mirror of https://github.com/MISP/PyMISP
Add support for ELF and MachO objects
parent
f66af15c62
commit
44008d1c0c
|
@ -1 +1 @@
|
||||||
Subproject commit 96d7aeb0729428a43f38f45b6c00a60b9fdba2b6
|
Subproject commit fc6d54f93b47d9c2ca951d68e568d1715e6eabf0
|
|
@ -1,5 +1,7 @@
|
||||||
from .neo4j import Neo4j
|
from .neo4j import Neo4j # noqa
|
||||||
from .objectgenerator import MISPObjectGenerator, MISPObjectException, InvalidMISPObject
|
from .objectgenerator import MISPObjectGenerator, MISPObjectException, InvalidMISPObject # noqa
|
||||||
from .fileobject import FileObject
|
from .fileobject import FileObject # noqa
|
||||||
from .peobject import PEObject, PESectionObject
|
from .peobject import PEObject, PESectionObject # noqa
|
||||||
from .create_misp_object import make_binary_objects
|
from .elfobject import ELFObject, ELFSectionObject # noqa
|
||||||
|
from .machoobject import MachOObject, MachOSectionObject # noqa
|
||||||
|
from .create_misp_object import make_binary_objects # noqa
|
||||||
|
|
|
@ -1,10 +1,12 @@
|
||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
# -*- coding: utf-8 -*-
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
from pymisp.tools import FileObject, PEObject, MISPObjectException
|
from pymisp.tools import FileObject, PEObject, ELFObject, MachOObject, MISPObjectException
|
||||||
|
|
||||||
try:
|
try:
|
||||||
import lief
|
import lief
|
||||||
|
from lief import Logger
|
||||||
|
Logger.disable()
|
||||||
HAS_LIEF = True
|
HAS_LIEF = True
|
||||||
except ImportError:
|
except ImportError:
|
||||||
HAS_LIEF = False
|
HAS_LIEF = False
|
||||||
|
@ -15,14 +17,30 @@ class FileTypeNotImplemented(MISPObjectException):
|
||||||
|
|
||||||
|
|
||||||
def make_pe_objects(lief_parsed, misp_file):
|
def make_pe_objects(lief_parsed, misp_file):
|
||||||
misp_pe = PEObject(parsed=lief_parsed)
|
pe_object = PEObject(parsed=lief_parsed)
|
||||||
misp_file.add_reference(misp_pe.uuid, 'included-in', 'PE indicators')
|
misp_file.add_reference(pe_object.uuid, 'included-in', 'PE indicators')
|
||||||
file_object = misp_file
|
|
||||||
pe_object = misp_pe
|
|
||||||
pe_sections = []
|
pe_sections = []
|
||||||
for s in misp_pe.sections:
|
for s in pe_object.sections:
|
||||||
pe_sections.append(s)
|
pe_sections.append(s)
|
||||||
return file_object, pe_object, pe_sections
|
return misp_file, pe_object, pe_sections
|
||||||
|
|
||||||
|
|
||||||
|
def make_elf_objects(lief_parsed, misp_file):
|
||||||
|
elf_object = ELFObject(parsed=lief_parsed)
|
||||||
|
misp_file.add_reference(elf_object.uuid, 'included-in', 'ELF indicators')
|
||||||
|
elf_sections = []
|
||||||
|
for s in elf_object.sections:
|
||||||
|
elf_sections.append(s)
|
||||||
|
return misp_file, elf_object, elf_sections
|
||||||
|
|
||||||
|
|
||||||
|
def make_macho_objects(lief_parsed, misp_file):
|
||||||
|
macho_object = MachOObject(parsed=lief_parsed)
|
||||||
|
misp_file.add_reference(macho_object.uuid, 'included-in', 'MachO indicators')
|
||||||
|
macho_sections = []
|
||||||
|
for s in macho_object.sections:
|
||||||
|
macho_sections.append(s)
|
||||||
|
return misp_file, macho_object, macho_sections
|
||||||
|
|
||||||
|
|
||||||
def make_binary_objects(filepath):
|
def make_binary_objects(filepath):
|
||||||
|
@ -34,16 +52,19 @@ def make_binary_objects(filepath):
|
||||||
if isinstance(lief_parsed, lief.PE.Binary):
|
if isinstance(lief_parsed, lief.PE.Binary):
|
||||||
return make_pe_objects(lief_parsed, misp_file)
|
return make_pe_objects(lief_parsed, misp_file)
|
||||||
elif isinstance(lief_parsed, lief.ELF.Binary):
|
elif isinstance(lief_parsed, lief.ELF.Binary):
|
||||||
raise FileTypeNotImplemented('ELF not implemented yet.')
|
return make_elf_objects(lief_parsed, misp_file)
|
||||||
elif isinstance(lief_parsed, lief.MachO.Binary):
|
elif isinstance(lief_parsed, lief.MachO.Binary):
|
||||||
raise FileTypeNotImplemented('MachO not implemented yet.')
|
return make_macho_objects(lief_parsed, misp_file)
|
||||||
except lief.bad_format as e:
|
except lief.bad_format as e:
|
||||||
print('\tBad format: ', e)
|
# print('\tBad format: ', e)
|
||||||
|
pass
|
||||||
except lief.bad_file as e:
|
except lief.bad_file as e:
|
||||||
print('\tBad file: ', e)
|
# print('\tBad file: ', e)
|
||||||
|
pass
|
||||||
except lief.parser_error as e:
|
except lief.parser_error as e:
|
||||||
print('\tParser error: ', e)
|
# print('\tParser error: ', e)
|
||||||
except FileTypeNotImplemented as e:
|
pass
|
||||||
print(e)
|
except FileTypeNotImplemented as e: # noqa
|
||||||
file_object = misp_file.to_json()
|
# print(e)
|
||||||
return file_object, None, None
|
pass
|
||||||
|
return misp_file, None, None
|
||||||
|
|
Loading…
Reference in New Issue