コード例 #1
0
ファイル: test_dotty.py プロジェクト: cephurs/rekall
 def testPrecedence(self):
     query = "5 == 1 * 5 and Process/name is 'init'"
     expected = expression.Intersection(
         expression.Equivalence(
             expression.Literal(5),
             expression.Product(expression.Literal(1),
                                expression.Literal(5))),
         expression.Equivalence(expression.Binding("Process/name"),
                                expression.Literal("init")))
     self.assertQueryMatches(query, expected)
コード例 #2
0
ファイル: test_dotty.py プロジェクト: cephurs/rekall
    def testTemplateReplacements(self):
        query = "Process/pid == {}"
        params = [1]
        exptected = expression.Equivalence(expression.Binding("Process/pid"),
                                           expression.Literal(1))
        self.assertQueryMatches(query, exptected, params=params)

        query = "Process/pid == {pid}"
        params = {"pid": 1}
        exptected = expression.Equivalence(expression.Binding("Process/pid"),
                                           expression.Literal(1))
        self.assertQueryMatches(query, exptected, params=params)
コード例 #3
0
ファイル: test_dotty.py プロジェクト: cephurs/rekall
    def testLetSubexpr(self):
        query = ("Process/parent matches (Process/command is 'init' and "
                 "Process/pid is 1)")
        expected = expression.Let(
            expression.Binding("Process/parent"),
            expression.Intersection(
                expression.Equivalence(expression.Binding("Process/command"),
                                       expression.Literal("init")),
                expression.Equivalence(expression.Binding("Process/pid"),
                                       expression.Literal(1))))

        self.assertQueryMatches(query, expected)
コード例 #4
0
ファイル: test_dotty.py プロジェクト: cephurs/rekall
    def testLetSubexprEach(self):
        query = "each Process/children matches Process/command is 'foo'"
        expected = expression.LetEach(
            expression.Binding("Process/children"),
            expression.Equivalence(expression.Binding("Process/command"),
                                   expression.Literal("foo")))

        self.assertQueryMatches(query, expected)
コード例 #5
0
ファイル: test_dotty.py プロジェクト: cephurs/rekall
    def testLetSingleAny(self):
        query = "any Process/parent->Process/command is 'init'"
        expected = expression.LetAny(
            expression.Binding("Process/parent"),
            expression.Equivalence(expression.Binding("Process/command"),
                                   expression.Literal("init")))

        self.assertQueryMatches(query, expected)
コード例 #6
0
ファイル: test_dotty.py プロジェクト: the80srobot/rekall
    def testLetSingle(self):
        query = "ProcessParent matches ProcessCommand is 'init'"
        expected = expression.Let(
            expression.Binding("ProcessParent"),
            expression.Equivalence(
                expression.Binding("ProcessCommand"),
                expression.Literal("init")))

        self.assertQueryMatches(query, expected)
コード例 #7
0
    def as_query(self):
        """A query that'll match entities with this identity."""
        union = []
        for _, keys, vals in self.indices:
            if isinstance(keys, tuple):
                intersection = []
                for idx, key in enumerate(keys):
                    intersection.append(
                        expression.Equivalence(expression.Binding(key),
                                               expression.Literal(vals[idx])))

                union.append(expression.Intersection(*intersection))
            else:
                union.append(
                    expression.Equivalence(expression.Binding(keys),
                                           expression.Literal(vals)))

        if len(union) == 1:
            return union[0]

        return expression.Union(*union)
コード例 #8
0
ファイル: test_dotty.py プロジェクト: cephurs/rekall
    def testParamFailures(self):
        query = "{foo} == 1"
        params = ["Process/pid"]
        self.assertQueryRaises(query, params=params)

        # Even fixing the above, the left side should be a literal, not a
        # binding.
        query = "{foo} == 1"
        params = {"foo": "Process/pid"}
        exptected = expression.Equivalence(expression.Literal("Process/pid"),
                                           expression.Literal(1))
        self.assertQueryMatches(query, exptected, params=params)
コード例 #9
0
ファイル: test_normalizer.py プロジェクト: the80srobot/rekall
    def testRealExample(self):
        original = expression.Intersection(
            expression.Let(
                expression.Let(expression.Binding('MemoryDescriptor'),
                               expression.Binding('process')),
                expression.Equivalence(
                    expression.Let(expression.Binding('Process'),
                                   expression.Binding('command')),
                    expression.Literal('Adium'))),
            expression.Intersection(
                expression.Membership(
                    expression.Literal('execute'),
                    expression.Let(expression.Binding('MemoryDescriptor'),
                                   expression.Binding('permissions'))),
                expression.Membership(
                    expression.Literal('write'),
                    expression.Let(expression.Binding('MemoryDescriptor'),
                                   expression.Binding('permissions')))))

        # Two binary intersections become one variadic intersection and the
        # let-forms now have a Binding as their LHS whenever possible.
        expected = expression.Intersection(
            expression.Let(
                expression.Binding('MemoryDescriptor'),
                expression.Let(
                    expression.Binding('process'),
                    expression.Equivalence(
                        expression.Let(expression.Binding('Process'),
                                       expression.Binding('command')),
                        expression.Literal('Adium')))),
            expression.Membership(
                expression.Literal('execute'),
                expression.Let(expression.Binding('MemoryDescriptor'),
                               expression.Binding('permissions'))),
            expression.Membership(
                expression.Literal('write'),
                expression.Let(expression.Binding('MemoryDescriptor'),
                               expression.Binding('permissions'))))

        self.assertResult(original, expected)
コード例 #10
0
    def render(self, renderer):
        renderer.table_header([
            ("User", "user", "15"),
            ("Session", "session", "15"),
            ("Terminal vnode", "vnode", "30"),
            ("Recovered input", "input", "75"),
            ("Recovered output", "output", "75")])

        for terminal in self.session.entities.find("has component Terminal"):

            buffer_in = self.session.entities.find_first(
                expression.Intersection(
                    expression.Equivalence(
                        expression.Binding("Buffer/purpose"),
                        expression.Literal("terminal_input")),
                    expression.Equivalence(
                        expression.Binding("Buffer/context"),
                        expression.Literal(terminal.identity))))

            buffer_out = self.session.entities.find_first(
                expression.Intersection(
                    expression.Equivalence(
                        expression.Binding("Buffer/purpose"),
                        expression.Literal("terminal_output")),
                    expression.Equivalence(
                        expression.Binding("Buffer/context"),
                        expression.Literal(terminal.identity))))

            renderer.table_row(
                terminal["Terminal/session"]["Session/user"]["User/username"],
                terminal["Terminal/session"]["Session/sid"],
                terminal.get("Terminal/file", complete=True)["File/path"],
                repr(self.SHORTENER.sub("<whitespace>",
                                        buffer_in["Buffer/contents"])),
                repr(self.SHORTENER.sub("<whitespace>",
                                        buffer_out["Buffer/contents"])))
コード例 #11
0
ファイル: test_dotty.py プロジェクト: cephurs/rekall
    def testBigQuery(self):
        query = ("(Process/pid is 1 and Process/command in ('init', 'initd')) "
                 "or any Process/children matches (Process/command not in "
                 "('launchd', 'foo'))")
        expected = expression.Union(
            expression.Intersection(
                expression.Equivalence(expression.Binding("Process/pid"),
                                       expression.Literal(1)),
                expression.Membership(expression.Binding("Process/command"),
                                      expression.Literal(("init", "initd")))),
            expression.LetAny(
                expression.Binding("Process/children"),
                expression.Complement(
                    expression.Membership(
                        expression.Binding("Process/command"),
                        expression.Literal(("launchd", "foo"))))))

        self.assertQueryMatches(query, expected)
コード例 #12
0
def ComplementEquivalence(*args, **kwargs):
    return expression.Complement(
        expression.Equivalence(*args, **kwargs), **kwargs)
コード例 #13
0
ファイル: test_dotty.py プロジェクト: cephurs/rekall
 def testEquivalence(self):
     query = "10 is 10"
     expected = expression.Equivalence(expression.Literal(10),
                                       expression.Literal(10))
     self.assertQueryMatches(query, expected)