feature: complete fileinfo

app/templates/includes/navigation.html

@@ -8,6 +8,7 @@
                 <li class="nav-item"><a class="nav-link {{ 'active' if request.path == '/upload' else '' }}" href="/upload">Upload</a></li>
                 {% if 'localhost' in request.host_url %}
                 <li class="nav-item"><a class="nav-link {{ 'active' if request.path == '/files' else '' }}" href="/files">Files</a></li>
+                <li class="nav-item"><a class="nav-link {{ 'active' if request.path == '/files_results' else '' }}" href="/files_results">FilesResults</a></li>
                 {% endif %}
                 <li class="nav-item"><a class="nav-link {{ 'active' if request.path.startswith('/file') else ''}}" href="/file/F156AC6CB5D5655B.test1.exe">File</a></li>
             </ul>

app/templates/list_files_results.html

@@ -21,7 +21,7 @@
                 </a>
             </td>
             <td>{{outcome.fileInfo.size}}</td>
-            <td>{{outcome.fileInfo.type}}</td>
+            <td>{{outcome.fileInfo.fileType}}</td>
             <td>{{outcome.matches|length}}</td>
 
             {% include 'includes/verifystatus.html' %}

avred.py

@@ -11,7 +11,7 @@ import logging
 from config import Config
 from verifier import verify
 from model.model import FileInfo, Outcome
-from utils import FileType, GetFileType, convertMatchesIt
+from utils import FileType, GetFileType, convertMatchesIt, getFileInfo
 
 from plugins.analyzer_office import analyzeFileWord, augmentFileWord
 from plugins.analyzer_pe import analyzeFileExe, augmentFilePe
@@ -88,14 +88,19 @@ def scanFile(args, scanner):
 
     # file ident
     filetype = FileType.UNKNOWN
+    uiFileType = 'unknown'
     if args.file.endswith('.ps1'):
         filetype = FileType.PLAIN
+        uiFileType = "Powershell"
     elif args.file.endswith('.docm'):  # dotm, xlsm, xltm
         filetype = FileType.OFFICE
+        uiFileType = "Word"
     elif args.file.endswith('.exe'):
         filetype = FileType.EXE
+        uiFileType = "Executable"
     elif args.file.endswith('.bin'):
         filetype = FileType.PLAIN
+        uiFileType = "Binary"
     else: 
         filetype = GetFileType(args.file)
 
@@ -120,8 +125,10 @@ def scanFile(args, scanner):
 
         if file.isDotNet:
             augmenter = augmentFileDotnet
+            uiFileType = 'Executable DotNet'
         else:
             augmenter = augmentFilePe
+            uiFileType = 'Executable Pe'
 
         analyzerOptions["isolate"] = args.isolate
         analyzerOptions["remove"] = args.remove
@@ -165,7 +172,7 @@ def scanFile(args, scanner):
         verification = verify(file, matches, scanner)
 
     # augment information
-    fileInfo = FileInfo(file.filename, 0, None)
+    fileInfo = getFileInfo(file, uiFileType, '')
     if augmenter is not None:
         fileStructure = augmenter(file, matches)
         fileInfo.fileStructure = fileStructure

model/model.py

@@ -8,7 +8,6 @@ import os
 from model.testverify import *
 
 
-
 class UiDisasmLine():
     def __init__(self, fileOffset, rva, isPart, text, textHtml):
         self.offset = str(hex(fileOffset))  # offset in file
@@ -25,6 +24,14 @@ class UiDisasmLine():
             self.text
         )
         return s
+
+
+
+class FileType(Enum):
+    UNKNOWN = 0
+    EXE = 1
+    OFFICE = 3
+    PLAIN = 4
     
 
 class Match():
@@ -75,12 +82,13 @@ class Match():
 
 
 class FileInfo():
-    def __init__(self, name, size, fileStructure):
+    def __init__(self, name, size, hash, fileType, time, fileStructure):
         self.name = name
         self.size = size
+        self.hash = hash
+        self.fileType = fileType
         self.fileStructure = fileStructure
-        self.type = ''
-        self.date = ''
+        self.date = time
 
 
 class Outcome():

tests/test_utils.py

@@ -2,9 +2,10 @@
 
 import unittest
 from utils import *
+from plugins.file_pe import FilePe
+from utils import getFileInfo
 
-
-class DotnetDisasmTest(unittest.TestCase):
+class UtilsTest(unittest.TestCase):
     def test_magic(self):
         filename = "tests/data/dotnet-test.dll"
         type = GetFileType(filename) 
@@ -16,4 +17,15 @@ class DotnetDisasmTest(unittest.TestCase):
 
         filename = "tests/data/test.exe"
         type = GetFileType(filename) 
-        self.assertEqual(type, FileType.EXE)
+        self.assertEqual(type, FileType.EXE)
+
+
+    def test_fileInfo(self):
+        file = FilePe()
+        file.loadFromFile('tests/data/test.exe')
+
+        fileInfo = getFileInfo(file, FileType.EXE, '')
+
+        self.assertEqual(fileInfo.name, 'test.exe')
+        self.assertEqual(fileInfo.size, 89062)
+        self.assertEqual(fileInfo.hash, b'\xcai\xed\x146.\xfe\x01\xb0|\x9a\xd4uv\x07\xd1')

utils.py

@@ -6,11 +6,21 @@ from enum import Enum
 import base64
 import magic
 from enum import Enum
+import pathlib
+import hashlib
 
-from model.model import Match
+from model.model import Match, FileInfo, FileType
 from model.testverify import FillType
 
 
+def getFileInfo(file, fileType, fileStructure):
+    size = pathlib.Path(file.filepath).stat().st_size
+    hash = hashlib.md5(file.fileData).digest()
+    time = pathlib.Path(file.filepath).stat().st_ctime
+    fileInfo = FileInfo(file.filename, size, hash, fileType, time, fileStructure)
+    return fileInfo
+
+
 def saveMatchesToFile(filename, matches):
     # convert first
     results = []
@@ -47,13 +57,6 @@ def patchData(data: bytes, base: int, size: int, fillType: FillType=FillType.nul
     return data
 
 
-class FileType(Enum):
-    UNKNOWN = 0
-    EXE = 1
-    OFFICE = 3
-    PLAIN = 4
-    
-
 def GetFileType(filepath):
     text = magic.from_file(filepath)
     mime = magic.from_file(filepath, mime=True)

verifier.py

@@ -57,7 +57,7 @@ def verificationAnalyzer(verifications: List[VerificationEntry]) -> VerifyConclu
     # verifyResults is filled. check for corner cases
 
     # with FIRST_TWO, LAST_TWO
-    if len(verifications) >= 5:
+    if len(verifications) > 5:
         if verifyResults[0] is VerifyStatus.BAD and verifyResults[1] is VerifyStatus.BAD:
             ft = getMatchTestsFor(verifications, TestMatchOrder.FIRST_TWO, TestMatchModify.FULL)            
             if ft[0].scanResult is ScanResult.NOT_DETECTED and ft[1].scanResult is ScanResult.NOT_DETECTED: