diff --git a/app/templates/includes/navigation.html b/app/templates/includes/navigation.html index 095d5ad..89cb8e9 100644 --- a/app/templates/includes/navigation.html +++ b/app/templates/includes/navigation.html @@ -8,6 +8,7 @@ {% if 'localhost' in request.host_url %} + {% endif %} diff --git a/app/templates/list_files_results.html b/app/templates/list_files_results.html index 1e40559..91edcaa 100644 --- a/app/templates/list_files_results.html +++ b/app/templates/list_files_results.html @@ -21,7 +21,7 @@ {{outcome.fileInfo.size}} - {{outcome.fileInfo.type}} + {{outcome.fileInfo.fileType}} {{outcome.matches|length}} {% include 'includes/verifystatus.html' %} diff --git a/avred.py b/avred.py index d73d8c0..5e08360 100755 --- a/avred.py +++ b/avred.py @@ -11,7 +11,7 @@ import logging from config import Config from verifier import verify from model.model import FileInfo, Outcome -from utils import FileType, GetFileType, convertMatchesIt +from utils import FileType, GetFileType, convertMatchesIt, getFileInfo from plugins.analyzer_office import analyzeFileWord, augmentFileWord from plugins.analyzer_pe import analyzeFileExe, augmentFilePe @@ -88,14 +88,19 @@ def scanFile(args, scanner): # file ident filetype = FileType.UNKNOWN + uiFileType = 'unknown' if args.file.endswith('.ps1'): filetype = FileType.PLAIN + uiFileType = "Powershell" elif args.file.endswith('.docm'): # dotm, xlsm, xltm filetype = FileType.OFFICE + uiFileType = "Word" elif args.file.endswith('.exe'): filetype = FileType.EXE + uiFileType = "Executable" elif args.file.endswith('.bin'): filetype = FileType.PLAIN + uiFileType = "Binary" else: filetype = GetFileType(args.file) @@ -120,8 +125,10 @@ def scanFile(args, scanner): if file.isDotNet: augmenter = augmentFileDotnet + uiFileType = 'Executable DotNet' else: augmenter = augmentFilePe + uiFileType = 'Executable Pe' analyzerOptions["isolate"] = args.isolate analyzerOptions["remove"] = args.remove @@ -165,7 +172,7 @@ def scanFile(args, scanner): verification = verify(file, matches, scanner) # augment information - fileInfo = FileInfo(file.filename, 0, None) + fileInfo = getFileInfo(file, uiFileType, '') if augmenter is not None: fileStructure = augmenter(file, matches) fileInfo.fileStructure = fileStructure diff --git a/model/model.py b/model/model.py index 548a71d..96cc4d9 100644 --- a/model/model.py +++ b/model/model.py @@ -8,7 +8,6 @@ import os from model.testverify import * - class UiDisasmLine(): def __init__(self, fileOffset, rva, isPart, text, textHtml): self.offset = str(hex(fileOffset)) # offset in file @@ -25,6 +24,14 @@ class UiDisasmLine(): self.text ) return s + + + +class FileType(Enum): + UNKNOWN = 0 + EXE = 1 + OFFICE = 3 + PLAIN = 4 class Match(): @@ -75,12 +82,13 @@ class Match(): class FileInfo(): - def __init__(self, name, size, fileStructure): + def __init__(self, name, size, hash, fileType, time, fileStructure): self.name = name self.size = size + self.hash = hash + self.fileType = fileType self.fileStructure = fileStructure - self.type = '' - self.date = '' + self.date = time class Outcome(): diff --git a/tests/test_utils.py b/tests/test_utils.py index da89880..6682c9c 100644 --- a/tests/test_utils.py +++ b/tests/test_utils.py @@ -2,9 +2,10 @@ import unittest from utils import * +from plugins.file_pe import FilePe +from utils import getFileInfo - -class DotnetDisasmTest(unittest.TestCase): +class UtilsTest(unittest.TestCase): def test_magic(self): filename = "tests/data/dotnet-test.dll" type = GetFileType(filename) @@ -16,4 +17,15 @@ class DotnetDisasmTest(unittest.TestCase): filename = "tests/data/test.exe" type = GetFileType(filename) - self.assertEqual(type, FileType.EXE) \ No newline at end of file + self.assertEqual(type, FileType.EXE) + + + def test_fileInfo(self): + file = FilePe() + file.loadFromFile('tests/data/test.exe') + + fileInfo = getFileInfo(file, FileType.EXE, '') + + self.assertEqual(fileInfo.name, 'test.exe') + self.assertEqual(fileInfo.size, 89062) + self.assertEqual(fileInfo.hash, b'\xcai\xed\x146.\xfe\x01\xb0|\x9a\xd4uv\x07\xd1') diff --git a/utils.py b/utils.py index 74a64f9..af10454 100644 --- a/utils.py +++ b/utils.py @@ -6,11 +6,21 @@ from enum import Enum import base64 import magic from enum import Enum +import pathlib +import hashlib -from model.model import Match +from model.model import Match, FileInfo, FileType from model.testverify import FillType +def getFileInfo(file, fileType, fileStructure): + size = pathlib.Path(file.filepath).stat().st_size + hash = hashlib.md5(file.fileData).digest() + time = pathlib.Path(file.filepath).stat().st_ctime + fileInfo = FileInfo(file.filename, size, hash, fileType, time, fileStructure) + return fileInfo + + def saveMatchesToFile(filename, matches): # convert first results = [] @@ -47,13 +57,6 @@ def patchData(data: bytes, base: int, size: int, fillType: FillType=FillType.nul return data -class FileType(Enum): - UNKNOWN = 0 - EXE = 1 - OFFICE = 3 - PLAIN = 4 - - def GetFileType(filepath): text = magic.from_file(filepath) mime = magic.from_file(filepath, mime=True) diff --git a/verifier.py b/verifier.py index 0b0f9e4..a33f2c1 100644 --- a/verifier.py +++ b/verifier.py @@ -57,7 +57,7 @@ def verificationAnalyzer(verifications: List[VerificationEntry]) -> VerifyConclu # verifyResults is filled. check for corner cases # with FIRST_TWO, LAST_TWO - if len(verifications) >= 5: + if len(verifications) > 5: if verifyResults[0] is VerifyStatus.BAD and verifyResults[1] is VerifyStatus.BAD: ft = getMatchTestsFor(verifications, TestMatchOrder.FIRST_TWO, TestMatchModify.FULL) if ft[0].scanResult is ScanResult.NOT_DETECTED and ft[1].scanResult is ScanResult.NOT_DETECTED: