get("family_count").getAsInt();
|
||||
|
||||
List<String> methods = new ArrayList<>();
|
||||
|
||||
JsonArray methodsJson = stringJsonObject.get("methods").getAsJsonArray();
|
||||
for (int i = 0; i < methodsJson.size(); i++) {
|
||||
String method = methodsJson.get(i).getAsString();
|
||||
methods.add(method);
|
||||
}
|
||||
|
||||
MalpediaFlossedString stringEntry = new MalpediaFlossedString(encodings, families, familyCount,
|
||||
methods, tags);
|
||||
stringMap.put(string, stringEntry);
|
||||
}
|
||||
|
||||
return new MalpediaFlossed(about, familyToIdMapping, stringMap);
|
||||
}
|
||||
};
|
||||
|
||||
// Read the file and store the result in a string
|
||||
String json = Files.readString(jsonFile.toPath());
|
||||
|
||||
// Initialise the GSON builder
|
||||
GsonBuilder gsonBuilder = new GsonBuilder();
|
||||
|
||||
// Register the custom deserializer
|
||||
gsonBuilder.registerTypeAdapter(MalpediaFlossed.class, deserializer);
|
||||
|
||||
// Create a Gson instance, with the custom adapter type
|
||||
Gson customGson = gsonBuilder.create();
|
||||
|
||||
// Parse the JSON into a Java object
|
||||
return customGson.fromJson(json, MalpediaFlossed.class);
|
||||
}
|
||||
|
||||
private class MalpediaFlossed {
|
||||
private MalpediaFlossedAbout about;
|
||||
private Map<Integer, String> familyIdMapping;
|
||||
private Map<String, MalpediaFlossedString> stringMapping;
|
||||
|
||||
public MalpediaFlossed(MalpediaFlossedAbout about, Map<Integer, String> familyIdMapping,
|
||||
Map<String, MalpediaFlossedString> stringMapping) {
|
||||
super();
|
||||
this.about = about;
|
||||
this.familyIdMapping = familyIdMapping;
|
||||
this.stringMapping = stringMapping;
|
||||
}
|
||||
|
||||
public MalpediaFlossedAbout getAbout() {
|
||||
return about;
|
||||
}
|
||||
|
||||
public Map<Integer, String> getFamilyIdMapping() {
|
||||
return familyIdMapping;
|
||||
}
|
||||
|
||||
public Map<String, MalpediaFlossedString> getStringMapping() {
|
||||
return stringMapping;
|
||||
}
|
||||
}
|
||||
|
||||
private class MalpediaFlossedString {
|
||||
private String string;
|
||||
private List<String> encodings;
|
||||
private List<Integer> families;
|
||||
private Integer familyCount;
|
||||
private List<String> methods;
|
||||
private List<String> tags;
|
||||
|
||||
public MalpediaFlossedString() {
|
||||
|
||||
}
|
||||
|
||||
public MalpediaFlossedString(List<String> encodings, List<Integer> families, Integer familyCount,
|
||||
List<String> methods, List<String> tags) {
|
||||
super();
|
||||
this.encodings = encodings;
|
||||
this.families = families;
|
||||
this.familyCount = familyCount;
|
||||
this.methods = methods;
|
||||
this.tags = tags;
|
||||
}
|
||||
|
||||
public List<String> getEncodings() {
|
||||
return encodings;
|
||||
}
|
||||
|
||||
public List<Integer> getFamilies() {
|
||||
return families;
|
||||
}
|
||||
|
||||
public Integer getFamilyCount() {
|
||||
return familyCount;
|
||||
}
|
||||
|
||||
public List<String> getMethods() {
|
||||
return methods;
|
||||
}
|
||||
|
||||
public List<String> getTags() {
|
||||
return tags;
|
||||
}
|
||||
}
|
||||
|
||||
private class MalpediaFlossedAbout {
|
||||
private String author;
|
||||
private String dateFlossed;
|
||||
private String datePublished;
|
||||
private String flossVersion;
|
||||
private String info;
|
||||
private String license;
|
||||
private int numberOfFamilies;
|
||||
private int numberOfProcessedStrings;
|
||||
private int numberOfSamplesFlossed;
|
||||
private int numberOfTotalStrings;
|
||||
private String reference;
|
||||
private String source;
|
||||
|
||||
public MalpediaFlossedAbout(String author, String dateFlossed, String datePublished, String flossVersion,
|
||||
String info, String license, int numberOfFamilies, int numberOfProcessedStrings,
|
||||
int numberOfSamplesFlossed, int numberOfTotalStrings, String reference, String source) {
|
||||
super();
|
||||
this.author = author;
|
||||
this.dateFlossed = dateFlossed;
|
||||
this.datePublished = datePublished;
|
||||
this.flossVersion = flossVersion;
|
||||
this.info = info;
|
||||
this.license = license;
|
||||
this.numberOfFamilies = numberOfFamilies;
|
||||
this.numberOfProcessedStrings = numberOfProcessedStrings;
|
||||
this.numberOfSamplesFlossed = numberOfSamplesFlossed;
|
||||
this.numberOfTotalStrings = numberOfTotalStrings;
|
||||
this.reference = reference;
|
||||
this.source = source;
|
||||
}
|
||||
|
||||
public String getAuthor() {
|
||||
return author;
|
||||
}
|
||||
|
||||
public String getDateFlossed() {
|
||||
return dateFlossed;
|
||||
}
|
||||
|
||||
public String getDatePublished() {
|
||||
return datePublished;
|
||||
}
|
||||
|
||||
public String getFlossVersion() {
|
||||
return flossVersion;
|
||||
}
|
||||
|
||||
public String getInfo() {
|
||||
return info;
|
||||
}
|
||||
|
||||
public String getLicense() {
|
||||
return license;
|
||||
}
|
||||
|
||||
public int getNumberOfFamilies() {
|
||||
return numberOfFamilies;
|
||||
}
|
||||
|
||||
public int getNumberOfProcessedStrings() {
|
||||
return numberOfProcessedStrings;
|
||||
}
|
||||
|
||||
public int getNumberOfSamplesFlossed() {
|
||||
return numberOfSamplesFlossed;
|
||||
}
|
||||
|
||||
public int getNumberOfTotalStrings() {
|
||||
return numberOfTotalStrings;
|
||||
}
|
||||
|
||||
public String getReference() {
|
||||
return reference;
|
||||
}
|
||||
|
||||
public String getSource() {
|
||||
return source;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,421 @@
|
||||
//A script to query the Malpedia FLOSSED JSON dataset via the web API (hosted by Malpedia, or a local instance) and compare it with the strings from the current program. Strings which aren't part of the Malpedia dataset are then printed out, as these are more likely to be unique to warrant interest.
|
||||
//@author Max 'Libra' Kersten for Trellix
|
||||
//@category
|
||||
//@keybinding
|
||||
//@menupath
|
||||
//@toolbar
|
||||
|
||||
import java.io.BufferedReader;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStreamReader;
|
||||
import java.io.OutputStream;
|
||||
import java.lang.reflect.Type;
|
||||
import java.net.HttpURLConnection;
|
||||
import java.net.URL;
|
||||
import java.util.ArrayList;
|
||||
import java.util.HashMap;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
import com.google.gson.Gson;
|
||||
import com.google.gson.GsonBuilder;
|
||||
import com.google.gson.JsonArray;
|
||||
import com.google.gson.JsonDeserializationContext;
|
||||
import com.google.gson.JsonDeserializer;
|
||||
import com.google.gson.JsonElement;
|
||||
import com.google.gson.JsonObject;
|
||||
import com.google.gson.JsonParseException;
|
||||
|
||||
import ghidra.app.script.GhidraScript;
|
||||
import ghidra.program.model.data.StringDataInstance;
|
||||
import ghidra.program.model.listing.Data;
|
||||
import ghidra.program.util.DefinedDataIterator;
|
||||
|
||||
public class MalpediaFlossedCheckWebApi extends GhidraScript {
|
||||
|
||||
/**
|
||||
* The URL to the API. Change this if you are self hosting an instance of this
|
||||
* service, otherwise the public Malpedia instance will be used.
