Skip to content
This repository was archived by the owner on Nov 2, 2024. It is now read-only.

Commit 5ca21e5

Browse files
g4zemlodic
authored and
Michalsus
committed
Improved PE_info analyzer (intelowlproject#2464)
* update * update * init * init * blint fix * black and flake8 * upgraded lief * complexity --------- Co-authored-by: Matteo Lodi <[email protected]>
1 parent 9b8828c commit 5ca21e5

File tree

17 files changed

+91
-52
lines changed

17 files changed

+91
-52
lines changed

‎api_app/analyzers_manager/admin.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@
66
from api_app.analyzers_manager.models import AnalyzerConfig, AnalyzerReport
77

88

9+
# flake8: noqa
910
@admin.register(AnalyzerReport)
10-
class AnalyzerReportAdminView(AbstractReportAdminView):
11-
...
11+
class AnalyzerReportAdminView(AbstractReportAdminView): ...
1212

1313

1414
@admin.register(AnalyzerConfig)

‎api_app/analyzers_manager/file_analyzers/doc_info.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -239,9 +239,9 @@ def manage_encrypted_doc(self):
239239
decrypted_file_name, correct_password = self.vbaparser.decrypt_file(
240240
self.passwords_to_check,
241241
)
242-
self.olevba_results[
243-
"additional_passwords_tried"
244-
] = self.passwords_to_check
242+
self.olevba_results["additional_passwords_tried"] = (
243+
self.passwords_to_check
244+
)
245245
if correct_password:
246246
self.olevba_results["correct_password"] = correct_password
247247
if decrypted_file_name:

‎api_app/analyzers_manager/file_analyzers/pe_info.py‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,10 @@
1111
from datetime import datetime
1212

1313
import lief
14+
import magic
1415
import pefile
1516
import pyimpfuzzy
17+
from dotnetfile import DotNetPE
1618
from PIL import Image
1719

1820
from api_app.analyzers_manager.classes import FileAnalyzer
@@ -33,8 +35,34 @@ class No_Icon_Error(Exception):
3335

3436

3537
class PEInfo(FileAnalyzer):
38+
def update(self):
39+
pass
40+
41+
def dotnetpe(self):
42+
results = {}
43+
file_type = magic.from_buffer(self.read_file_bytes())
44+
45+
if ".Net" in file_type:
46+
dotnet_file = DotNetPE(self.filepath)
47+
dotnet_info = {
48+
"runtime_target_version": dotnet_file.get_runtime_target_version(),
49+
"number_of_streams": dotnet_file.get_number_of_streams(),
50+
"has_resources": dotnet_file.has_resources(),
51+
"is_mixed_assembly": dotnet_file.is_mixed_assembly(),
52+
"has_native_entry_point": dotnet_file.has_native_entry_point(),
53+
"is_native_image": dotnet_file.is_native_image(),
54+
"is_windows_forms_app": dotnet_file.is_windows_forms_app(),
55+
}
56+
results["is_dotnet"] = True
57+
results["dotnet_info"] = dotnet_info
58+
else:
59+
results["is_dotnet"] = False
60+
return results
61+
3662
def run(self):
3763
results = {}
64+
results["dotnet"] = self.dotnetpe()
65+
3866
try:
3967
pe = pefile.PE(self.filepath)
4068
if not pe:

‎api_app/connectors_manager/admin.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88

99

1010
@admin.register(ConnectorReport)
11-
class ConnectorReportAdminView(AbstractReportAdminView):
12-
...
11+
# flake8: noqa
12+
class ConnectorReportAdminView(AbstractReportAdminView): ...
1313

1414

1515
@admin.register(ConnectorConfig)

‎api_app/connectors_manager/connectors/slack.py‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,11 @@ def run(self) -> dict:
4141

4242
@classmethod
4343
def _monkeypatch(cls):
44+
# flake8: noqa
4445
class MockClient:
45-
def __init__(self, *args, **kwargs):
46-
...
46+
def __init__(self, *args, **kwargs): ...
4747

48-
def chat_postMessage(self, *args, **kwargs):
49-
...
48+
def chat_postMessage(self, *args, **kwargs): ...
5049

5150
patches = [
5251
if_mock_connections(

‎api_app/ingestors_manager/admin.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@
77
from api_app.ingestors_manager.models import IngestorConfig, IngestorReport
88

99

10+
# flake8: noqa
1011
@admin.register(IngestorReport)
11-
class IngestorReportAdminView(AbstractReportAdminView):
12-
...
12+
class IngestorReportAdminView(AbstractReportAdminView): ...
1313

1414

1515
@admin.register(IngestorConfig)

‎api_app/interfaces.py‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -102,9 +102,11 @@ def _get_file_serializer(
102102
from tests.mock_utils import MockUpRequest
103103

104104
files = [
105-
data
106-
if isinstance(data, File)
107-
else File(io.BytesIO(data), name=f"{self.name}.{i}")
105+
(
106+
data
107+
if isinstance(data, File)
108+
else File(io.BytesIO(data), name=f"{self.name}.{i}")
109+
)
108110
for i, data in enumerate(values)
109111
]
110112
query_dict = QueryDict(mutable=True)

‎api_app/investigations_manager/queryset.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1+
# flake8: noqa
12
from api_app.queryset import CleanOnCreateQuerySet, ModelWithOwnershipQuerySet
23

34

4-
class InvestigationQuerySet(CleanOnCreateQuerySet, ModelWithOwnershipQuerySet):
5-
...
5+
class InvestigationQuerySet(CleanOnCreateQuerySet, ModelWithOwnershipQuerySet): ...

‎api_app/pivots_manager/admin.py‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl
22
# See the file 'LICENSE' for copying permission.
3-
3+
# flake8: noqa
44
from django.contrib import admin
55
from django.http import HttpRequest
66

@@ -10,8 +10,7 @@
1010

1111

1212
@admin.register(PivotReport)
13-
class PivotReportAdminView(AbstractReportAdminView):
14-
...
13+
class PivotReportAdminView(AbstractReportAdminView): ...
1514

1615

1716
@admin.register(PivotConfig)

‎api_app/queryset.py‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# flake8: noqa
12
import datetime
23
import json
34
import uuid
@@ -285,15 +286,18 @@ def _alias_org_value_for_user(
285286
from api_app.models import PluginConfig
286287

287288
return self.alias(
288-
org_value=Subquery(
289-
PluginConfig.objects.filter(
290-
parameter__pk=OuterRef("pk"), **{config.snake_case_name: config.pk}
289+
org_value=(
290+
Subquery(
291+
PluginConfig.objects.filter(
292+
parameter__pk=OuterRef("pk"),
293+
**{config.snake_case_name: config.pk},
294+
)
295+
.visible_for_user_by_org(user)
296+
.values("value")[:1],
291297
)
292-
.visible_for_user_by_org(user)
293-
.values("value")[:1],
294-
)
295-
if user and user.has_membership()
296-
else Value(None, output_field=JSONField()),
298+
if user and user.has_membership()
299+
else Value(None, output_field=JSONField())
300+
),
297301
)
298302

299303
def _alias_default_value(self, config: "PythonConfig") -> "ParameterQuerySet":
@@ -455,8 +459,7 @@ def visible_for_user(self, user: User = None) -> "PluginConfigQuerySet":
455459
return self.default_values()
456460

457461

458-
class PluginConfigQuerySet(CleanOnCreateQuerySet, ModelWithOwnershipQuerySet):
459-
...
462+
class PluginConfigQuerySet(CleanOnCreateQuerySet, ModelWithOwnershipQuerySet): ...
460463

461464

462465
class PythonConfigQuerySet(AbstractConfigQuerySet):

0 commit comments

Comments
 (0)