jmb/scanfile
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tentative work on python wrappers

Browse source
This commit is contained in:
Johannes Bülow 2025-06-15 21:14:09 +02:00
parent e5f95b905b
commit 6aaa34a6d2
Signed by: jmb
GPG key ID: B56971CF7B8F83A6
2 changed files with 32 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
scanners/capa/routes/capa.py
View file

@ -1,31 +1,35 @@
from logging import log
import logging
from flask import Blueprint, request, jsonify, abort
from flask import Blueprint, request, abort
from werkzeug.utils import secure_filename
import capa.main
import capa.rules
import capa.loader
import capa.render.json
import capa.capabilities.common
from capa.features.common import OS_AUTO, FORMAT_AUTO
from os import path
from pathlib import Path
import config
import json
import os
capa_bp = Blueprint('capa', __name__)
@capa_bp.route('/analyze', methods=['GET'])
def analyze_mraptor():
file = request.args.get('file', '')
def analyze_capa():
file = secure_filename(request.args.get('file', ''))
if file == '':
abort(400)
filepath = path.join(config.Config.FILE_DIRECTORY, file)
# Analyze with olevba
vbaparser = olevba.VBA_Parser(filepath)
if vbaparser.detect_vba_macros():
vba_code = ''
try:
vba_code = vbaparser.get_vba_code_all_modules()
except Exception as e:
logging.error(e)
abort(500)
raptor = mraptor.MacroRaptor(vba_code)
raptor.scan()
if raptor.suspicious:
return jsonify({'filename': file, 'result': mraptor.Result_Suspicious, 'flags': raptor.get_flags(), 'matches': raptor.matches})
else:
return jsonify({'filename': file, 'result': mraptor.Result_MacroOK, 'flags': raptor.get_flags(), 'matches': raptor.matches})
else:
return jsonify({'filename': file, 'result': mraptor.Result_NoMacro})
filepath = Path(path.join(config.Config.FILE_DIRECTORY, file))
if not os.path.exists(filepath):
print(f"Error: File not found at '{filepath}'")
abort(400)
rules = capa.rules.get_rules([capa.main.get_default_root()/ "rules"])
extractor = capa.loader.get_extractor(filepath, FORMAT_AUTO, OS_AUTO, capa.main.BACKEND_VIV, [], should_save_workspace=False, disable_progress=True)
capabilities = capa.capabilities.common.find_capabilities(rules, extractor, disable_progress=True)
meta = capa.loader.collect_metadata([], filepath, FORMAT_AUTO, OS_AUTO, [capa.main.get_default_root()/ "rules"], extractor, capabilities)
return json.loads(capa.render.json.render(meta=meta, rules=rules, capabilities=capabilities.matches))

10
scanners/ole/routes/mraptor.py
View file

@ -1,7 +1,7 @@
from logging import log
import logging
from flask import Blueprint, request, jsonify, abort
from os import path
from werkzeug.utils import secure_filename
from oletools import olevba, mraptor
import config
@ -9,7 +9,7 @@ mraptor_bp = Blueprint('mraptor', __name__)
@mraptor_bp.route('/analyze', methods=['GET'])
def analyze_mraptor():
file = request.args.get('file', '')
file = secure_filename(request.args.get('file', ''))
if file == '':
abort(400)
filepath = path.join(config.Config.FILE_DIRECTORY, file)
@ -25,8 +25,8 @@ def analyze_mraptor():
raptor = mraptor.MacroRaptor(vba_code)
raptor.scan()
if raptor.suspicious:
return jsonify({'filename': file, 'result': mraptor.Result_Suspicious, 'flags': raptor.get_flags(), 'matches': raptor.matches})
return jsonify({'result': mraptor.Result_Suspicious.name, 'flags': raptor.get_flags(), 'matches': raptor.matches})
else:
return jsonify({'filename': file, 'result': mraptor.Result_MacroOK, 'flags': raptor.get_flags(), 'matches': raptor.matches})
return jsonify({'result': mraptor.Result_MacroOK.name, 'flags': raptor.get_flags(), 'matches': raptor.matches})
else:
return jsonify({'filename': file, 'result': mraptor.Result_NoMacro})
return jsonify({'result': mraptor.Result_NoMacro.name})