PyMISP/pymisp/tools/create_misp_object.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from pymisp.tools import FileObject, PEObject, ELFObject, MachOObject
from pymisp.exceptions import MISPObjectException
import warnings

try:
    import lief
    from lief import Logger
    Logger.disable()
    HAS_LIEF = True
except ImportError:
    HAS_LIEF = False


class FileTypeNotImplemented(MISPObjectException):
    pass


def make_pe_objects(lief_parsed, misp_file):
    pe_object = PEObject(parsed=lief_parsed)
    misp_file.add_reference(pe_object.uuid, 'included-in', 'PE indicators')
    pe_sections = []
    for s in pe_object.sections:
        pe_sections.append(s)
    return misp_file, pe_object, pe_sections


def make_elf_objects(lief_parsed, misp_file):
    elf_object = ELFObject(parsed=lief_parsed)
    misp_file.add_reference(elf_object.uuid, 'included-in', 'ELF indicators')
    elf_sections = []
    for s in elf_object.sections:
        elf_sections.append(s)
    return misp_file, elf_object, elf_sections


def make_macho_objects(lief_parsed, misp_file):
    macho_object = MachOObject(parsed=lief_parsed)
    misp_file.add_reference(macho_object.uuid, 'included-in', 'MachO indicators')
    macho_sections = []
    for s in macho_object.sections:
        macho_sections.append(s)
    return misp_file, macho_object, macho_sections


def make_binary_objects(filepath):
    misp_file = FileObject(filepath)
    if HAS_LIEF:
        try:
            lief_parsed = lief.parse(filepath)
            if isinstance(lief_parsed, lief.PE.Binary):
                return make_pe_objects(lief_parsed, misp_file)
            elif isinstance(lief_parsed, lief.ELF.Binary):
                return make_elf_objects(lief_parsed, misp_file)
            elif isinstance(lief_parsed, lief.MachO.Binary):
                return make_macho_objects(lief_parsed, misp_file)
        except lief.bad_format as e:
            warnings.warn('\tBad format: ', e)
        except lief.bad_file as e:
            warnings.warn('\tBad file: ', e)
        except lief.parser_error as e:
            warnings.warn('\tParser error: ', e)
        except FileTypeNotImplemented as e:  # noqa
            warnings.warn(e)
    else:
        warnings.warn('Please install lief, documentation here: https://github.com/lief-project/LIEF')
    return misp_file, None, None