Skip to content

feat: added decoding functions calls #978

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mr-tz merged 8 commits into from
Mar 24, 2024
Merged

feat: added decoding functions calls #978

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
2dd5a6a
Reformatted and added only necessary chnages.
RahulSankhla312 Mar 19, 2024
44b15ae
Corrected black and isort
RahulSankhla312 Mar 19, 2024
aea6fc6
corrected mypy errors
RahulSankhla312 Mar 20, 2024
203aaa9
Merge branch 'mandiant:master' into rahul/decoding
RahulSankhla312 Mar 23, 2024
a41a16f
Merge branch 'master' of https://github.com/mandiant/flare-floss into…
RahulSankhla312 Mar 23, 2024
58808f7
added test cases for test_load
RahulSankhla312 Mar 23, 2024
05f3527
Merge branch 'rahul/decoding' of https://github.com/RahulSankhla312/f…
RahulSankhla312 Mar 23, 2024
4ded7ef
Update floss/main.py
mr-tz Mar 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion floss/identify.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,11 @@ def find_decoding_function_features(vw, functions, disable_progress=False) -> Tu

f = viv_utils.Function(vw, function_address)

function_data = {"meta": get_function_meta(f), "features": list()}
function_data = {
"meta": get_function_meta(f),
"features": [],
"xrefs_to": len(list(vw.getXrefsTo(function_address))),
}

# meta data features
function_data["features"].append(BlockCount(function_data["meta"].get("block_count")))
Expand Down
6 changes: 4 additions & 2 deletions floss/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -783,8 +783,10 @@ def main(argv=None) -> int:
else:
logger.debug("identified %d candidate decoding functions", len(fvas_to_emulate))
for fva in fvas_to_emulate:
results.analysis.functions.decoding_function_scores[fva] = decoding_function_features[fva]["score"]
logger.debug(" - 0x%x: %.3f", fva, decoding_function_features[fva]["score"])
score = decoding_function_features[fva]["score"]
xrefs_to = decoding_function_features[fva]["xrefs_to"]
results.analysis.functions.decoding_function_scores[fva] = {"score": score, "xrefs_to": xrefs_to}
logger.debug(" - 0x%x: score: %.3f, xrefs to: %d", fva, score, xrefs_to)

# TODO filter out strings decoded in library function or function only called by library function(s)
results.strings.decoded_strings = decode_strings(
Expand Down
4 changes: 2 additions & 2 deletions floss/render/default.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,11 +138,11 @@ def render_function_analysis_rows(results) -> List[Tuple[str, str]]:
if results.analysis.functions.decoding_function_scores:
rows.append(
(
" identified decoding functions\n (offset and score)",
" identified decoding functions\n (offset, score, and number of xrefs to)",
textwrap.fill(
", ".join(
[
f"0x{fva:x} ({d:.3f})"
f"0x{fva:x} ({d['score']:.3f}, xrefs_to: {d['xrefs_to']})"
for fva, d in results.analysis.functions.decoding_function_scores.items()
]
),
Expand Down
2 changes: 1 addition & 1 deletion floss/results.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,7 +169,7 @@ class Functions:
analyzed_stack_strings: int = 0
analyzed_tight_strings: int = 0
analyzed_decoded_strings: int = 0
decoding_function_scores: Dict[int, float] = field(default_factory=dict)
decoding_function_scores: Dict[int, Dict[str, float]] = field(default_factory=dict)


@dataclass
Expand Down
24 changes: 20 additions & 4 deletions tests/test_load.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,26 @@
"analyzed_stack_strings": 30,
"analyzed_tight_strings": 2,
"decoding_function_scores": {
"4199648": 0.744, "4199776": 0.763, "4199888": 0.617, "4200144": 0.62, "4200304": 0.471,
"4200336": 0.617, "4200560": 0.44, "4201104": 0.931, "4201200": 0.887, "4201776": 0.576,
"4202640": 0.539, "4202672": 0.886, "4202992": 0.624, "4203120": 0.686, "4203264": 0.6,
"4203424": 0.497, "4203584": 0.591, "4203648": 0.727, "4203872": 0.617, "4204416": 0.531
"4199648": {"score": 0.744, "xrefs_to": 2},
"4199776": {"score": 0.763, "xrefs_to": 3},
"4199888": {"score": 0.617, "xrefs_to": 1},
"4200144": {"score": 0.62, "xrefs_to": 2},
"4200304": {"score": 0.471, "xrefs_to": 1},
"4200336": {"score": 0.617, "xrefs_to": 2},
"4200560": {"score": 0.44, "xrefs_to": 1},
"4201104": {"score": 0.931, "xrefs_to": 0},
"4201200": {"score": 0.887, "xrefs_to": 2},
"4201776": {"score": 0.576, "xrefs_to": 3},
"4202640": {"score": 0.539, "xrefs_to": 1},
"4202672": {"score": 0.886, "xrefs_to": 2},
"4202992": {"score": 0.624, "xrefs_to": 1},
"4203120": {"score": 0.686, "xrefs_to": 2},
"4203264": {"score": 0.6, "xrefs_to": 1},
"4203424": {"score": 0.497, "xrefs_to": 1},
"4203584": {"score": 0.591, "xrefs_to": 2},
"4203648": {"score": 0.727, "xrefs_to": 1},
"4203872": {"score": 0.617, "xrefs_to": 2},
"4204416": {"score": 0.531, "xrefs_to": 1}
},
"discovered": 50,
"library": 0
Expand Down