Ejemplo n.º 1
0
def main(args):

    logging.basicConfig()

    # debug
    if args.debug:
        logger.setLevel(logging.DEBUG)

    if not args.output_path:
        logger.error("Please specify a filename to save the filters to.")
        sys.exit(0)

    # for now, process local directory
    if args.dir_path:
        logger.info("Analyzing all analyses in directory %s" % (args.dir_path))

        # Disk
        disk_filter = DiskFilter()

        for analysis_dir in os.listdir(args.dir_path):
            path = os.path.join(args.dir_path, analysis_dir)
            logger.info("Disk Filter: Analyzing %s" % path)

            diff = None

            if not args.rerun and os.path.exists(
                    os.path.join(path, 'disk_diff.txt')):
                diff = pickle.load(
                    open(os.path.join(path, 'disk_diff.txt'), 'rb'))

            else:

                dcap_uri = os.path.join(path, "dcap")

                disk_analysis = DiskAnalysis(dcap_uri, args.machine_type,
                                             args.disk_img)
                diff = disk_analysis.run()

                pickle.dump(diff,
                            open(os.path.join(path, 'disk_diff.txt'), 'wb'))

            if not diff:
                logger.error(
                    "Error processing disk analysis for %s . . . skipping!" %
                    path)
                continue

            disk_filter.add_analysis(diff)

        # adjust filter
        if not args.noadjust:
            disk_filter.adjust_filter(9)

        # write filter to disk
        f = open(args.output_path + '.disk', 'w')
        f.write(pprint.pformat(disk_filter.occurrences_dict))
        f.close()
Ejemplo n.º 2
0
 def csv_mbr(self):
     """Extract MBR and BootLoader"""
     informations = DiskAnalysis(self.output_dir)
     partition = Partitions(self.output_dir, self.logger)
     disk = Disks()
     operatingSystem = OperatingSystem()
     envVar = EnvironmentVariable()
     mbr = Mbr(self.output_dir)
     informations.os = operatingSystem.os_information(
         informations.currentMachine)
     informations.listDisks = disk.get_disk_information(
         informations.currentMachine)
     self.logger.info('MBR Extracting')
     for d in informations.listDisks:
         informations.mbrDisk = mbr.mbr_parsing(d.deviceID)
         mbr.boot_loader_disassembly()
         for p in informations.mbrDisk.partitions:
             if p.state == "ACTIVE":
                 vbr = Vbr(d.deviceID, p.sector_offset, self.output_dir)
                 self.logger.info('VBR Extracting')
                 vbr.extract_vbr()
                 vbr.vbrDisassembly()
     self.logger.info('BootLoader Extracting')
     informations.envVarList = os.environ
     informations.listPartitions = partition.partition_information(
         informations.currentMachine)
     informations.save_informations()
Ejemplo n.º 3
0
def main(args):

    logging.basicConfig()

    # debug
    if args.debug:
        logger.setLevel(logging.DEBUG)

    if not args.output_path:
        logger.error("Please specify a filename to save the filters to.")
        sys.exit(0)

    # for now, process local directory
    if args.dir_path:
        logger.info("Analyzing all analyses in directory %s" % (args.dir_path))


        # Disk
        disk_filter = DiskFilter()

        for analysis_dir in os.listdir(args.dir_path):
            path = os.path.join(args.dir_path, analysis_dir)
            logger.info("Disk Filter: Analyzing %s" % path)

            diff = None

            if not args.rerun and os.path.exists(os.path.join(path, 'disk_diff.txt')):
                diff = pickle.load(open(os.path.join(path, 'disk_diff.txt'), 'rb'))

            else:

                dcap_uri = os.path.join(path, "dcap")

                disk_analysis = DiskAnalysis(dcap_uri, args.machine_type, args.disk_img)
                diff = disk_analysis.run()

                pickle.dump(diff, open(os.path.join(path, 'disk_diff.txt'), 'wb'))

            if not diff:
                logger.error("Error processing disk analysis for %s . . . skipping!" % path)
                continue

            disk_filter.add_analysis(diff)

