diff options
| author | Jordan Wiens <jordan@psifertex.com> | 2024-10-02 18:04:48 -0400 |
|---|---|---|
| committer | Jordan Wiens <jordan@psifertex.com> | 2024-10-02 18:04:48 -0400 |
| commit | fefe5882f0e2ef445f509b5b73f4dbce4f15944f (patch) | |
| tree | 425c9ee11448e6bf3ae94ec0cdee26ff903c323f /python/examples | |
| parent | fc28e5142593e69a960ab8dd72ff88a2f06065da (diff) | |
update to get python triage example working on recent builds
Diffstat (limited to 'python/examples')
| -rw-r--r-- | python/examples/triage/entropy.py | 4 | ||||
| -rw-r--r-- | python/examples/triage/headers.py | 79 | ||||
| -rw-r--r-- | python/examples/triage/imports.py | 8 | ||||
| -rw-r--r-- | python/examples/triage/view.py | 4 |
4 files changed, 47 insertions, 48 deletions
diff --git a/python/examples/triage/entropy.py b/python/examples/triage/entropy.py index 3b24a9ba..bcd2affb 100644 --- a/python/examples/triage/entropy.py +++ b/python/examples/triage/entropy.py @@ -37,10 +37,10 @@ class EntropyWidget(QWidget): self.data = data self.raw_data = data.file.raw - self.block_size = (len(self.raw_data) / 4096) + 1 + self.block_size = (self.raw_data.length / 4096) + 1 if self.block_size < 1024: self.block_size = 1024 - self.width = int(len(self.raw_data) / self.block_size) + self.width = int(self.raw_data.length / self.block_size) self.image = QImage(self.width, 1, QImage.Format_ARGB32) self.image.fill(QColor(0, 0, 0, 0)) diff --git a/python/examples/triage/headers.py b/python/examples/triage/headers.py index 0f2fd6de..d743e8c5 100644 --- a/python/examples/triage/headers.py +++ b/python/examples/triage/headers.py @@ -53,107 +53,106 @@ class GenericHeaders(object): class PEHeaders(object): def __init__(self, data): - dos = StructuredDataView(data, "DOS_Header", data.start) - pe_offset = data.start + int(dos.e_lfanew) - coff = StructuredDataView(data, "COFF_Header", pe_offset) - pe_magic = data.read(pe_offset + len(coff), 2) + dos = data.get_data_var_at(data.start) + pe_offset = data.start + int(dos['e_lfanew'].value) + coff = data.get_data_var_at(pe_offset) + pe_magic = data.read(pe_offset + data.start, 2) self.fields = [] + peopt = data.get_data_var_at(coff.address + 0x18) + is64bit = True if pe_magic == b"\x0b\x01": - peopt = StructuredDataView(data, "PE32_Optional_Header", pe_offset + len(coff)) self.fields.append(("Type", "PE 32-bit")) is64bit = False elif pe_magic == b"\x0b\x02": - peopt = StructuredDataView(data, "PE64_Optional_Header", pe_offset + len(coff)) self.fields.append(("Type", "PE 64-bit")) - is64bit = True - machine_value = int(coff.machine) + machine_value = int(coff['machine'].value) machine_enum = data.get_type_by_name("coff_machine") machine_name = str(machine_value) - for member in machine_enum.enumeration.members: + for member in machine_enum.members: if member.value == machine_value: machine_name = member.name if machine_name.startswith("IMAGE_FILE_MACHINE_"): machine_name = machine_name[len("IMAGE_FILE_MACHINE_"):] self.fields.append(("Machine", machine_name)) - subsys_value = int(peopt.subsystem) + subsys_value = int(peopt['subsystem'].value) subsys_enum = data.get_type_by_name("pe_subsystem") subsys_name = str(subsys_value) - for member in subsys_enum.enumeration.members: + for member in subsys_enum.members: if member.value == subsys_value: subsys_name = member.name if subsys_name.startswith("IMAGE_SUBSYSTEM_"): subsys_name = subsys_name[len("IMAGE_SUBSYSTEM_"):] self.fields.append(("Subsystem", subsys_name)) - self.fields.append(("Timestamp", time.strftime("%c", time.localtime(int(coff.timeDateStamp))))) + self.fields.append(("Timestamp", time.strftime("%c", time.localtime(int(coff['timeDateStamp'].value))))) - base = int(peopt.imageBase) + base = int(peopt['imageBase'].value) self.fields.append(("Image Base", "0x%x" % base, "ptr")) - entry_point = base + int(peopt.addressOfEntryPoint) + entry_point = base + int(peopt['addressOfEntryPoint'].value) self.fields.append(("Entry Point", "0x%x" % entry_point, "code")) - section_align = int(peopt.sectionAlignment) + section_align = int(peopt['sectionAlignment'].value) self.fields.append(("Section Alignment", "0x%x" % section_align)) - file_align = int(peopt.fileAlignment) + file_align = int(peopt['fileAlignment'].value) self.fields.append(("File Alignment", "0x%x" % file_align)) - checksum = int(peopt.checkSum) + checksum = int(peopt['checkSum'].value) self.fields.append(("Checksum", "0x%.8x" % checksum)) - code_base = base + int(peopt.baseOfCode) + code_base = base + int(peopt['baseOfCode'].value) self.fields.append(("Base of Code", "0x%x" % code_base, "ptr")) if not is64bit: - data_base = base + int(peopt.baseOfData) + data_base = base + int(peopt['baseOfData'].value) self.fields.append(("Base of Data", "0x%x" % data_base, "ptr")) - code_size = int(peopt.sizeOfCode) + code_size = int(peopt['sizeOfCode'].value) self.fields.append(("Size of Code", "0x%x" % code_size)) - init_data_size = int(peopt.sizeOfInitializedData) + init_data_size = int(peopt['sizeOfInitializedData'].value) self.fields.append(("Size of Init Data", "0x%x" % init_data_size)) - uninit_data_size = int(peopt.sizeOfUninitializedData) + uninit_data_size = int(peopt['sizeOfUninitializedData'].value) self.fields.append(("Size of Uninit Data", "0x%x" % uninit_data_size)) - header_size = int(peopt.sizeOfHeaders) + header_size = int(peopt['sizeOfHeaders'].value) self.fields.append(("Size of Headers", "0x%x" % header_size)) - image_size = int(peopt.sizeOfImage) + image_size = int(peopt['sizeOfImage'].value) self.fields.append(("Size of Image", "0x%x" % image_size)) - stack_commit = int(peopt.sizeOfStackCommit) - stack_reserve = int(peopt.sizeOfStackReserve) + stack_commit = int(peopt['sizeOfStackCommit'].value) + stack_reserve = int(peopt['sizeOfStackReserve'].value) self.fields.append(("Stack Size", "0x%x / 0x%x" % (stack_commit, stack_reserve))) - heap_commit = int(peopt.sizeOfHeapCommit) - heap_reserve = int(peopt.sizeOfHeapReserve) + heap_commit = int(peopt['sizeOfHeapCommit'].value) + heap_reserve = int(peopt['sizeOfHeapReserve'].value) self.fields.append(("Heap Size", "0x%x / 0x%x" % (heap_commit, heap_reserve))) - linker_major = int(peopt.majorLinkerVersion) - linker_minor = int(peopt.minorLinkerVersion) + linker_major = int(peopt['majorLinkerVersion'].value) + linker_minor = int(peopt['minorLinkerVersion'].value) self.fields.append(("Linker Version", "%d.%.2d" % (linker_major, linker_minor))) - image_major = int(peopt.majorImageVersion) - image_minor = int(peopt.minorImageVersion) + image_major = int(peopt['majorImageVersion'].value) + image_minor = int(peopt['minorImageVersion'].value) self.fields.append(("Image Version", "%d.