Compare commits

..

No commits in common. "0b709669b08a459569cd774e31e30d8b83787c04" and "857063da34e975dcfaf133d0fbc3fccf55d6942f" have entirely different histories.

3 changed files with 7 additions and 13 deletions

View File

@ -11,3 +11,4 @@ services:
- scraps:/out - scraps:/out
working_dir: /app working_dir: /app
command: python3 -m sins -o /out/ command: python3 -m sins -o /out/
# command: yasm seed.asm -o seed

View File

@ -4,18 +4,10 @@ import json
capstone = Cs(CS_ARCH_X86, CS_MODE_64) capstone = Cs(CS_ARCH_X86, CS_MODE_64)
def disasm(shellcode: bytes)->list: def disasm(shellcode: bytes)->str:
opcodes = list() opcodes = list()
for opcode in capstone.disasm(shellcode, 0): for opcode in capstone.disasm(shellcode, 0):
opcodes.append([opcode.mnemonic, opcode.op_str]) opcodes.append([opcode.mnemonic, opcode.op_str])
return opcodes return opcodes
def objdump(shellcode: bytes)->str:
opcodes = str()
for opcode in capstone.disasm(shellcode, 0):
opcodes += f'{opcode.mnemonic} {opcode.op_str}\n'
return opcodes

View File

@ -8,7 +8,7 @@ from sqlalchemy.orm import Session, relationship, backref
from sqlalchemy.orm.collections import attribute_mapped_collection from sqlalchemy.orm.collections import attribute_mapped_collection
import json import json
from .disassemble import objdump from .disassemble import disasm
now = '{0:%Y%m%dT%H%M%S}'.format(datetime.utcnow()) now = '{0:%Y%m%dT%H%M%S}'.format(datetime.utcnow())
Base = declarative_base() Base = declarative_base()
@ -29,7 +29,7 @@ class ScrapNode(Base):
mtime = Column(DateTime, onupdate=datetime.utcnow) mtime = Column(DateTime, onupdate=datetime.utcnow)
parent_id = Column(Integer, ForeignKey(id)) parent_id = Column(Integer, ForeignKey(id))
checksum = Column(String) checksum = Column(String)
objdump = Column(String) disasm = Column(String)
image = Column(LargeBinary) image = Column(LargeBinary)
children = relationship( children = relationship(
@ -43,17 +43,18 @@ class ScrapNode(Base):
self.image = child self.image = child
self.length = len(child) self.length = len(child)
self.sha1sum self.sha1sum
self.objdump = objdump(child) self.disasm = str(disasm(child))
def __repr__(self): def __repr__(self):
values = { values = {
'checksum': self.checksum, 'checksum': self.checksum,
'length': self.length, 'length': self.length,
'disasm': self.disasm,
'parent_id': self.parent_id, 'parent_id': self.parent_id,
'id': self.id, 'id': self.id,
} }
return f'{values}\n{self.objdump}' return json.dumps(values, indent=1)
@property @property
def sha1sum(self): def sha1sum(self):