MISP
/
PyMISP
mirror of https://github.com/MISP/PyMISP
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: Update lief code to v0.13

pull/977/head v2.4.170.1
Raphaël Vinot 2023-04-19 11:47:41 +03:00
parent b8949399ad
commit 75435df663
4 changed files with 23 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
pymisp/tools/create_misp_object.py
View File

@ -11,7 +11,7 @@ from typing import Optional
logger = logging.getLogger('pymisp') logger = logging.getLogger('pymisp')
try: try:
import lief # type: ignore import lief
lief.logging.disable() lief.logging.disable()
HAS_LIEF = True HAS_LIEF = True
@ -35,40 +35,23 @@ def make_binary_objects(filepath: Optional[str] = None, pseudofile: Optional[Byt
misp_file = FileObject(filepath=filepath, pseudofile=pseudofile, filename=filename, misp_file = FileObject(filepath=filepath, pseudofile=pseudofile, filename=filename,
standalone=standalone, default_attributes_parameters=default_attributes_parameters) standalone=standalone, default_attributes_parameters=default_attributes_parameters)
if HAS_LIEF and (filepath or (pseudofile and filename)): if HAS_LIEF and (filepath or (pseudofile and filename)):
try: if filepath:
if filepath: lief_parsed = lief.parse(filepath=filepath)
lief_parsed = lief.parse(filepath=filepath) elif pseudofile and filename:
elif pseudofile and filename: lief_parsed = lief.parse(raw=pseudofile.getvalue(), name=filename)
lief_parsed = lief.parse(raw=pseudofile.getvalue(), name=filename) if isinstance(lief_parsed, lief.lief_errors):
else: logger.warning('Got an error parsing the file: {lief_parsed}')
logger.critical('You need either a filepath, or a pseudofile and a filename.') elif isinstance(lief_parsed, lief.PE.Binary):
lief_parsed = None
if isinstance(lief_parsed, lief.PE.Binary):
return make_pe_objects(lief_parsed, misp_file, standalone, default_attributes_parameters) return make_pe_objects(lief_parsed, misp_file, standalone, default_attributes_parameters)
elif isinstance(lief_parsed, lief.ELF.Binary): elif isinstance(lief_parsed, lief.ELF.Binary):
return make_elf_objects(lief_parsed, misp_file, standalone, default_attributes_parameters) return make_elf_objects(lief_parsed, misp_file, standalone, default_attributes_parameters)
elif isinstance(lief_parsed, lief.MachO.Binary): elif isinstance(lief_parsed, lief.MachO.Binary):
return make_macho_objects(lief_parsed, misp_file, standalone, default_attributes_parameters) return make_macho_objects(lief_parsed, misp_file, standalone, default_attributes_parameters)
except lief.bad_format as e: else:
logger.warning('Bad format: {}'.format(e)) logger.critical(f'Unexpected type from lief: {type(lief_parsed)}')
except lief.bad_file as e: else:
logger.warning('Bad file: {}'.format(e)) logger.critical('You need either a filepath, or a pseudofile and a filename.')
except lief.conversion_error as e: lief_parsed = None
logger.warning('Conversion file: {}'.format(e))
except lief.builder_error as e:
logger.warning('Builder file: {}'.format(e))
except lief.parser_error as e:
logger.warning('Parser error: {}'.format(e))
except lief.integrity_error as e:
logger.warning('Integrity error: {}'.format(e))
except lief.pe_error as e:
logger.warning('PE error: {}'.format(e))
except lief.type_error as e:
logger.warning('Type error: {}'.format(e))
except lief.exception as e:
logger.warning('Lief exception: {}'.format(e))
except FileTypeNotImplemented as e:
logger.warning(e)
if not HAS_LIEF: if not HAS_LIEF:
logger.warning('Please install lief, documentation here: https://github.com/lief-project/LIEF') logger.warning('Please install lief, documentation here: https://github.com/lief-project/LIEF')
return misp_file, None, [] return misp_file, None, []