%.2d" % (image_major, image_minor))) - os_major = int(peopt.majorOperatingSystemVersion) - os_minor = int(peopt.minorOperatingSystemVersion) + os_major = int(peopt['majorOperatingSystemVersion'].value) + os_minor = int(peopt['minorOperatingSystemVersion'].value) self.fields.append(("OS Version", "%d.%.2d" % (os_major, os_minor))) - sub_major = int(peopt.majorSubsystemVersion) - sub_minor = int(peopt.minorSubsystemVersion) + sub_major = int(peopt['majorSubsystemVersion'].value) + sub_minor = int(peopt['minorSubsystemVersion'].value) self.fields.append(("Subsystem Version", "%d.%.2d" % (sub_major, sub_minor))) - coff_char_value = int(coff.characteristics) + coff_char_value = int(coff['characteristics'].value) coff_char_enum = data.get_type_by_name("coff_characteristics") coff_char_values = [] - for member in coff_char_enum.enumeration.members: + for member in coff_char_enum.members: if (coff_char_value & member.value) != 0: if member.name.startswith("IMAGE_FILE_"): coff_char_values.append(member.name[len("IMAGE_FILE_"):]) @@ -162,10 +161,10 @@ class PEHeaders(object): if len(coff_char_values) > 0: self.fields.append(("COFF Characteristics", coff_char_values)) - dll_char_value = int(peopt.dllCharacteristics) + dll_char_value = int(peopt['dllCharacteristics'].value) dll_char_enum = data.get_type_by_name("pe_dll_characteristics") dll_char_values = [] - for member in dll_char_enum.enumeration.members: + for member in dll_char_enum.members: if (dll_char_value & member.value) != 0: if member.name.startswith("IMAGE_DLLCHARACTERISTICS_"): dll_char_values.append(member.name[len("IMAGE_DLLCHARACTERISTICS_"):]) diff --git a/python/examples/triage/imports.py b/python/examples/triage/imports.py index 55b09c6d..dbe8ed47 100644 --- a/python/examples/triage/imports.py +++ b/python/examples/triage/imports.py @@ -137,17 +137,17 @@ def find_dynamically_linked_funcs(bv): mlil_ssa = f.medium_level_il.ssa_form for call in find_mlil_calls_to_targets(mlil_ssa, platform_info["sym_lookups"]): - if len(call.params) < 2 or len(call.output.vars_written) < 1: + if len(call.params) < 2 or len(call.output) < 1: continue symbol_name_addr = call.params[1].value if symbol_name_addr.type not in [RegisterValueType.ConstantPointerValue, RegisterValueType.ConstantValue]: continue - output_var = call.output.vars_written[0] + output_var = call.output[0] symbol_name = bv.get_ascii_string_at(symbol_name_addr.value).value - #Add confidence to both the args and the return of zero - symbol_type = Type.pointer(bv.parse_type_string("void foo()")[0], arch=bv.arch) + # Add confidence to both the args and the return of zero + symbol_type = Type.pointer(bv.arch, bv.parse_type_string("void foo()")[0]) if len(symbol_name) == 0: continue diff --git a/python/examples/triage/view.py b/python/examples/triage/view.py index e4f60df0..d7a29bb6 100644 --- a/python/examples/triage/view.py +++ b/python/examples/triage/view.py @@ -124,7 +124,7 @@ class TriageView(QScrollArea, View): def setCurrentOffset(self, offset): self.currentOffset = offset - UIContext.updateStatus(True) + UIContext.updateStatus() def getFont(self): return binaryninjaui.getMonospaceFont(self) @@ -180,7 +180,7 @@ class TriageViewType(ViewType): prefer_for_raw = Settings().get_bool("triage.preferSummaryViewForRaw", data) if data.executable and (always_prefer or not is_full): return 100 - if len(data) > 0: + if data.length > 0: if always_prefer or data.executable or prefer_for_raw: return 25 return 1 |