        # adjust filter
        if not args.noadjust:
            disk_filter.adjust_filter(9)

        # write filter to disk
        f = open(args.output_path+'.disk', 'w')
        f.write(pprint.pformat(disk_filter.occurrences_dict))
        f.close()
Ejemplo n.º 4
0
	def csv_mbr(self):
		''' Extract MBR and BootLoader '''
		informations = DiskAnalysis(self.output_dir)
		partition = Partitions(self.output_dir,self.logger)
		disk = Disks()
		operatingSystem = OperatingSystem()
		envVar = EnvironmentVariable()
		mbr = Mbr(self.output_dir)
		informations.os = operatingSystem.os_informations(informations.currentMachine)
		informations.listDisks = disk.getDiskInformations(informations.currentMachine)
		self.logger.info('MBR Extracting')
		for d in informations.listDisks:
			informations.mbrDisk = mbr.mbr_parsing(d.deviceID)
			mbr.bootLoaderDisassembly()
		self.logger.info('BootLoader Extracting')
		informations.envVarList = os.environ
		informations.listPartitions = partition.partitionInformations(informations.currentMachine)
		informations.saveInformations()
Ejemplo n.º 5
0
 def csv_mbr(self):
     """Extract MBR and BootLoader"""
     informations = DiskAnalysis(self.output_dir)
     partition = Partitions(self.output_dir, self.logger)
     disk = Disks()
     operatingSystem = OperatingSystem()
     envVar = EnvironmentVariable()
     mbr = Mbr(self.output_dir)
     informations.os = operatingSystem.os_information(informations.currentMachine)
     informations.listDisks = disk.get_disk_information(informations.currentMachine)
     self.logger.info('MBR Extracting')
     for d in informations.listDisks:
         informations.mbrDisk = mbr.mbr_parsing(d.deviceID)
         mbr.boot_loader_disassembly()
     self.logger.info('BootLoader Extracting')
     informations.envVarList = os.environ
     informations.listPartitions = partition.partition_information(informations.currentMachine)
     informations.save_informations()
Ejemplo n.º 6
0
def main(args):

    logging.basicConfig()

    # debug
    if args.debug:
        logger.setLevel(logging.DEBUG)

    if not args.output_path:
        logger.error("Please specify a filename to save the filters to.")
        sys.exit(0)

    # for now, process local directory
    if args.dir_path:
        logger.info("Analyzing all analyses in directory %s" % (args.dir_path))

        # Memory
        mem_filter = MemoryFilter()

        for analysis_dir in os.listdir(args.dir_path):
            path = os.path.join(args.dir_path, analysis_dir)
            logger.info("Memory Filter: Analyzing %s" % path)

            diff = None

            # TODO add option to redo analysis even if this file exists
            if os.path.exists(os.path.join(path, 'mem_diff.txt')):
                diff = pickle.load(open(os.path.join(path, 'mem_diff.txt'), 'rb'))

            else:

                clean_disk_uri = os.path.join(path, "sut_memory_clean.mfd")
                dirty_memory_uri = os.path.join(path, "sut_memory_dirty.mfd")

                memory_analysis = MemoryAnalysis(clean_disk_uri, dirty_memory_uri, args.profile)
                diff = memory_analysis.run()

                pickle.dump(diff, open(os.path.join(path, 'mem_diff.txt'), 'wb'))

            if not diff:
                logger.error("Error processing memory analysis for %s . . . skipping!" % path)
                continue

            mem_filter.add_analysis(diff)

        # adjust the filter
        mem_filter.adjust_filter(5)

        # write filter to disk
        # pprint.pprint(mem_filter.occurrences_dict)
        f = open(args.output_path+'.mem', 'w')
        f.write(pprint.pformat(mem_filter.occurrences_dict))
        f.close()

        # Disk
        disk_filter = DiskFilter()

        for analysis_dir in os.listdir(args.dir_path):
            path = os.path.join(args.dir_path, analysis_dir)
            logger.info("Disk Filter: Analyzing %s" % path)

            diff = None

            # TODO add option to redo analysis even if this file exists
            if os.path.exists(os.path.join(path, 'disk_diff.txt')):
                diff = pickle.load(open(os.path.join(path, 'disk_diff.txt'), 'rb'))

            else:

                dcap_uri = os.path.join(path, "dcap")

                disk_analysis = DiskAnalysis(dcap_uri, args.machine_type, args.disk_img)
                diff = disk_analysis.run()

                pickle.dump(diff, open(os.path.join(path, 'disk_diff.txt'), 'wb'))

            if not diff:
                logger.error("Error processing disk analysis for %s . . . skipping!" % path)
                continue

            disk_filter.add_analysis(diff)

        # adjust filter
        disk_filter.adjust_filter(5)

        # write filter to disk
        f = open(args.output_path+'.disk', 'w')
        f.write(pprint.pformat(disk_filter.occurrences_dict))
        f.close()