8
pymisp/tools/elfobject.py
View File

@ -10,7 +10,7 @@ from typing import Union, Optional
from pathlib import Path from pathlib import Path
from . import FileObject from . import FileObject
import lief # type: ignore import lief
try: try:
import pydeep # type: ignore import pydeep # type: ignore
@ -21,7 +21,7 @@ except ImportError:
logger = logging.getLogger('pymisp') logger = logging.getLogger('pymisp')
def make_elf_objects(lief_parsed: lief.Binary, misp_file: FileObject, standalone: bool = True, default_attributes_parameters: dict = {}): def make_elf_objects(lief_parsed: lief.ELF.Binary, misp_file: FileObject, standalone: bool = True, default_attributes_parameters: dict = {}):
elf_object = ELFObject(parsed=lief_parsed, standalone=standalone, default_attributes_parameters=default_attributes_parameters) elf_object = ELFObject(parsed=lief_parsed, standalone=standalone, default_attributes_parameters=default_attributes_parameters)
misp_file.add_reference(elf_object.uuid, 'includes', 'ELF indicators') misp_file.add_reference(elf_object.uuid, 'includes', 'ELF indicators')
elf_sections = [] elf_sections = []
@ -32,14 +32,14 @@ def make_elf_objects(lief_parsed: lief.Binary, misp_file: FileObject, standalone
class ELFObject(AbstractMISPObjectGenerator): class ELFObject(AbstractMISPObjectGenerator):
def __init__(self, parsed: Optional[lief.ELF.Binary] = None, filepath: Optional[Union[Path, str]] = None, pseudofile: Optional[Union[BytesIO, bytes]] = None, **kwargs): def __init__(self, parsed: Optional[lief.ELF.Binary] = None, filepath: Optional[Union[Path, str]] = None, pseudofile: Optional[BytesIO] = None, **kwargs):
"""Creates an ELF object, with lief""" """Creates an ELF object, with lief"""
super().__init__('elf', **kwargs) super().__init__('elf', **kwargs)
if not HAS_PYDEEP: if not HAS_PYDEEP:
logger.warning("pydeep is missing, please install pymisp this way: pip install pymisp[fileobjects]") logger.warning("pydeep is missing, please install pymisp this way: pip install pymisp[fileobjects]")
if pseudofile: if pseudofile:
if isinstance(pseudofile, BytesIO): if isinstance(pseudofile, BytesIO):
self.__elf = lief.ELF.parse(raw=pseudofile.getvalue()) self.__elf = lief.ELF.parse(io=pseudofile)
elif isinstance(pseudofile, bytes): elif isinstance(pseudofile, bytes):
self.__elf = lief.ELF.parse(raw=pseudofile) self.__elf = lief.ELF.parse(raw=pseudofile)
else: else:

6
pymisp/tools/machoobject.py
View File

@ -10,7 +10,7 @@ from typing import Optional, Union
from pathlib import Path from pathlib import Path
from . import FileObject from . import FileObject
import lief # type: ignore import lief
try: try:
import pydeep # type: ignore import pydeep # type: ignore
@ -21,7 +21,7 @@ except ImportError:
logger = logging.getLogger('pymisp') logger = logging.getLogger('pymisp')
def make_macho_objects(lief_parsed: lief.Binary, misp_file: FileObject, standalone: bool = True, default_attributes_parameters: dict = {}): def make_macho_objects(lief_parsed: lief.MachO.Binary, misp_file: FileObject, standalone: bool = True, default_attributes_parameters: dict = {}):
macho_object = MachOObject(parsed=lief_parsed, standalone=standalone, default_attributes_parameters=default_attributes_parameters) macho_object = MachOObject(parsed=lief_parsed, standalone=standalone, default_attributes_parameters=default_attributes_parameters)
misp_file.add_reference(macho_object.uuid, 'includes', 'MachO indicators') misp_file.add_reference(macho_object.uuid, 'includes', 'MachO indicators')
macho_sections = [] macho_sections = []
@ -39,7 +39,7 @@ class MachOObject(AbstractMISPObjectGenerator):
logger.warning("pydeep is missing, please install pymisp this way: pip install pymisp[fileobjects]") logger.warning("pydeep is missing, please install pymisp this way: pip install pymisp[fileobjects]")
if pseudofile: if pseudofile:
if isinstance(pseudofile, BytesIO): if isinstance(pseudofile, BytesIO):
self.__macho = lief.MachO.parse(raw=pseudofile.getvalue()) self.__macho = lief.MachO.parse(io=pseudofile)
elif isinstance(pseudofile, bytes): elif isinstance(pseudofile, bytes):
self.__macho = lief.MachO.parse(raw=pseudofile) self.__macho = lief.MachO.parse(raw=pseudofile)
else: else:

6
pymisp/tools/peobject.py
View File

@ -13,7 +13,7 @@ from base64 import b64encode
from . import FileObject from . import FileObject
import lief # type: ignore import lief
try: try:
import pydeep # type: ignore import pydeep # type: ignore
@ -24,7 +24,7 @@ except ImportError:
logger = logging.getLogger('pymisp') logger = logging.getLogger('pymisp')
def make_pe_objects(lief_parsed: lief.Binary, misp_file: FileObject, standalone: bool = True, default_attributes_parameters: dict = {}): def make_pe_objects(lief_parsed: lief.PE.Binary, misp_file: FileObject, standalone: bool = True, default_attributes_parameters: dict = {}):
pe_object = PEObject(parsed=lief_parsed, standalone=standalone, default_attributes_parameters=default_attributes_parameters) pe_object = PEObject(parsed=lief_parsed, standalone=standalone, default_attributes_parameters=default_attributes_parameters)
misp_file.add_reference(pe_object.uuid, 'includes', 'PE indicators') misp_file.add_reference(pe_object.uuid, 'includes', 'PE indicators')
pe_sections = [] pe_sections = []
@ -42,7 +42,7 @@ class PEObject(AbstractMISPObjectGenerator):
logger.warning("pydeep is missing, please install pymisp this way: pip install pymisp[fileobjects]") logger.warning("pydeep is missing, please install pymisp this way: pip install pymisp[fileobjects]")
if pseudofile: if pseudofile:
if isinstance(pseudofile, BytesIO): if isinstance(pseudofile, BytesIO):
self.__pe = lief.PE.parse(raw=pseudofile.getvalue()) self.__pe = lief.PE.parse(io=pseudofile)
elif isinstance(pseudofile, bytes): elif isinstance(pseudofile, bytes):
self.__pe = lief.PE.parse(raw=pseudofile) self.__pe = lief.PE.parse(raw=pseudofile)
else: else: