Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added catalog checker #95

Merged
merged 31 commits into from
May 10, 2020
Merged

Conversation

milenkowski
Copy link
Contributor

  • updated static_analyzer.py, requirements.txt
  • hooks.json left unmodified
  • added asn1.py (a fixed version of the pyasn1 library)

Copy link
Owner

@Wenzel Wenzel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please see my remarks.

I will test your hook tomorrow.

And thanks for your work !

asn1.py Outdated Show resolved Hide resolved
hooks/static_analyzer.py Outdated Show resolved Hide resolved
hooks/static_analyzer.py Outdated Show resolved Hide resolved
hooks/static_analyzer.py Outdated Show resolved Hide resolved
hooks/static_analyzer.py Outdated Show resolved Hide resolved
@Wenzel Wenzel changed the base branch from static_analyzer_catfiles to master April 26, 2020 15:31
@Wenzel Wenzel force-pushed the static_analyzer_catfiles branch from 0a75415 to 26c0a82 Compare May 7, 2020 23:51
@Wenzel
Copy link
Owner

Wenzel commented May 7, 2020

@milenkowski I did the following changes:

  • rebase on master and solved conflicts
  • rename all variables to remove camelcase (not pythonic)
  • remove some fields such as code size and imports, we are not going to process them now, and it will be in a different hook
  • refactor the variables around the check of the signature.

@Wenzel
Copy link
Owner

Wenzel commented May 8, 2020

@milenkowski I finished the rest of the work for this PR.

I updated the model to add new properties on the Neo4J Inode to define PE security properties
and I triggered the event in the static_analyzer hook to insert these data into the node.

The data is in Neo4j 🎉

Sample query: get all signed (embedded) binaries
Capture d’écran de 2020-05-08 03-04-41

MATCH (o:OS {name:"winxp"})-[*]->(i:GraphInode)
WHERE i.checksec = true AND i.signed = true
RETURN o,i

@Wenzel Wenzel force-pushed the static_analyzer_catfiles branch from ab908b1 to fa19b61 Compare May 8, 2020 01:07
@Wenzel Wenzel merged commit 8038d7f into Wenzel:master May 10, 2020
@Wenzel Wenzel deleted the static_analyzer_catfiles branch May 10, 2020 00:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants