diff --git a/app/templates/includes/navigation.html b/app/templates/includes/navigation.html
index 095d5ad..89cb8e9 100644
--- a/app/templates/includes/navigation.html
+++ b/app/templates/includes/navigation.html
@@ -8,6 +8,7 @@
Upload
{% if 'localhost' in request.host_url %}
Files
+ FilesResults
{% endif %}
File
diff --git a/app/templates/list_files_results.html b/app/templates/list_files_results.html
index 1e40559..91edcaa 100644
--- a/app/templates/list_files_results.html
+++ b/app/templates/list_files_results.html
@@ -21,7 +21,7 @@
{{outcome.fileInfo.size}} |
- {{outcome.fileInfo.type}} |
+ {{outcome.fileInfo.fileType}} |
{{outcome.matches|length}} |
{% include 'includes/verifystatus.html' %}
diff --git a/avred.py b/avred.py
index d73d8c0..5e08360 100755
--- a/avred.py
+++ b/avred.py
@@ -11,7 +11,7 @@ import logging
from config import Config
from verifier import verify
from model.model import FileInfo, Outcome
-from utils import FileType, GetFileType, convertMatchesIt
+from utils import FileType, GetFileType, convertMatchesIt, getFileInfo
from plugins.analyzer_office import analyzeFileWord, augmentFileWord
from plugins.analyzer_pe import analyzeFileExe, augmentFilePe
@@ -88,14 +88,19 @@ def scanFile(args, scanner):
# file ident
filetype = FileType.UNKNOWN
+ uiFileType = 'unknown'
if args.file.endswith('.ps1'):
filetype = FileType.PLAIN
+ uiFileType = "Powershell"
elif args.file.endswith('.docm'): # dotm, xlsm, xltm
filetype = FileType.OFFICE
+ uiFileType = "Word"
elif args.file.endswith('.exe'):
filetype = FileType.EXE
+ uiFileType = "Executable"
elif args.file.endswith('.bin'):
filetype = FileType.PLAIN
+ uiFileType = "Binary"
else:
filetype = GetFileType(args.file)
@@ -120,8 +125,10 @@ def scanFile(args, scanner):
if file.isDotNet:
augmenter = augmentFileDotnet
+ uiFileType = 'Executable DotNet'
else:
augmenter = augmentFilePe
+ uiFileType = 'Executable Pe'
analyzerOptions["isolate"] = args.isolate
analyzerOptions["remove"] = args.remove
@@ -165,7 +172,7 @@ def scanFile(args, scanner):
verification = verify(file, matches, scanner)
# augment information
- fileInfo = FileInfo(file.filename, 0, None)
+ fileInfo = getFileInfo(file, uiFileType, '')
if augmenter is not None:
fileStructure = augmenter(file, matches)
fileInfo.fileStructure = fileStructure
diff --git a/model/model.py b/model/model.py
index 548a71d..96cc4d9 100644
--- a/model/model.py
+++ b/model/model.py
@@ -8,7 +8,6 @@ import os
from model.testverify import *
-
class UiDisasmLine():
def __init__(self, fileOffset, rva, isPart, text, textHtml):
self.offset = str(hex(fileOffset)) # offset in file
@@ -25,6 +24,14 @@ class UiDisasmLine():
self.text
)
return s
+
+
+
+class FileType(Enum):
+ UNKNOWN = 0
+ EXE = 1
+ OFFICE = 3
+ PLAIN = 4
class Match():
@@ -75,12 +82,13 @@ class Match():
class FileInfo():
- def __init__(self, name, size, fileStructure):
+ def __init__(self, name, size, hash, fileType, time, fileStructure):
self.name = name
self.size = size
+ self.hash = hash
+ self.fileType = fileType
self.fileStructure = fileStructure
- self.type = ''
- self.date = ''
+ self.date = time
class Outcome():
diff --git a/tests/test_utils.py b/tests/test_utils.py
index da89880..6682c9c 100644
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -2,9 +2,10 @@
import unittest
from utils import *
+from plugins.file_pe import FilePe
+from utils import getFileInfo
-
-class DotnetDisasmTest(unittest.TestCase):
+class UtilsTest(unittest.TestCase):
def test_magic(self):
filename = "tests/data/dotnet-test.dll"
type = GetFileType(filename)
@@ -16,4 +17,15 @@ class DotnetDisasmTest(unittest.TestCase):
filename = "tests/data/test.exe"
type = GetFileType(filename)
- self.assertEqual(type, FileType.EXE)
\ No newline at end of file
+ self.assertEqual(type, FileType.EXE)
+
+
+ def test_fileInfo(self):
+ file = FilePe()
+ file.loadFromFile('tests/data/test.exe')
+
+ fileInfo = getFileInfo(file, FileType.EXE, '')
+
+ self.assertEqual(fileInfo.name, 'test.exe')
+ self.assertEqual(fileInfo.size, 89062)
+ self.assertEqual(fileInfo.hash, b'\xcai\xed\x146.\xfe\x01\xb0|\x9a\xd4uv\x07\xd1')
diff --git a/utils.py b/utils.py
index 74a64f9..af10454 100644
--- a/utils.py
+++ b/utils.py
@@ -6,11 +6,21 @@ from enum import Enum
import base64
import magic
from enum import Enum
+import pathlib
+import hashlib
-from model.model import Match
+from model.model import Match, FileInfo, FileType
from model.testverify import FillType
+def getFileInfo(file, fileType, fileStructure):
+ size = pathlib.Path(file.filepath).stat().st_size
+ hash = hashlib.md5(file.fileData).digest()
+ time = pathlib.Path(file.filepath).stat().st_ctime
+ fileInfo = FileInfo(file.filename, size, hash, fileType, time, fileStructure)
+ return fileInfo
+
+
def saveMatchesToFile(filename, matches):
# convert first
results = []
@@ -47,13 +57,6 @@ def patchData(data: bytes, base: int, size: int, fillType: FillType=FillType.nul
return data
-class FileType(Enum):
- UNKNOWN = 0
- EXE = 1
- OFFICE = 3
- PLAIN = 4
-
-
def GetFileType(filepath):
text = magic.from_file(filepath)
mime = magic.from_file(filepath, mime=True)
diff --git a/verifier.py b/verifier.py
index 0b0f9e4..a33f2c1 100644
--- a/verifier.py
+++ b/verifier.py
@@ -57,7 +57,7 @@ def verificationAnalyzer(verifications: List[VerificationEntry]) -> VerifyConclu
# verifyResults is filled. check for corner cases
# with FIRST_TWO, LAST_TWO
- if len(verifications) >= 5:
+ if len(verifications) > 5:
if verifyResults[0] is VerifyStatus.BAD and verifyResults[1] is VerifyStatus.BAD:
ft = getMatchTestsFor(verifications, TestMatchOrder.FIRST_TWO, TestMatchModify.FULL)
if ft[0].scanResult is ScanResult.NOT_DETECTED and ft[1].scanResult is ScanResult.NOT_DETECTED: