diff --git a/die_source/_options.h b/die_source/_options.h new file mode 100644 index 0000000000000..93ad518914e82 --- /dev/null +++ b/die_source/_options.h @@ -0,0 +1,239 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#ifndef _OPTIONS_H +#define _OPTIONS_H + +#include +#include +#include +#ifdef USE_NFD +#include "staticscan.h" +#include "staticscanitemmodel.h" +#endif + +#define __DIE "Detect It Easy" +#define __VERSION "2.00" +#define __BUILDDATE __DATE__ +#define __UPDATEFILE "http://ntinfo.biz/files/die_version" +#define __HOMEPAGE "http://ntinfo.biz/index.php/detect-it-easy" +#define __TOOLTIPRELAY 1000 + +#define DIE_SHOWERRORS 0x00000001 +#define DIE_SHOWOPTIONS 0x00000002 +#define DIE_SHOWVERSION 0x00000004 +#define DIE_SHOWENTROPY 0x00000008 +#define DIE_SINGLELINEOUTPUT 0x00000010 +#define DIE_SHOWFILEFORMATONCE 0x00000020 + +struct __SIGNATURE +{ + QString sName; + QString sText; +}; + +enum SCAN_METHODS +{ + SM_DIE=0, +#ifdef USE_NFD + SM_NFD, +#endif +#ifdef USE_YARA + SM_YARA, +#endif +#ifdef USE_PEID + SM_PEID +#endif +}; + +struct __DIE_RESULT +{ + QString sSignature; + QString sFileType; + QString sType; + QString sName; +}; + +struct __DIE_OPTIONS +{ + int nDialogOpen; + bool bStayOnTop; + bool bScanAfterOpen; + bool bSaveLastDirectory; + bool bShowTooltips; + bool bScanShowVersionDIE; + bool bScanShowOptionsDIE; +#ifdef USE_NFD + bool bScanDeepScanNFD; + bool bScanScanOverlayNFD; +#endif + bool bShowErrors; + bool bShowScanTime; + bool bScanSubfolders; + bool bResizeableMainWindow; + bool bShowEntropy; + bool bSingleLineOutput; + bool bShowFileFormatOnce; + bool bFullScan; + bool bSectionsEntropyAfterOpen; + bool bSingleApplication; + double fThreshold; + unsigned int nEntropyGraph; + QString sLastDirectory; + QString sPluginName; + QList<__SIGNATURE> listPEScripts; + QList<__SIGNATURE> listBinaryScripts; + QList<__SIGNATURE> listTextScripts; + QList<__SIGNATURE> listELFScripts; + QList<__SIGNATURE> listMSDOSScripts; + QList<__SIGNATURE> listMACHScripts; + QString sStyle; + QString sStyleSheet; + bool bEnableLanguage; + QString sLanguage; + bool bEnableFont; + QString sFont; + QString sFontHEX; + unsigned int nAddressWidth; + QString sEndianness; + bool bEnablePlugins; + QString sCodec; +// int nNumberOfResults; + QString sDataBasePath; + QString sEditorPath; + QString sHelpPath; + QString sInfoPath; + QString sPluginsPath; + QString sQSSPath; + QString sLangsPath; + QString sScriptsPath; + QString sSearchPath; + SCAN_METHODS sm; + QMutex *pMutexResult; + QList<__DIE_RESULT> die_listResult; +#ifdef USE_NFD + QList nfd_listResult; +#endif +}; + +#define __StayOnTop "General/StayOnTop" +#define __SingleApplication "General/SingleApplication" +#define __ScanAfterOpen "Scan/ScanAfterOpen" +#define __ScanShowVersionDIE "Scan/ShowVersionDIE" +#define __ScanShowOptionsDIE "Scan/ShowOptionsDIE" +#ifdef USE_NFD +#define __ScanDeepScanNFD "Scan/ScanDeepNFD" +#define __ScanScanOverlayNFD "Scan/ScanOverlayNFD" +#endif +#define __ScanMethod "Scan/Method" +#define __ShowErrors "Scan/ShowErrors" +#define __ShowScanTime "Scan/ShowScanTime" +#define __SectionsEntropyAfterOpen "Entropy/SectionsEntropyAfterOpen" +#define __EntropyGraph "Entropy/EntropyGraph" +#define __Threshold "Entropy/Threshold" +#define __ShowTooltips "General/ShowTooltips" +#define __SaveLastDirectory "General/SaveLastDirectory" +#define __ResizeableMainWindow "Appearance/ResizeableMainWindow" +#define __SaveLastDirectory "General/SaveLastDirectory" +#define __LastDirectory "General/LastDirectory" +#define __Style "Appearance/Style" +#define __StyleSheet "Appearance/StyleSheet" +#define __Codec "Appearance/Codec" +#define __EnableFont "Appearance/FontEnable" +#define __Font "Appearance/Font" +#define __EnableLanguage "Appearance/EnableLanguage" +#define __Language "Appearance/Language" +#define __FontHEX "HEX/Font" +#define __AddressWidthHEX "HEX/AddressWidth" +#define __Endianness "HEX/Endianness" +#define __EnablePlugins "Plugins/EnablePlugins" + +#define __DataBasePath "Paths/DataBase" +#define __EditorPath "Paths/Editor" +#define __HelpPath "Paths/Help" +#define __InfoPath "Paths/Info" +#define __PluginsPath "Paths/Plugins" +#define __QSSPath "Paths/QSS" +#define __LangsPath "Paths/Langs" +#define __ScriptsPath "Paths/Scripts" +#define __SearchPath "Paths/Search" + +#define __DefaultDataBasePath "$app/db" +#define __DefaultEditorPath "$app/editor" +#define __DefaultHelpPath "$app/help" +#define __DefaultInfoPath "$app/info" +#define __DefaultPluginsPath "$app/die_plugins" +#define __DefaultQSSPath "$app/qss" +#define __DefaultLangsPath "$app/lang" +#define __DefaultScriptsPath "$app/scripts" +#define __DefaultSearchPath "$app/search" + +// KeySequences +#define __KeySequence_tab1 "Alt+1" +#define __KeySequence_tab2 "Alt+2" +#define __KeySequence_tab3 "Alt+3" +#define __KeySequence_tab4 "Alt+4" +#define __KeySequence_tab5 "Alt+5" +#define __KeySequence_tab6 "Alt+6" +#define __KeySequence_tab7 "Alt+7" +#define __KeySequence_tab8 "Alt+8" +#define __KeySequence_tab9 "Alt+9" +#define __KeySequence_altU "Alt+U" +#define __KeySequence_altA "Alt+A" +#define __KeySequence_altB "Alt+B" +#define __KeySequence_altE "Alt+E" +#define __KeySequence_altI "Alt+I" +#define __KeySequence_altF "Alt+F" +#define __KeySequence_altR "Alt+R" +#define __KeySequence_altS "Alt+S" +#define __KeySequence_altP "Alt+P" +#define __KeySequence_altH "Alt+H" +#define __KeySequence_altV "Alt+V" +#define __KeySequence_altM "Alt+M" +#define __KeySequence_altO "Alt+O" +#define __KeySequence_altD "Alt+D" +#define __KeySequence_altN "Alt+N" +#define __KeySequence_ctrlA "Ctrl+A" +#define __KeySequence_ctrlD "Ctrl+D" +#define __KeySequence_ctrlR "Ctrl+R" +#define __KeySequence_ctrlS "Ctrl+S" +#define __KeySequence_ctrlF "Ctrl+F" +#define __KeySequence_ctrlG "Ctrl+G" +#define __KeySequence_ctrlI "Ctrl+I" +#define __KeySequence_ctrlL "Ctrl+L" +#define __KeySequence_ctrlN "Ctrl+N" +#define __KeySequence_ctrlE "Ctrl+E" +#define __KeySequence_ctrlW "Ctrl+W" + +#define __KeySequence_ctrlaltG "Ctrl+Alt+G" +#define __KeySequence_ctrlaltE "Ctrl+Alt+E" +#define __KeySequence_ctrlaltO "Ctrl+Alt+O" +#define __KeySequence_ctrlaltS "Ctrl+Alt+S" +#define __KeySequence_ctrlaltU "Ctrl+Alt+U" +#define __KeySequence_ctrlaltL "Ctrl+Alt+L" +#define __KeySequence_ctrlaltI "Ctrl+Alt+I" + +#define __KeySequence_save "Ctrl+S" +#define __KeySequence_open "Ctrl+O" +#define __KeySequence_saveandquit "Ctrl+Alt+S" +#define __KeySequence_hex "Alt+H" +#define __KeySequence_quit "Alt+X" + +#endif // _OPTIONS_H diff --git a/die_source/console/_mainclass.cpp b/die_source/console/_mainclass.cpp new file mode 100644 index 0000000000000..01cb07921c98a --- /dev/null +++ b/die_source/console/_mainclass.cpp @@ -0,0 +1,55 @@ +#include "_mainclass.h" + +_MainClass::_MainClass(QObject *parent) : + QObject(parent) +{ +} + +void _MainClass::setOptions(__DIE_OPTIONS *pOptions) +{ + this->pOptions=pOptions; +} +void _MainClass::handleMessage(QString szMessage) +{ + printf("%s",szMessage.toAscii().data()); + + if(pOptions->bSingleLineOutput) + { + printf("; "); + } + else + { + printf("\n"); + } +} + +//void _MainClass::appendSignature(QString szMessage) +//{ +// QString sType=szMessage.section(": ",0,0); +// if((pOptions->bShowFileFormatOnce)&&(sType!=sCurrentType)) +// { +// szMessage=szMessage.section(": ",1,-1); +// sCurrentType=sType; +// } + +// handleMessage(szMessage); +//} + +void _MainClass::appendError(QString szMessage) +{ + handleMessage(szMessage); +} + +void _MainClass::appendFileName(QString szMessage) +{ + printf("%s",szMessage.toAscii().data()); + + if(pOptions->bSingleLineOutput) + { + printf(": "); + } + else + { + printf("\n"); + } +} diff --git a/die_source/console/_mainclass.h b/die_source/console/_mainclass.h new file mode 100644 index 0000000000000..675c061d67de7 --- /dev/null +++ b/die_source/console/_mainclass.h @@ -0,0 +1,28 @@ +#ifndef _MAINCLASS_H +#define _MAINCLASS_H + +#include +#include +#include "../utils.h" + +class _MainClass : public QObject +{ + Q_OBJECT +public: + explicit _MainClass(QObject *parent = 0); + void setOptions(__DIE_OPTIONS *pOptions); +signals: + +public slots: + void handleMessage(QString szMessage); + // void appendSignature(QString szMessage); + void appendError(QString szMessage); + void appendFileName(QString szMessage); + +private: + bool bSingleLineOutput; + __DIE_OPTIONS *pOptions; + QString sCurrentType; +}; + +#endif // _MAINCLASS_H diff --git a/die_source/console/console.pro b/die_source/console/console.pro new file mode 100644 index 0000000000000..ab3fae6bb728e --- /dev/null +++ b/die_source/console/console.pro @@ -0,0 +1,72 @@ +QT += core script xml concurrent + +QT -= gui + +DEFINES += QT_DISABLE_DEPRECATED_BEFORE=0x000000 + +CONFIG += console +CONFIG -= app_bundle + +TARGET = DIEC +win32 { +TARGET = DIEC_win +} +unix:!macx { +BITSIZE = $$system(getconf LONG_BIT) +if (contains(BITSIZE, 64)) { + TARGET = DIEC_lin64 +} +if (contains(BITSIZE, 32)) { + TARGET = DIEC_lin32 +} +} +unix:macx { +TARGET = DIEC_mac +} + +include(../../build.pri) + +HEADERS += \ + _mainclass.h \ + ../scriptpe.h \ + ../scriptmsdos.h \ + ../scriptelf.h \ + ../scriptbinary.h \ + ../scan.h \ + ../utils.h \ + ../../pluginsscript.h \ + ../_options.h \ + ../../versionresource.h \ + ../../pefile.h \ + ../../msdosfile.h \ + ../../elffile.h \ + ../../textfile.h \ + ../../binary.h \ + ../../machfile.h \ + ../scriptmach.h \ + ../scripttext.h \ + ../scriptgeneric.h \ + ../singlefilescan.h + +SOURCES += \ + mainc.cpp \ + _mainclass.cpp \ + ../scriptpe.cpp \ + ../scriptmsdos.cpp \ + ../scriptelf.cpp \ + ../scriptbinary.cpp \ + ../scan.cpp \ + ../utils.cpp \ + ../../pluginsscript.cpp \ + ../../versionresource.cpp \ + ../../pefile.cpp \ + ../../msdosfile.cpp \ + ../../elffile.cpp \ + ../../textfile.cpp \ + ../../binary.cpp \ + ../../machfile.cpp \ + ../scriptmach.cpp \ + ../scripttext.cpp \ + ../scriptgeneric.cpp \ + ../singlefilescan.cpp + diff --git a/die_source/console/mainc.cpp b/die_source/console/mainc.cpp new file mode 100644 index 0000000000000..427dca45e6ef4 --- /dev/null +++ b/die_source/console/mainc.cpp @@ -0,0 +1,549 @@ +#include +#include +#include "../scan.h" +#include "../_options.h" +#include "_mainclass.h" +#include "../singlefilescan.h" + +void FindFiles(QString sDirectoryName,QStringList *pList,bool bSubDirs) +{ + QDir dir; + dir.setPath(sDirectoryName); + + QFileInfoList fi=dir.entryInfoList(); + + for(int i=0; iappend(fi.at(i).absoluteFilePath()); + } + + if(fi.at(i).isDir()&&(bSubDirs)) + { + FindFiles(fi.at(i).absoluteFilePath(),pList,bSubDirs); + } + } +} + +bool ParseOptions(__DIE_OPTIONS *pOptions,QStringList *pListArguments,QStringList *pListFiles) +{ + QString sParam; + QString sTemp; + + QStringList listTemp1; + + for(int i=1; icount(); i++) + { + sParam=pListArguments->at(i); + + if(sParam.toLower().contains("-showerrors:")) + { + sTemp=sParam.section(":",1,1).toLower(); + + if(sTemp=="yes") + { + pOptions->bShowErrors=true; + } + else if(sTemp=="no") + { + pOptions->bShowErrors=false; + } + else + { + printf("Invalid parameter: %s",sParam.toAscii().data()); + return false; + } + + } + else if(sParam.toLower().contains("-showoptions:")) + { + sTemp=sParam.section(":",1,1).toLower(); + + if(sTemp=="yes") + { + pOptions->bShowOptions=true; + } + else if(sTemp=="no") + { + pOptions->bShowOptions=false; + } + else + { + printf("Invalid parameter: %s",sParam.toAscii().data()); + return false; + } + } + else if(sParam.toLower().contains("-showversion:")) + { + sTemp=sParam.section(":",1,1).toLower(); + + if(sTemp=="yes") + { + pOptions->bShowVersion=true; + } + else if(sTemp=="no") + { + pOptions->bShowVersion=false; + } + else + { + printf("Invalid parameter: %s",sParam.toAscii().data()); + return false; + } + } + else if(sParam.toLower().contains("-subfolders:")) + { + sTemp=sParam.section(":",1,1).toLower(); + + if(sTemp=="yes") + { + pOptions->bScanSubfolders=true; + } + else if(sTemp=="no") + { + pOptions->bScanSubfolders=false; + } + else + { + printf("Invalid parameter: %s",sParam.toAscii().data()); + return false; + } + } + else if(sParam.toLower().contains("-showentropy:")) + { + sTemp=sParam.section(":",1,1).toLower(); + + if(sTemp=="yes") + { + pOptions->bShowEntropy=true; + } + else if(sTemp=="no") + { + pOptions->bShowEntropy=false; + } + else + { + printf("Invalid parameter: %s",sParam.toAscii().data()); + return false; + } + } + else if(sParam.toLower().contains("-singlelineoutput:")) + { + sTemp=sParam.section(":",1,1).toLower(); + + if(sTemp=="yes") + { + pOptions->bSingleLineOutput=true; + } + else if(sTemp=="no") + { + pOptions->bSingleLineOutput=false; + } + else + { + printf("Invalid parameter %s",sParam.toAscii().data()); + return false; + } + } + else if(sParam.toLower().contains("-showfileformatonce:")) + { + sTemp=sParam.section(":",1,1).toLower(); + + if(sTemp=="yes") + { + pOptions->bShowFileFormatOnce=true; + } + else if(sTemp=="no") + { + pOptions->bShowFileFormatOnce=false; + } + else + { + printf("Invalid parameter: %s",sParam.toAscii().data()); + return false; + } + } + else if(sParam.toLower().contains("-fullscan:")) + { + sTemp=sParam.section(":",1,1).toLower(); + + if(sTemp=="yes") + { + pOptions->bFullScan=true; + } + else if(sTemp=="no") + { + pOptions->bFullScan=false; + } + else + { + printf("Invalid parameter: %s",sParam.toAscii().data()); + return false; + } + } + else if(sParam.toLower().contains("-database:")) + { + sTemp=sParam.section(":",1,-1).toLower(); + + QDir _dir; + + if(_dir.exists(Utils::convertPath(sTemp))) + { + pOptions->sDataBasePath=sTemp; + } + else + { + printf("Invalid database name: %s",sTemp.toAscii().data()); + return false; + } + } + else + { + listTemp1.append(sParam); + } + } + + if(listTemp1.count()==0) + { + printf("No file specified"); + + return false; + } + + QFile file; + QDir dir; + + // QDir dir2; + // int nNumberOfSlash=0; + // QStringList listTemp2; + // QFileInfoList fil; + // QString sBaseName; + for(int i=0; ibScanSubfolders); + } + else if(file.exists()) + { + pListFiles->append(listTemp1.at(i)); + } + else if(listTemp1.at(i).contains("*")||listTemp1.at(i).contains("?")) + { + QStringList nameFilters; + nameFilters.append(listTemp1.at(i)); + QDir _dir; + QFileInfoList listFI=_dir.entryInfoList(nameFilters); + + + for(int j=0; jbScanSubfolders); + } + else if(listFI.at(j).isFile()) + { + pListFiles->append(listFI.at(j).absoluteFilePath()); + } + } + } + else + { + printf("Invalid parameter or file name: %s",listTemp1.at(i).toAscii().data()); + return false; + } + + // if(listTemp1.at(i).contains("*")||listTemp1.at(i).contains("?")) + // { + // sTemp=listTemp1.at(i); + // sTemp.replace("/",QDir::separator()); + // sTemp.replace("\\",QDir::separator()); + + // nNumberOfSlash=sTemp.count(QDir::separator()); + + // if(nNumberOfSlash) + // { + // dir2.setPath(sTemp.section(QDir::separator(),0,nNumberOfSlash-1)+QDir::separator()); + // sTemp=sTemp.section(QDir::separator(),nNumberOfSlash); + // } + // fil=dir2.entryInfoList(QStringList()<bScanSubfolders); + // } + // else if(file.exists()) + // { + // pListFiles->append(listTemp2.at(i)); + // } + // else + // { + // printf("Invalid parameter or file name: %s",listTemp2.at(i).toAscii().data()); + // return false; + // } + // } + + return true; +} + +void loadOptions(__DIE_OPTIONS *pOptions) +{ + QSettings settings(Utils::getApplicationPath()+QDir::separator()+"diec.ini",QSettings::IniFormat); + + pOptions->bShowErrors=settings.value("ShowErrors",false).toBool(); + pOptions->bShowOptions=settings.value("ShowOptions",true).toBool(); + pOptions->bShowVersion=settings.value("ShowVersion",true).toBool(); + pOptions->bScanSubfolders=settings.value("ScanSubfolders",true).toBool(); + pOptions->bShowEntropy=settings.value("ShowEntropy",false).toBool(); + pOptions->bSingleLineOutput=settings.value("SingleLineOutput",false).toBool(); + pOptions->bShowFileFormatOnce=settings.value("ShowFileFormatOnce",false).toBool(); + pOptions->bFullScan=settings.value("FullScan",false).toBool(); + pOptions->sDataBasePath=settings.value("DataBase","$app/db").toString(); + pOptions->bShowScanTime=false; +} + +int getNumberOfScripts(QList<__SIGNATURE> *pList) +{ + int nResult=0; + + for(int i=0; icount(); i++) + { + if(pList->at(i).sName!="_init") + { + nResult++; + } + } + + return nResult; +} + +QMap getSubTypes(QList<__SIGNATURE> *pList) +{ + QMap mapResult; + + for(int i=0; icount(); i++) + { + if(pList->at(i).sName!="_init") + { + QString sName=pList->at(i).sName; + + if(sName.count(".")>=3) + { + QString sType=sName.section(".",0,0); + + if((sType!="")&&(!sType.contains(' '))) + { + mapResult.insert(sType,mapResult.value(sType)+1); + } + } + } + } + + return mapResult; +} + +int printSignatures(QString sType,QList<__SIGNATURE> *pList) +{ + int nResult=getNumberOfScripts(pList); + printf("Number of %s signatures: %d\n",sType.toAscii().data(),getNumberOfScripts(pList)); + + QMap mapSubtypes=getSubTypes(pList); + + QMapIterator i(mapSubtypes); + + while(i.hasNext()) + { + i.next(); + printf("\tNumber of %s signatures: %d\n",i.key().toAscii().data(),i.value()); + } + + return nResult; +} + + +int main(int argc, char *argv[]) +{ + QCoreApplication a(argc, argv); + + // __DIE_OPTIONS options; + QStringList arguments=QCoreApplication::arguments(); + // Default options + // options.bShowErrors=true; + // options.bShowOptions=true; + // options.bShowVersion=true; + // options.bScanSubfolders=true; + // options.bShowEntropy=false; + // options.bShowScanTime=false; +#ifdef QT_DEBUG + // arguments.append("/home/trix/progs/xntsv32/xntsv32.exe"); + //// arguments.append("-database:$app/help"); + ////// arguments.append("-singlelineoutput:yes"); + // // arguments.append("-showfileformatonce:no"); + // arguments.append("-showentropy:yes"); + // // arguments.append("-fullscan:yes"); +#endif + + loadOptions(&SingleFileScan::options); + // // fill scripts + Scan::loadScripts(&SingleFileScan::options); + + bool bInvalidBase=(SingleFileScan::options.listBinaryScripts.count()==0) + &&(SingleFileScan::options.listELFScripts.count()==0) + &&(SingleFileScan::options.listMACHScripts.count()==0) + &&(SingleFileScan::options.listMSDOSScripts.count()==0) + &&(SingleFileScan::options.listPEScripts.count()==0) + &&(SingleFileScan::options.listTextScripts.count()==0); + + + if(arguments.count()==1) + { + printf(__DIE); + printf(" "); + printf(__VERSION); + printf(" console\n"); + printf("\n"); + printf("Copyright(C) 2006-2008 Hellsp@wn 2012-2016 Hors\n"); + printf("Website: http://ntinfo.biz\n"); + printf("Bugreports: horsicq@gmail.com\n"); + printf("\n"); + int nTotal=0; + nTotal+=printSignatures("Binary",&SingleFileScan::options.listBinaryScripts); + nTotal+=printSignatures("Text",&SingleFileScan::options.listTextScripts); + nTotal+=printSignatures("MSDOS",&SingleFileScan::options.listMSDOSScripts); + nTotal+=printSignatures("PE/PE+",&SingleFileScan::options.listPEScripts); + nTotal+=printSignatures("ELF/ELF64",&SingleFileScan::options.listELFScripts); + nTotal+=printSignatures("MACH/MACH64",&SingleFileScan::options.listMACHScripts); + printf("Total signatures: %d\n",nTotal); + // printf("Number of Binary signatures: %d\n",getNumberOfScripts(&options.listBinaryScripts)); + // printf("Number of Text signatures: %d\n",getNumberOfScripts(&options.listTextScripts)); + // printf("Number of MSDOS signatures: %d\n",getNumberOfScripts(&options.listMSDOSScripts)); + // printf("Number of PE/PE+ signatures: %d\n",getNumberOfScripts(&options.listPEScripts)); + // printf("Number of ELF/ELF64 signatures: %d\n",getNumberOfScripts(&options.listELFScripts)); + // printf("Number of MACH/MACH64 signatures: %d\n",getNumberOfScripts(&options.listMACHScripts)); + printf("\n"); + printf("Usage: DIEC file/directory [options]\n"); + printf("\n"); + printf("Options:\n"); + printf(QString("-showerrors [default: -showerrors:%1] Show all errors\n").arg(SingleFileScan::options.bShowErrors?"yes":"no").toAscii().data()); + printf(QString("-showoptions [default: -showoptions:%1] Show compiler/protector/packer/etc options\n").arg(SingleFileScan::options.bShowOptions?"yes":"no").toAscii().data()); + printf(QString("-showversion [default: -showversion:%1] Show compiler/protector/packer/etc version\n").arg(SingleFileScan::options.bShowVersion?"yes":"no").toAscii().data()); + printf(QString("-subfolders [default: -subfolders:%1] Scan subfolders. Only for directory scan\n").arg(SingleFileScan::options.bScanSubfolders?"yes":"no").toAscii().data()); + printf(QString("-showentropy [default: -showentropy:%1] Show entropy\n").arg(SingleFileScan::options.bShowEntropy?"yes":"no").toAscii().data()); + printf(QString("-singlelineoutput [default: -singlelineoutput:%1] Output as single line\n").arg(SingleFileScan::options.bSingleLineOutput?"yes":"no").toAscii().data()); + printf(QString("-showfileformatonce [default: -showfileformatonce:%1] Show file format once\n").arg(SingleFileScan::options.bShowFileFormatOnce?"yes":"no").toAscii().data()); + printf(QString("-fullscan [default: -fullscan:%1] Full scan for all valid types\n").arg(SingleFileScan::options.bFullScan?"yes":"no").toAscii().data()); + printf(QString("-database [default: -database:\"%1\"] Set scan database\n").arg(SingleFileScan::options.sDataBasePath).toAscii().data()); + } + else if(arguments.count()>1) + { + QStringList listFiles; + + if(!ParseOptions(&SingleFileScan::options,&arguments,&listFiles)) + { + return 0; + } + + _MainClass mc(&a); + + mc.setOptions(&SingleFileScan::options); + + if(listFiles.count()!=1) + { + mc.handleMessage(QString("Number of files: %1").arg(listFiles.count())); + printf("\n"); + } + + SingleFileScan sfs; + + // sfs.setOptions(&options); + + for(int i=0; i + +// flags +#define DIE_SHOWERRORS 0x00000001 +#define DIE_SHOWOPTIONS 0x00000002 +#define DIE_SHOWVERSION 0x00000004 +#define DIE_SHOWENTROPY 0x00000008 +#define DIE_SINGLELINEOUTPUT 0x00000010 +#define DIE_SHOWFILEFORMATONCE 0x00000020 + +#ifdef __cplusplus +extern "C" { +#endif + +int __declspec(dllexport) __stdcall DIE_scanA(char *pszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags); +int __declspec(dllexport) __stdcall DIE_scanW(wchar_t *pwszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags); +int __declspec(dllexport) __stdcall DIE_scanExA(char *pszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags,char *pszDataBase); +int __declspec(dllexport) __stdcall DIE_scanExW(wchar_t *pwszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags,wchar_t *pwszDataBase); +PCHAR __declspec(dllexport) __stdcall DIE_versionA(void); +PWCHAR __declspec(dllexport) __stdcall DIE_versionW(void); + + +#ifdef UNICODE +#define DIE_scan DIE_scanW +#define DIE_scanEx DIE_scanExW +#define DIE_version DIE_versionW +#else +#define DIE_scan DIE_scanA +#define DIE_scanEx DIE_scanExA +#define DIE_version DIE_versionA +#endif + +#ifdef __cplusplus +} +#endif + +#endif // DIEDLL_H diff --git a/die_source/diedll/diedll.pro b/die_source/diedll/diedll.pro new file mode 100644 index 0000000000000..ba17fec887b3e --- /dev/null +++ b/die_source/diedll/diedll.pro @@ -0,0 +1,64 @@ +#------------------------------------------------- +# +# Project created by QtCreator 2014-02-05T13:18:36 +# +#------------------------------------------------- + +QT +=script xml gui + +TARGET = diedll +TEMPLATE = lib + +include(../../build.pri) + +DEFINES += DIEDLL_LIBRARY + +SOURCES += diedll.cpp \ + ../scriptpe.cpp \ + ../scriptmsdos.cpp \ + ../scriptelf.cpp \ + ../scriptbinary.cpp \ + ../scripttext.cpp \ + ../scan.cpp \ + ../utils.cpp \ + ../../versionresource.cpp \ + ../../pefile.cpp \ + ../../msdosfile.cpp \ + ../../elffile.cpp \ + ../../textfile.cpp \ + ../../binary.cpp \ + ../../pluginsscript.cpp \ + ../../machfile.cpp \ + ../scriptmach.cpp \ + ../scriptgeneric.cpp \ + ../singlefilescan.cpp + +HEADERS += diedll.h \ + ../scriptpe.h \ + ../scriptmsdos.h \ + ../scriptelf.h \ + ../scriptbinary.h \ + ../scripttext.h \ + ../scan.h \ + ../utils.h \ + ../../versionresource.h \ + ../../pefile.h \ + ../../msdosfile.h \ + ../../elffile.h \ + ../../textfile.h \ + ../../binary.h \ + ../../pluginsscript.h \ + ../../machfile.h \ + ../scriptmach.h \ + ../scriptgeneric.h \ + ../singlefilescan.h + + +unix:!symbian { + maemo5 { + target.path = /opt/usr/lib + } else { + target.path = /usr/lib + } + INSTALLS += target +} diff --git a/die_source/dielib/dielib.cpp b/die_source/dielib/dielib.cpp new file mode 100644 index 0000000000000..ad9c3006d6937 --- /dev/null +++ b/die_source/dielib/dielib.cpp @@ -0,0 +1,34 @@ +#include "dielib.h" +#include "../singlefilescan.h" + +int DIE_scanExA(char *pszFileName, char *pszOutBuffer, int nOutBufferSize, unsigned int nFlags, char *pszDataBase) +{ + return __DIE_scanExA(pszFileName,pszOutBuffer,nOutBufferSize,nFlags,pszDataBase); +} + +int DIE_scanExW(wchar_t *pwszFileName, char *pszOutBuffer, int nOutBufferSize, unsigned int nFlags, wchar_t *pwszDataBase) +{ + return __DIE_scanExW(pwszFileName,pszOutBuffer,nOutBufferSize,nFlags,pwszDataBase); +} + +int DIE_scanA(char *pszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags) +{ + return __DIE_scanA(pszFileName,pszOutBuffer,nOutBufferSize,nFlags); +} + +int DIE_scanW(wchar_t *pwszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags) +{ + return __DIE_scanW(pwszFileName,pszOutBuffer,nOutBufferSize,nFlags); +} + +char *DIE_versionA() +{ + return __DIE_versionA(); +} + +wchar_t *DIE_versionW() +{ + return __DIE_versionW(); +} + + diff --git a/die_source/dielib/dielib.h b/die_source/dielib/dielib.h new file mode 100644 index 0000000000000..ee8efbeae406b --- /dev/null +++ b/die_source/dielib/dielib.h @@ -0,0 +1,43 @@ +#ifndef DIELIB_H +#define DIELIB_H + +#include + +// flags +#define DIE_SHOWERRORS 0x00000001 +#define DIE_SHOWOPTIONS 0x00000002 +#define DIE_SHOWVERSION 0x00000004 +#define DIE_SHOWENTROPY 0x00000008 +#define DIE_SINGLELINEOUTPUT 0x00000010 +#define DIE_SHOWFILEFORMATONCE 0x00000020 + +#ifdef Q_OS_WIN +typedef unsigned short wchar_t; +#endif + + +#ifdef __cplusplus +extern "C" { +#endif +int DIE_scanA(char *pszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags); +int DIE_scanW(wchar_t *pwszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags); +int DIE_scanExA(char *pszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags,char *pszDataBase); +int DIE_scanExW(wchar_t *pwszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags,wchar_t *pwszDataBase); +char* DIE_versionA(); +wchar_t* DIE_versionW(); + +#ifdef UNICODE +#define DIE_scan DIE_scanW +#define DIE_scanEx DIE_scanExW +#define DIE_version DIE_versionW +#else +#define DIE_scan DIE_scanA +#define DIE_scanEx DIE_scanExA +#define DIE_version DIE_versionA +#endif + +#ifdef __cplusplus +} +#endif + +#endif // DIELIB_H diff --git a/die_source/dielib/dielib.pro b/die_source/dielib/dielib.pro new file mode 100644 index 0000000000000..714a1bd48cf1f --- /dev/null +++ b/die_source/dielib/dielib.pro @@ -0,0 +1,71 @@ +#------------------------------------------------- +# +# Project created by QtCreator 2014-02-05T13:18:36 +# +#------------------------------------------------- + +QT +=script xml gui + +TARGET = dielib + +win32 { + TARGET = dielib_win32 +} +unix:!macx { + + BITSIZE = $$system(getconf LONG_BIT) + if (contains(BITSIZE, 64)) { + TARGET = dielib_lin64 + } + if (contains(BITSIZE, 32)) { + TARGET = dielib_lin32 + } +} + +unix:macx { + TARGET = dielib_mac +} + +TEMPLATE = lib +CONFIG+= staticlib + +SOURCES += dielib.cpp \ + ../scriptpe.cpp \ + ../scriptmsdos.cpp \ + ../scriptelf.cpp \ + ../scriptbinary.cpp \ + ../scripttext.cpp \ + ../scan.cpp \ + ../utils.cpp \ + ../../pluginsscript.cpp \ + ../../versionresource.cpp \ + ../../pefile.cpp \ + ../../msdosfile.cpp \ + ../../elffile.cpp \ + ../../textfile.cpp \ + ../../binary.cpp \ + ../../machfile.cpp \ + ../scriptmach.cpp \ + ../scriptgeneric.cpp \ + ../singlefilescan.cpp + +HEADERS += dielib.h \ + ../scriptpe.h \ + ../scriptmsdos.h \ + ../scriptelf.h \ + ../scriptbinary.h \ + ../scripttext.h \ + ../scan.h \ + ../utils.h \ + ../../pluginsscript.h \ + ../../versionresource.h \ + ../../pefile.h \ + ../../msdosfile.h \ + ../../elffile.h \ + ../../textfile.h \ + ../../binary.h \ + ../../machfile.h \ + ../scriptmach.h \ + ../scriptgeneric.h \ + ../singlefilescan.h + diff --git a/die_source/scan.cpp b/die_source/scan.cpp new file mode 100644 index 0000000000000..ef2b624651f0a --- /dev/null +++ b/die_source/scan.cpp @@ -0,0 +1,616 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#include "scan.h" + +//using namespace QtConcurrent; + +Scan::Scan(QObject *parent) : + QObject(parent) +{ + connect(this,SIGNAL(die_appendSignatureSignal(QString)),this,SLOT(die_appendSignatureSlot(QString))); + + dirContent=0; + nNumberOfSignatures=0; + bIsRun=false; + bIsCompleted=true; + + bShowSource=false; +} + +void Scan::setData(QString sScanFileName,__DIE_OPTIONS *pOptions) +{ + this->sScanFileName=sScanFileName; + this->pOptions=pOptions; +} + +void Scan::setData(QList *dirContent,__DIE_OPTIONS *pOptions) +{ + this->dirContent=dirContent; + this->pOptions=pOptions; +} + +void Scan::setData(__DIE_OPTIONS *pOptions) +{ + this->pOptions=pOptions; +} + +void Scan::setShowSource(bool bShowSource) +{ + this->bShowSource=bShowSource; +} + +void Scan::_stop() +{ + bIsRun=false; +} + +bool Scan::isRun() +{ + return bIsRun; +} + +bool Scan::isCompleted() +{ + return bIsCompleted; +} + +void Scan::setRun(bool bIsRun) +{ + this->bIsRun=bIsRun; +} + +void Scan::process() +{ + if(bIsRun) + { + return; + } + + bIsRun=true; + bIsCompleted=false; + + if(sScanFileName!="") + { + analize(sScanFileName,pOptions->bFullScan); + } + else if(dirContent) + { + emit setProgressBar2(1,0); + + for(int i=0; (icount())&&(bIsRun); i++) + { + analize(dirContent->at(i),pOptions->bFullScan); + emit die_appendSignatureSignal(""); + + emit setProgressBar2(dirContent->count(),i+1); + } + + emit setProgressBar2(1,1); + } + + emit _finished(); + + bIsCompleted=true; + bIsRun=false; +} + +bool Scan::analize(QString sFileName,bool bFullScan) +{ + if(pOptions->pMutexResult) + { + pOptions->pMutexResult->lock(); + } + + + QTime scanTime=QTime::currentTime(); + +// pOptions->nNumberOfResults=0; + + emit appendFileName(sFileName); + + if(pOptions->sm==SM_DIE) + { + pOptions->die_listResult.clear(); + + Binary file; + + PluginsScript engine; + + connect(&file,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + connect(&engine,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + connect(&engine,SIGNAL(appendMessage(QString)),this,SIGNAL(die_appendSignatureSignal(QString))); + + QList listTypes; + + if(file.setFileName(sFileName)) + { + listTypes=file.getTypes(); + //qDebug(sType.toAscii().data()); + file.close(); + } + else + { + file.close(); + + return false; + } + + int nCount=listTypes.count(); + + if(!bFullScan) + { + nCount=1; + } + + for(int i=0; ism==SM_NFD) + { + emit setProgressBar(1,0); + + SpecAbstract::SCAN_OPTIONS nfd_options=SpecAbstract::SCAN_OPTIONS(); + nfd_options.bScanOverlay=pOptions->bScanScanOverlayNFD; + nfd_options.bDeepScan=pOptions->bScanDeepScanNFD; + + pOptions->nfd_listResult=StaticScan::process(sFileName,&nfd_options); + + emit setProgressBar(1,1); + } +#endif + + int nMs=scanTime.msecsTo(QTime::currentTime()); + + emit singleScanComplete(nMs); + + return true; +} + +bool Scan::die_scanPE(QString sFileName,QString sPrefix) +{ + PluginsScript engine; + connect(&engine,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + connect(&engine,SIGNAL(appendMessage(QString)),this,SIGNAL(die_appendSignatureSignal(QString))); + + PEFile _pefile; + connect(&_pefile,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + scriptPE scriptpe; + connect(&scriptpe,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + + if(_pefile.setFileName(sFileName)) + { + // if(!_pefile.completeCheck()) + // { + // emit setProgressBar(1,1); + // return false; + // } + + // emit appendError(QString("Number of signatures: %1").arg(nNumberOfSignatures)); + + _pefile.entryPointLoad(); + + if(_pefile.isNETPresent()) + { + _pefile.entryPointLoad_NET(); + } + + scriptpe.setData(&_pefile); + + engine.setData(&scriptpe,"PE",Utils::getDataBasePath(pOptions)); + + die_handleSignatures(&engine,&(pOptions->listPEScripts),sPrefix); + + return true; + } + else + { + emit setProgressBar(1,1); + return false; + } +} + +bool Scan::die_scanELF(QString sFileName,QString sPrefix) +{ + PluginsScript engine; + connect(&engine,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + connect(&engine,SIGNAL(appendMessage(QString)),this,SIGNAL(die_appendSignatureSignal(QString))); + + ELFFile _elfile; + connect(&_elfile,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + scriptELF scriptelf; + connect(&scriptelf,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + + if(_elfile.setFileName(sFileName)) + { + _elfile.entryPointLoad(); + + scriptelf.setData(&_elfile); + + engine.setData(&scriptelf,"ELF",Utils::getDataBasePath(pOptions)); + + die_handleSignatures(&engine,&(pOptions->listELFScripts),sPrefix); + + return true; + } + else + { + emit setProgressBar(1,1); + return false; + } + +} + +bool Scan::die_scanMACH(QString sFileName,QString sPrefix) +{ + PluginsScript engine; + connect(&engine,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + connect(&engine,SIGNAL(appendMessage(QString)),this,SIGNAL(die_appendSignatureSignal(QString))); + + MACHFile _machfile; + connect(&_machfile,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + scriptMACH scriptmach; + connect(&scriptmach,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + + if(_machfile.setFileName(sFileName)) + { + _machfile.entryPointLoad(); + + scriptmach.setData(&_machfile); + + engine.setData(&scriptmach,"MACH",Utils::getDataBasePath(pOptions)); + + die_handleSignatures(&engine,&(pOptions->listMACHScripts),sPrefix); + + return true; + } + else + { + emit setProgressBar(1,1); + return false; + } +} + +bool Scan::die_scanMSDOS(QString sFileName, QString sPrefix) +{ + PluginsScript engine; + connect(&engine,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + connect(&engine,SIGNAL(appendMessage(QString)),this,SIGNAL(die_appendSignatureSignal(QString))); + + MSDOSFile _msdosfile; + connect(&_msdosfile,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + scriptMSDOS scriptmsdos; + connect(&scriptmsdos,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + + if(_msdosfile.setFileName(sFileName)) + { + _msdosfile.entryPointLoad(); + + scriptmsdos.setData(&_msdosfile); + + engine.setData(&scriptmsdos,"MSDOS",Utils::getDataBasePath(pOptions)); + + die_handleSignatures(&engine,&(pOptions->listMSDOSScripts),sPrefix); + + return true; + } + else + { + emit setProgressBar(1,1); + return false; + } +} + +bool Scan::die_scanText(QString sFileName,QString sPrefix) +{ + PluginsScript engine; + connect(&engine,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + connect(&engine,SIGNAL(appendMessage(QString)),this,SIGNAL(die_appendSignatureSignal(QString))); + + TextFile _text; + connect(&_text,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + scriptText scripttext; + connect(&scripttext,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + + if(_text.setFileName(sFileName)) + { + scripttext.setData(&_text); + + engine.setData(&scripttext,"Text",Utils::getDataBasePath(pOptions)); + + die_handleSignatures(&engine,&(pOptions->listTextScripts),sPrefix); + + return true; + } + else + { + emit setProgressBar(1,1); + return false; + } +} + +bool Scan::die_scanBinary(QString sFileName,QString sPrefix) +{ + PluginsScript engine; + connect(&engine,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + connect(&engine,SIGNAL(appendMessage(QString)),this,SIGNAL(die_appendSignatureSignal(QString))); + + Binary _binary; + connect(&_binary,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + scriptBinary scriptbinary; + connect(&scriptbinary,SIGNAL(appendError(QString)),this,SIGNAL(appendError(QString))); + + if(_binary.setFileName(sFileName)) + { + scriptbinary.setData(&_binary); + + engine.setData(&scriptbinary,"Binary",Utils::getDataBasePath(pOptions)); + + die_handleSignatures(&engine,&(pOptions->listBinaryScripts),sPrefix); + + return true; + } + else + { + emit setProgressBar(1,1); + return false; + } +} + +void Scan::die_handleSignatures(PluginsScript *pluginScript, QList<__SIGNATURE> *pListSignatures, QString sType) +{ + int _nNumberOfSignatures=pListSignatures->count(); + + for(int i=0; i<_nNumberOfSignatures; i++) + { + // listSignatures.append(pOptions->listBinaryScripts.at(i)); + if(pListSignatures->at(i).sName=="_init") + { + pluginScript->evaluate(pListSignatures->at(i).sText,"_init"); + break; + } + } + + int k=0; + bResult=false; + + for(int i=0; (i<_nNumberOfSignatures)&&(bIsRun); i++) + { + if(pListSignatures->at(i).sName!="_init") + { + QTime scanTime; + + if(pOptions->bShowScanTime) + { + scanTime=QTime::currentTime(); + } + + die_compareFile(pluginScript,pListSignatures->at(i).sText,pListSignatures->at(i).sName,sType); + + if(pOptions->bShowScanTime) + { + emit appendError(QString("%1: %2 ms").arg(pListSignatures->at(i).sName).arg(scanTime.msecsTo(QTime::currentTime()))); + } + + if(i+1>(_nNumberOfSignatures/30)*k) + { + emit setProgressBar(_nNumberOfSignatures,i+1); + k++; + } + } + } + + emit setProgressBar(1,1); + + if(bResult==false) + { + emit die_appendSignatureSignal(sType+": Nothing found"); + } +} + +void Scan::loadTypeScripts(QList<__SIGNATURE> *pList, QString sType,__DIE_OPTIONS *pOptions) +{ + __SIGNATURE _signature; + + QList<__SIGNATURE> listSignatures; + + pList->clear(); + + // QString sPath=Utils::getApplicationPath(); + + QDir dir(Utils::getDataBasePath(pOptions)+QDir::separator()+sType); + QFileInfoList dircontent=dir.entryInfoList(QStringList()<<"*.sg"<<"_init"); + QFile file; + QString sScript; + + for(int i=0; iappend(listSignatures.at(i)); + listSignatures.removeAt(i); + break; + } + } + + QString sPriority; + QString sName; + int nCount=0; + + QSet set; + + for(int i=0; i1) + { + sPriority=sName.section(".",nCount-1,nCount-1); + set.insert(sPriority); + } + } + + QList values = set.values(); + qSort(values); + + for(int j=0; j1) + { + sPriority=sName.section(".",nCount-1,nCount-1); + + if(sPriority==values.at(j)) + { + pList->append(listSignatures.at(i)); + listSignatures.removeAt(i); + i--; + } + } + } + } + + pList->append(listSignatures); +} + +void Scan::die_loadScripts(__DIE_OPTIONS *pOptions) +{ + loadTypeScripts(&pOptions->listBinaryScripts,"Binary",pOptions); + loadTypeScripts(&pOptions->listTextScripts,"Text",pOptions); + loadTypeScripts(&pOptions->listELFScripts,"ELF",pOptions); + loadTypeScripts(&pOptions->listMSDOSScripts,"MSDOS",pOptions); + loadTypeScripts(&pOptions->listPEScripts,"PE",pOptions); + loadTypeScripts(&pOptions->listMACHScripts,"MACH",pOptions); +} + +void Scan::die_appendSignatureSlot(QString sString) +{ + //qDebug(sString.toLatin1().data()); + + if((sString!="")&&(!sString.contains("Nothing found"))) + { + __DIE_RESULT record; + QString sTemp; + if(sString.contains(";")) + { + record.sSignature=sString.section(";",0,0); + sTemp=sString.section(";",1,-1); + } + else + { + sTemp=sString; + } + + record.sFileType=sTemp.section(":",0,0); + record.sType=sTemp.section(":",1,1); + record.sName=sTemp.section(":",2,-1); + + pOptions->die_listResult.append(record); + } +} + +QString Scan::die_compareFile(PluginsScript *pScript,QString sScript,QString sScriptName,QString sType) +{ + QScriptValueList args; + QString sResult=""; + + args<bScanShowVersionDIE<bScanShowOptionsDIE; + + QScriptValue result=pScript->call(sScript,"detect",args,sScriptName); + + if(result.toString()!="") + { +// pOptions->nNumberOfResults++; + QString sSignature; + + if(bShowSource) + { + sSignature=sScriptName+";"; + } + + sSignature+=sType+": "+result.toString(); + + emit die_appendSignatureSignal(sSignature); + + bResult=true; + + sResult=result.toString(); + } + + return sResult; +} + +//void Scan::_compareFile(QString sScript) +//{ +// compareFile(pScript,sScript); +//} diff --git a/die_source/scan.h b/die_source/scan.h new file mode 100644 index 0000000000000..0a1370c6dfa9f --- /dev/null +++ b/die_source/scan.h @@ -0,0 +1,112 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#ifndef SCAN_H +#define SCAN_H + + +#include +//#include +#include +#include +#include +#include +#include +#include +#include + +#include "../pluginsscript.h" +#include "scriptpe.h" +#include "scriptbinary.h" +#include "scriptelf.h" +#include "scriptmsdos.h" +#include "scriptmach.h" +#include "scripttext.h" +#include "_options.h" +#include "utils.h" + +#define DIE_SHOWERRORS 0x00000001 +#define DIE_SHOWOPTIONS 0x00000002 +#define DIE_SHOWVERSION 0x00000004 +#define DIE_SHOWENTROPY 0x00000008 +#define DIE_SINGLELINEOUTPUT 0x00000010 +#define DIE_SHOWFILEFORMATONCE 0x00000020 +#define DIE_FULLSCAN 0x00000040 + +class Scan : public QObject +{ + Q_OBJECT +public: + explicit Scan(QObject *parent = 0); + void setData(QString sScanFileName,__DIE_OPTIONS *pOptions); + void setData(QList *dirContent,__DIE_OPTIONS *pOptions); + void setData(__DIE_OPTIONS *pOptions); + void setShowSource(bool bShowSource); + + bool isRun(); + bool isCompleted(); + void setRun(bool bIsRun); + + bool analize(QString sFileName,bool bFullScan); + bool die_scanPE(QString sFileName,QString sPrefix); + bool die_scanELF(QString sFileName,QString sPrefix); + bool die_scanMACH(QString sFileName,QString sPrefix); + bool die_scanMSDOS(QString sFileName,QString sPrefix); + bool die_scanText(QString sFileName,QString sPrefix); + bool die_scanBinary(QString sFileName,QString sPrefix); + + void die_handleSignatures(PluginsScript *pluginScript,QList<__SIGNATURE> *pListSignatures,QString sType); + + static void loadTypeScripts(QList<__SIGNATURE> *pList,QString sType,__DIE_OPTIONS *pOptions); + static void die_loadScripts(__DIE_OPTIONS *pOptions); + // void _compareFile(QString sScript); +signals: + void die_appendSignatureSignal(const QString &sString); + void setProgressBar(int nMax,int nValue); + void setProgressBar2(int nMax,int nValue); + void appendError(QString sText); + void appendFileName(QString sText); + void appendExtra(QString sText); + void singleScanComplete(int nTime); + void _finished(); + +private slots: + void die_appendSignatureSlot(QString sString); + +public slots: + void process(); + void _stop(); + +private: + bool bShowSource; + QString sScanFileName; + __DIE_OPTIONS *pOptions; + QList *dirContent; + int nNumberOfSignatures; + bool bIsRun; + bool bIsCompleted; + bool bResult; + + // PluginsScript *pScript; + QString sFileName; + QString die_compareFile(PluginsScript *pScript,QString sScript,QString sScriptName,QString sType); +}; + +#endif // SCAN_H diff --git a/die_source/scriptbinary.cpp b/die_source/scriptbinary.cpp new file mode 100644 index 0000000000000..a81bd85afa2af --- /dev/null +++ b/die_source/scriptbinary.cpp @@ -0,0 +1,149 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#include "scriptbinary.h" + +scriptBinary::scriptBinary(QObject *parent) : + scriptGeneric(parent) +{ +} + +void scriptBinary::setData(Binary *binary) +{ + this->binary=binary; +} +//bool scriptBinary::isPlainText() +//{ +// return binary->isPlainText(); +//} + +bool scriptBinary::compare(QString sSignature,unsigned int nOffset) +{ + return binary->compare(sSignature,nOffset); +} + +//bool scriptBinary::compareHeader(QString sSignature) +//{ +// return binary->compareHeader(sSignature); +//} + +bool scriptBinary::compareEP(QString sSignature,unsigned int nOffset) +{ + return binary->compareEP(sSignature,nOffset); +} + +//bool scriptBinary::compareEPn(QString sSignature,unsigned int nOffset) +//{ +// return compare(sSignature,nOffset); +//} +//void scriptBinary::_log(QString sString) +//{ +// emit appendError(sString); +//} + +QString scriptBinary::getString(unsigned int nOffset, unsigned int nSize) +{ + return binary->getString(nOffset,nSize); +} + +unsigned int scriptBinary::readDword(unsigned int nOffset) +{ + return binary->readDword(nOffset); +} + +unsigned short scriptBinary::readWord(unsigned int nOffset) +{ + return binary->readWord(nOffset); +} + +unsigned char scriptBinary::readByte(unsigned int nOffset) +{ + return