PyMISP/pymisp/tools/create_misp_object.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from pymisp.tools import FileObject, PEObject, MISPObjectException

try:
    import lief
    HAS_LIEF = True
except ImportError:
    HAS_LIEF = False


class FileTypeNotImplemented(MISPObjectException):
    pass


def make_pe_objects(lief_parsed, misp_file):
    misp_pe = PEObject(parsed=lief_parsed)
    misp_file.add_reference(misp_pe.uuid, 'included-in', 'PE indicators')
    file_object = misp_file
    pe_object = misp_pe
    pe_sections = []
    for s in misp_pe.sections:
        pe_sections.append(s)
    return file_object, pe_object, pe_sections


def make_binary_objects(filepath):
    if not HAS_LIEF:
        raise ImportError('Please install lief, documentation here: https://github.com/lief-project/LIEF')
    misp_file = FileObject(filepath)
    try:
        lief_parsed = lief.parse(filepath)
        if isinstance(lief_parsed, lief.PE.Binary):
            return make_pe_objects(lief_parsed, misp_file)
        elif isinstance(lief_parsed, lief.ELF.Binary):
            raise FileTypeNotImplemented('ELF not implemented yet.')
        elif isinstance(lief_parsed, lief.MachO.Binary):
            raise FileTypeNotImplemented('MachO not implemented yet.')
    except lief.bad_format as e:
        print('\tBad format: ', e)
    except lief.bad_file as e:
        print('\tBad file: ', e)
    except lief.parser_error as e:
        print('\tParser error: ', e)
    except FileTypeNotImplemented as e:
        print(e)
    file_object = misp_file.to_json()
    return file_object, None, None