|
||||
*/
|
||||
private static final String WEB_API_URL = "https://strings.malpedia.io/api/query/";
|
||||
|
||||
/**
|
||||
* The minimum length of a string, for it to be considered useful
|
||||
*/
|
||||
private int MINIMUM_STRING_LENGTH;
|
||||
|
||||
@Override
|
||||
protected void run() throws Exception {
|
||||
// Get the minimum string length from the user or the CLI in headless mode
|
||||
MINIMUM_STRING_LENGTH = askInt("Minimum string length",
|
||||
"What is the minimum length of a given string to be submitted to the web service? Any value lower than four will result in the value of four.");
|
||||
|
||||
// Correct the minimum string length if need be
|
||||
if (MINIMUM_STRING_LENGTH < 4) {
|
||||
println("The entered minimum string length of " + MINIMUM_STRING_LENGTH
|
||||
+ " is lower than four, and has thus been adjust to four");
|
||||
MINIMUM_STRING_LENGTH = 4;
|
||||
}
|
||||
|
||||
// Get all strings from the currently open program
|
||||
List<String> stringsFromCurrentProgram = getStringsFromCurrentProgram(MINIMUM_STRING_LENGTH);
|
||||
|
||||
// Parse the JSON file into a Java object
|
||||
Map<String, MalpediaFlossedString> flossed = requestAndParse(stringsFromCurrentProgram);
|
||||
|
||||
// Create and print the message about the non-occurring strings
|
||||
println("Strings not occurring in the Malpedia string set (this check is case sensitive):");
|
||||
|
||||
/*
|
||||
* Get a list of strings from the flossed object, since the keys are the
|
||||
* strings. To easily iterate over the strings and to be able to fetch results,
|
||||
* an ArrayList is used, rather than the set.
|
||||
*/
|
||||
List<String> stringKeys = new ArrayList<>(flossed.keySet());
|
||||
|
||||
/*
|
||||
* If no matches are found, an additional message is to be printed for the
|
||||
* analyst. This boolean defines if said message will be printed.
|
||||
*/
|
||||
boolean noMatches = true;
|
||||
|
||||
// Iterate over all strings within the current program
|
||||
for (int i = 0; i < stringsFromCurrentProgram.size(); i++) {
|
||||
// Get the current string
|
||||
String currentString = stringsFromCurrentProgram.get(i);
|
||||
// If the list of flossed strings does not contain the current string
|
||||
if (stringKeys.contains(currentString) == false) {
|
||||
/*
|
||||
* If no matches are found, set the boolean, which is used to inform the analyst
|
||||
* later on
|
||||
*/
|
||||
noMatches = false;
|
||||
// Printed for the analyst to see
|
||||
println(currentString);
|
||||
}
|
||||
}
|
||||
|
||||
// If no missing strings were found, print a message related to that
|
||||
if (noMatches) {
|
||||
println("All strings of this binary occur within the Malpedia string set!");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Send the HTTP POST request to the web service
|
||||
*
|
||||
* @param body the body of comma separated strings to check
|
||||
* @return the JSON response from the server
|
||||
* @throws IOException
|
||||
*/
|
||||
private String postRequest(String body) throws IOException {
|
||||
URL url = new URL(WEB_API_URL);
|
||||
HttpURLConnection connection = (HttpURLConnection) url.openConnection();
|
||||
connection.setRequestMethod("POST");
|
||||
connection.setRequestProperty("Content-Type", "application/json");
|
||||
connection.setRequestProperty("Accept", "application/json");
|
||||
connection.setDoOutput(true);
|
||||
|
||||
try (OutputStream outputStream = connection.getOutputStream()) {
|
||||
byte[] rawBody = body.getBytes("utf-8");
|
||||
outputStream.write(rawBody, 0, rawBody.length);
|
||||
}
|
||||
|
||||
try (BufferedReader bufferedReader = new BufferedReader(
|
||||
new InputStreamReader(connection.getInputStream(), "utf-8"))) {
|
||||
StringBuilder response = new StringBuilder();
|
||||
String line = null;
|
||||
while ((line = bufferedReader.readLine()) != null) {
|
||||
response.append(line.trim());
|
||||
}
|
||||
return response.toString();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a comma separated string of the given list
|
||||
*
|
||||
* @param input the list to convert
|
||||
* @return the converted list, in string format, where each string is
|
||||
* encapsulated between quotes
|
||||
*/
|
||||
private String csvFormatList(List<String> input) {
|
||||
String output = "";
|
||||
|
||||
for (String string : input) {
|
||||
output += encapsulate(string) + ",";
|
||||
}
|
||||
return output.substring(0, output.length() - 1);
|
||||
}
|
||||
|
||||
/**
|
||||
* Encapsulates the given string between quotes
|
||||
*
|
||||
* @param input the string to encapsulate
|
||||
* @return the encapsulated string
|
||||
*/
|
||||
private String encapsulate(String input) {
|
||||
return "\"" + input + "\"";
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all defined strings from the current program. Only strings equal to, or
|
||||
* longer than, the given minimum size are returned
|
||||
*
|
||||
* @param minimumLength the minimum length of the string to be included in the
|
||||
* matches
|
||||
* @return all strings that are at least as long as the minimum length
|
||||
*/
|
||||
private List<String> getStringsFromCurrentProgram(int minimumLength) {
|
||||
// Create a set to store all strings in
|
||||
Set<String> strings = new HashSet<>();
|
||||
|
||||
// Get a data iterator
|
||||
DefinedDataIterator ddi = DefinedDataIterator.definedStrings(currentProgram);
|
||||
// Iterate over the data iterator
|
||||
for (Data d : ddi) {
|
||||
// Get an instance of the currently selected data
|
||||
StringDataInstance sdi = StringDataInstance.getStringDataInstance(d);
|
||||
// Get the string value of said string
|
||||
String s = sdi.getStringValue();
|
||||
|
||||
// If the string is not null nor empty
|
||||
if (s != null && s.isEmpty() == false) {
|
||||
/*
|
||||
* If the length of the string is equal to, or larger than the predefined
|
||||
* minimum length
|
||||
*/
|
||||
if (s.length() >= minimumLength) {
|
||||
if (isFullyHumanReadable(s)) {
|
||||
// Add the string to the set
|
||||
strings.add(s);
|
||||
} else {
|
||||
println(s);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Sets do not contain duplicate items by their nature, but cannot always be
|
||||
* accessed in the same way as a list can (i.e. when sorting, given the
|
||||
* hashset's nature).
|
||||
*
|
||||
* The unique strings from the list, are stored in a newly created array list,
|
||||
* which maintains the order. Next, they are sorted alphabetically, ignoring the
|
||||
* casing during sorting to avoid an order where A-Za-z would occur, but rather
|
||||
* any casing of A through Z.
|
||||
*/
|
||||
List<String> output = new ArrayList<>(strings);
|
||||
output.sort(String::compareToIgnoreCase);
|
||||
return output;
|
||||
}
|
||||
|
||||
/**
|
||||
* Non human readable characters will throw an error from the web server
|
||||
*
|
||||
* @param input the string to check
|
||||
* @return true if the string is fully readable, false if not
|
||||
*/
|
||||
private boolean isFullyHumanReadable(String input) {
|
||||
// Get the byte representation from the given string
|
||||
byte[] bytes = input.getBytes();
|
||||
|
||||
// Iterate over all bytes
|
||||
for (byte b : bytes) {
|
||||
// Values lower than 0x20 are not human readable
|
||||
if (b < 0x20) {
|
||||
/*
|
||||
* 0x09 is a horizontal tab
|
||||
*
|
||||
* 0x0A is a line feed
|
||||
*
|
||||
* 0x0D is carriage feed
|
||||
*/
|
||||
if (b != 0x09 && b != 0x0A && b != 0x0D) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
// 0xFF is an unreadable character
|
||||
if (b == 0xFF) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* A parsing function, which contains a custom GSON parser to properly parse the
|
||||
* Malpedia JSON set
|
||||
*
|
||||
* @param jsonFile the Malpedia JSON file, as a Java File object
|
||||
* @return the custom Java object with all results
|
||||
* @throws IOException
|
||||
*/
|
||||
private Map<String, MalpediaFlossedString> requestAndParse(List<String> stringsFromCurrentProgram)
|
||||
throws IOException {
|
||||
/*
|
||||
* Create a custom JSON deserializer
|
||||
*/
|
||||
JsonDeserializer<MalpediaFlossed> deserializer = new JsonDeserializer<MalpediaFlossed>() {
|
||||
@Override
|
||||
public MalpediaFlossed deserialize(JsonElement json, Type typeOfT, JsonDeserializationContext context)
|
||||
throws JsonParseException {
|
||||
JsonObject jsonObject = json.getAsJsonObject();
|
||||
|
||||
if (jsonObject.get("status").getAsString().equalsIgnoreCase("successful") == false) {
|
||||
printerr("Unssucessful request!");
|
||||
return null;
|
||||
}
|
||||
|
||||
Map<String, MalpediaFlossedString> stringMapping = new HashMap<>();
|
||||
|
||||
JsonArray data = jsonObject.get("data").getAsJsonArray();
|
||||
for (int count = 0; count < data.size(); count++) {
|
||||
JsonObject entry = data.get(count).getAsJsonObject();
|
||||
|
||||
String string = entry.get("string").getAsString();
|
||||
|
||||
boolean matched = entry.get("matched").getAsBoolean();
|
||||
|
||||
List<String> encodings = new ArrayList<>();
|
||||
JsonElement element = entry.get("encodings");
|
||||
if (element != null) {
|
||||
JsonArray encodingsJson = element.getAsJsonArray();
|
||||
for (int i = 0; i < encodingsJson.size(); i++) {
|
||||
String encoding = encodingsJson.get(i).getAsString();
|
||||
encodings.add(encoding);
|
||||
}
|
||||
}
|
||||
|
||||
List<String> tags = new ArrayList<>();
|
||||
element = entry.get("tags");
|
||||
if (element != null) {
|
||||
JsonArray tagsJson = element.getAsJsonArray();
|
||||
for (int i = 0; i < tagsJson.size(); i++) {
|
||||
String tag = tagsJson.get(i).getAsString();
|
||||
tags.add(tag);
|
||||
}
|
||||
}
|
||||
|
||||
List<String> families = new ArrayList<>();
