def main(args): logging.basicConfig() # debug if args.debug: logger.setLevel(logging.DEBUG) if not args.output_path: logger.error("Please specify a filename to save the filters to.") sys.exit(0) # for now, process local directory if args.dir_path: logger.info("Analyzing all analyses in directory %s" % (args.dir_path)) # Disk disk_filter = DiskFilter() for analysis_dir in os.listdir(args.dir_path): path = os.path.join(args.dir_path, analysis_dir) logger.info("Disk Filter: Analyzing %s" % path) diff = None if not args.rerun and os.path.exists( os.path.join(path, 'disk_diff.txt')): diff = pickle.load( open(os.path.join(path, 'disk_diff.txt'), 'rb')) else: dcap_uri = os.path.join(path, "dcap") disk_analysis = DiskAnalysis(dcap_uri, args.machine_type, args.disk_img) diff = disk_analysis.run() pickle.dump(diff, open(os.path.join(path, 'disk_diff.txt'), 'wb')) if not diff: logger.error( "Error processing disk analysis for %s . . . skipping!" % path) continue disk_filter.add_analysis(diff) # adjust filter if not args.noadjust: disk_filter.adjust_filter(9) # write filter to disk f = open(args.output_path + '.disk', 'w') f.write(pprint.pformat(disk_filter.occurrences_dict)) f.close()
def csv_mbr(self): """Extract MBR and BootLoader""" informations = DiskAnalysis(self.output_dir) partition = Partitions(self.output_dir, self.logger) disk = Disks() operatingSystem = OperatingSystem() envVar = EnvironmentVariable() mbr = Mbr(self.output_dir) informations.os = operatingSystem.os_information( informations.currentMachine) informations.listDisks = disk.get_disk_information( informations.currentMachine) self.logger.info('MBR Extracting') for d in informations.listDisks: informations.mbrDisk = mbr.mbr_parsing(d.deviceID) mbr.boot_loader_disassembly() for p in informations.mbrDisk.partitions: if p.state == "ACTIVE": vbr = Vbr(d.deviceID, p.sector_offset, self.output_dir) self.logger.info('VBR Extracting') vbr.extract_vbr() vbr.vbrDisassembly() self.logger.info('BootLoader Extracting') informations.envVarList = os.environ informations.listPartitions = partition.partition_information( informations.currentMachine) informations.save_informations()
def main(args): logging.basicConfig() # debug if args.debug: logger.setLevel(logging.DEBUG) if not args.output_path: logger.error("Please specify a filename to save the filters to.") sys.exit(0) # for now, process local directory if args.dir_path: logger.info("Analyzing all analyses in directory %s" % (args.dir_path)) # Disk disk_filter = DiskFilter() for analysis_dir in os.listdir(args.dir_path): path = os.path.join(args.dir_path, analysis_dir) logger.info("Disk Filter: Analyzing %s" % path) diff = None if not args.rerun and os.path.exists(os.path.join(path, 'disk_diff.txt')): diff = pickle.load(open(os.path.join(path, 'disk_diff.txt'), 'rb')) else: dcap_uri = os.path.join(path, "dcap") disk_analysis = DiskAnalysis(dcap_uri, args.machine_type, args.disk_img) diff = disk_analysis.run() pickle.dump(diff, open(os.path.join(path, 'disk_diff.txt'), 'wb')) if not diff: logger.error("Error processing disk analysis for %s . . . skipping!" % path) continue disk_filter.add_analysis(diff) # adjust filter if not args.noadjust: disk_filter.adjust_filter(9) # write filter to disk f = open(args.output_path+'.disk', 'w') f.write(pprint.pformat(disk_filter.occurrences_dict)) f.close()
def csv_mbr(self): ''' Extract MBR and BootLoader ''' informations = DiskAnalysis(self.output_dir) partition = Partitions(self.output_dir,self.logger) disk = Disks() operatingSystem = OperatingSystem() envVar = EnvironmentVariable() mbr = Mbr(self.output_dir) informations.os = operatingSystem.os_informations(informations.currentMachine) informations.listDisks = disk.getDiskInformations(informations.currentMachine) self.logger.info('MBR Extracting') for d in informations.listDisks: informations.mbrDisk = mbr.mbr_parsing(d.deviceID) mbr.bootLoaderDisassembly() self.logger.info('BootLoader Extracting') informations.envVarList = os.environ informations.listPartitions = partition.partitionInformations(informations.currentMachine) informations.saveInformations()
def csv_mbr(self): """Extract MBR and BootLoader""" informations = DiskAnalysis(self.output_dir) partition = Partitions(self.output_dir, self.logger) disk = Disks() operatingSystem = OperatingSystem() envVar = EnvironmentVariable() mbr = Mbr(self.output_dir) informations.os = operatingSystem.os_information(informations.currentMachine) informations.listDisks = disk.get_disk_information(informations.currentMachine) self.logger.info('MBR Extracting') for d in informations.listDisks: informations.mbrDisk = mbr.mbr_parsing(d.deviceID) mbr.boot_loader_disassembly() self.logger.info('BootLoader Extracting') informations.envVarList = os.environ informations.listPartitions = partition.partition_information(informations.currentMachine) informations.save_informations()
def main(args): logging.basicConfig() # debug if args.debug: logger.setLevel(logging.DEBUG) if not args.output_path: logger.error("Please specify a filename to save the filters to.") sys.exit(0) # for now, process local directory if args.dir_path: logger.info("Analyzing all analyses in directory %s" % (args.dir_path)) # Memory mem_filter = MemoryFilter() for analysis_dir in os.listdir(args.dir_path): path = os.path.join(args.dir_path, analysis_dir) logger.info("Memory Filter: Analyzing %s" % path) diff = None # TODO add option to redo analysis even if this file exists if os.path.exists(os.path.join(path, 'mem_diff.txt')): diff = pickle.load(open(os.path.join(path, 'mem_diff.txt'), 'rb')) else: clean_disk_uri = os.path.join(path, "sut_memory_clean.mfd") dirty_memory_uri = os.path.join(path, "sut_memory_dirty.mfd") memory_analysis = MemoryAnalysis(clean_disk_uri, dirty_memory_uri, args.profile) diff = memory_analysis.run() pickle.dump(diff, open(os.path.join(path, 'mem_diff.txt'), 'wb')) if not diff: logger.error("Error processing memory analysis for %s . . . skipping!" % path) continue mem_filter.add_analysis(diff) # adjust the filter mem_filter.adjust_filter(5) # write filter to disk # pprint.pprint(mem_filter.occurrences_dict) f = open(args.output_path+'.mem', 'w') f.write(pprint.pformat(mem_filter.occurrences_dict)) f.close() # Disk disk_filter = DiskFilter() for analysis_dir in os.listdir(args.dir_path): path = os.path.join(args.dir_path, analysis_dir) logger.info("Disk Filter: Analyzing %s" % path) diff = None # TODO add option to redo analysis even if this file exists if os.path.exists(os.path.join(path, 'disk_diff.txt')): diff = pickle.load(open(os.path.join(path, 'disk_diff.txt'), 'rb')) else: dcap_uri = os.path.join(path, "dcap") disk_analysis = DiskAnalysis(dcap_uri, args.machine_type, args.disk_img) diff = disk_analysis.run() pickle.dump(diff, open(os.path.join(path, 'disk_diff.txt'), 'wb')) if not diff: logger.error("Error processing disk analysis for %s . . . skipping!" % path) continue disk_filter.add_analysis(diff) # adjust filter disk_filter.adjust_filter(5) # write filter to disk f = open(args.output_path+'.disk', 'w') f.write(pprint.pformat(disk_filter.occurrences_dict)) f.close()