|
||||
|
||||
element = entry.get("families");
|
||||
if (element != null) {
|
||||
JsonArray familiesJson = element.getAsJsonArray();
|
||||
for (int i = 0; i < familiesJson.size(); i++) {
|
||||
String family = familiesJson.get(i).getAsString();
|
||||
families.add(family);
|
||||
}
|
||||
}
|
||||
|
||||
Integer familyCount = -1;
|
||||
element = entry.get("family_count");
|
||||
if (element != null) {
|
||||
familyCount = element.getAsInt();
|
||||
}
|
||||
|
||||
List<String> methods = new ArrayList<>();
|
||||
element = entry.get("methods");
|
||||
if (element != null) {
|
||||
JsonArray methodsJson = element.getAsJsonArray();
|
||||
for (int i = 0; i < methodsJson.size(); i++) {
|
||||
String method = methodsJson.get(i).getAsString();
|
||||
methods.add(method);
|
||||
}
|
||||
}
|
||||
|
||||
MalpediaFlossedString stringEntry = new MalpediaFlossedString(matched, encodings, families,
|
||||
familyCount, methods, tags);
|
||||
stringMapping.put(string, stringEntry);
|
||||
}
|
||||
|
||||
return new MalpediaFlossed(stringMapping);
|
||||
}
|
||||
};
|
||||
|
||||
// Create the request body
|
||||
String body = csvFormatList(stringsFromCurrentProgram);
|
||||
|
||||
// Store the JSON response from the server
|
||||
String json = postRequest(body);
|
||||
|
||||
// Initialise the GSON builder
|
||||
GsonBuilder gsonBuilder = new GsonBuilder();
|
||||
|
||||
// Register the custom deserializer
|
||||
gsonBuilder.registerTypeAdapter(MalpediaFlossed.class, deserializer);
|
||||
|
||||
// Create a Gson instance, with the custom adapter type
|
||||
Gson customGson = gsonBuilder.create();
|
||||
|
||||
/*
|
||||
* Parse the JSON into a Java object, and return the mapping from the wrapper
|
||||
* object
|
||||
*/
|
||||
return customGson.fromJson(json, MalpediaFlossed.class).getData();
|
||||
}
|
||||
|
||||
private class MalpediaFlossed {
|
||||
private Map<String, MalpediaFlossedString> data;
|
||||
|
||||
public MalpediaFlossed(Map<String, MalpediaFlossedString> data) {
|
||||
super();
|
||||
this.data = data;
|
||||
}
|
||||
|
||||
public Map<String, MalpediaFlossedString> getData() {
|
||||
return data;
|
||||
}
|
||||
}
|
||||
|
||||
private class MalpediaFlossedString {
|
||||
boolean matched;
|
||||
private List<String> encodings;
|
||||
private List<String> families;
|
||||
private Integer familyCount;
|
||||
private List<String> methods;
|
||||
private List<String> tags;
|
||||
|
||||
public MalpediaFlossedString() {
|
||||
|
||||
}
|
||||
|
||||
public MalpediaFlossedString(boolean matched, List<String> encodings, List<String> families,
|
||||
Integer familyCount, List<String> methods, List<String> tags) {
|
||||
super();
|
||||
this.matched = matched;
|
||||
this.encodings = encodings;
|
||||
this.families = families;
|
||||
this.familyCount = familyCount;
|
||||
this.methods = methods;
|
||||
this.tags = tags;
|
||||
}
|
||||
|
||||
public boolean isMatched() {
|
||||
return matched;
|
||||
}
|
||||
|
||||
public List<String> getEncodings() {
|
||||
return encodings;
|
||||
}
|
||||
|
||||
public List<String> getFamilies() {
|
||||
return families;
|
||||
}
|
||||
|
||||
public Integer getFamilyCount() {
|
||||
return familyCount;
|
||||
}
|
||||
|
||||
public List<String> getMethods() {
|
||||
return methods;
|
||||
}
|
||||
|
||||
public List<String> getTags() {
|
||||
return tags;
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user