binary->readByte(nOffset); +} + +unsigned int scriptBinary::getSize() +{ + return binary->size(); +} + +QString scriptBinary::getFileDirectory() +{ + return binary->getFileDirectory(); +} + +QString scriptBinary::getFileBaseName() +{ + return binary->getFileBaseName(); +} + +QString scriptBinary::getFileSuffix() +{ + return binary->getFileSuffix(); +} + +QString scriptBinary::getFileCompleteSuffix() +{ + return binary->getFileCompleteSuffix(); +} + +int scriptBinary::findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue) +{ + return binary->findByte(nOffset,nSize,cValue); +} + +int scriptBinary::findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue) +{ + return binary->findWord(nOffset,nSize,sValue); +} + +int scriptBinary::findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue) +{ + return binary->findDword(nOffset,nSize,nValue); +} + +int scriptBinary::findString(unsigned int nOffset, unsigned int nSize, QString sValue) +{ + return binary->findString(nOffset,nSize,sValue); +} + +int scriptBinary::findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return binary->findSignature(nOffset,nSize,sSignature); +} + +bool scriptBinary::isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return binary->isSignaturePresent(nOffset,nSize,sSignature); +} + +float scriptBinary::calculateEntropy(unsigned int nOffset, unsigned int nSize) +{ + return binary->calculateEntropy(nOffset,nSize); +} + +QString scriptBinary::getSignature(unsigned int nOffset, unsigned int nSize) +{ + return binary->getSignature(nOffset,nSize); +} + +QString scriptBinary::calculateMD5(unsigned int nOffset, unsigned int nSize) +{ + return binary->calculateMD5(nOffset,nSize); +} diff --git a/die_source/scriptbinary.h b/die_source/scriptbinary.h new file mode 100644 index 0000000000000..69b3e30c99c27 --- /dev/null +++ b/die_source/scriptbinary.h @@ -0,0 +1,74 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#ifndef SCRIPTBINARY_H +#define SCRIPTBINARY_H + +#include "scriptgeneric.h" + +#include "../binary.h" + +class scriptBinary : public scriptGeneric +{ + Q_OBJECT +public: + explicit scriptBinary(QObject *parent = 0); + void setData(Binary *binary); + +signals: + // void appendError(QString sString); + +public slots: + // void _log(QString sString); + // unsigned int swapBytes(unsigned int nValue); + // QString upperCase(QString sString); + + // bool isPlainText(); + + bool compare(QString sSignature,unsigned int nOffset=0); + // bool compareHeader(QString sSignature); + bool compareEP(QString sSignature,unsigned int nOffset=0); + // bool compareEPn(QString sSignature,unsigned int nOffset); + + QString getString(unsigned int nOffset,unsigned int nSize=50); + unsigned int readDword(unsigned int nOffset); + unsigned short readWord(unsigned int nOffset); + unsigned char readByte(unsigned int nOffset); + unsigned int getSize(); + QString getFileDirectory(); + QString getFileBaseName(); + QString getFileSuffix(); + QString getFileCompleteSuffix(); + int findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue); + int findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue); + int findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue); + int findString(unsigned int nOffset, unsigned int nSize, QString sValue); + int findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature); + bool isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature); + + float calculateEntropy(unsigned int nOffset, unsigned int nSize); + QString getSignature(unsigned int nOffset,unsigned int nSize); + QString calculateMD5(unsigned int nOffset, unsigned int nSize); + +private: + Binary *binary; +}; + +#endif // SCRIPTBINARY_H diff --git a/die_source/scriptelf.cpp b/die_source/scriptelf.cpp new file mode 100644 index 0000000000000..be692d6dd432e --- /dev/null +++ b/die_source/scriptelf.cpp @@ -0,0 +1,365 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#include "scriptelf.h" + +scriptELF::scriptELF(QObject *parent) : + scriptGeneric(parent) +{ +} + +void scriptELF::setData(ELFFile *elffile) +{ + this->elffile=elffile; + + // emit appendError("Test2"); +} +QString scriptELF::getGeneralOptions() +{ + QString sResult; + + bool bIs64=elffile->isELF64(); + + QString sType; + QString sBits; + unsigned int nType=elffile->getElfHeader_type(); + + if(nType==0) + { + sType="unknown"; + } + else if(nType==1) + { + sType="relocatable"; + } + else if(nType==2) + { + sType="executable"; + } + else if(nType==3) + { + sType="shared object"; + } + else if(nType==4) + { + sType="core file"; + } + + if(bIs64) + { + sBits="64"; + } + else + { + sBits="32"; + } + + sResult=QString("%1 %2-%3").arg(sType).arg(elffile->getMachineAsString()).arg(sBits); + + return sResult; +} + +unsigned short scriptELF::getElfHeader_type() +{ + return elffile->getElfHeader_type(); +} + +unsigned short scriptELF::getElfHeader_machine() +{ + return elffile->getElfHeader_machine(); +} + +unsigned int scriptELF::getElfHeader_version() +{ + return elffile->getElfHeader_version(); +} + +unsigned int scriptELF::getElfHeader_entry() +{ + return elffile->getElfHeader_entry(); +} + +unsigned long long scriptELF::getElfHeader_entry64() +{ + return elffile->getElfHeader_entry64(); +} + +unsigned int scriptELF::getElfHeader_phoff() +{ + return elffile->getElfHeader_phoff(); +} + +unsigned long long scriptELF::getElfHeader_phoff64() +{ + return elffile->getElfHeader_phoff64(); +} + +unsigned int scriptELF::getElfHeader_shoff() +{ + return elffile->getElfHeader_shoff(); +} +unsigned long long scriptELF::getElfHeader_shoff64() +{ + return elffile->getElfHeader_shoff64(); +} + +unsigned int scriptELF::getElfHeader_flags() +{ + return elffile->getElfHeader_flags(); +} + +unsigned short scriptELF::getElfHeader_ehsize() +{ + return elffile->getElfHeader_ehsize(); +} + +unsigned short scriptELF::getElfHeader_phentsize() +{ + return elffile->getElfHeader_phentsize(); +} + +unsigned short scriptELF::getElfHeader_phnum() +{ + return elffile->getElfHeader_phnum(); +} + +unsigned short scriptELF::getElfHeader_shentsize() +{ + return elffile->getElfHeader_shentsize(); +} + +unsigned short scriptELF::getElfHeader_shnum() +{ + return elffile->getElfHeader_shnum(); +} + +unsigned short scriptELF::getElfHeader_shstrndx() +{ + return elffile->getElfHeader_shstrndx(); + +} +//bool scriptELF::compareHeader(QString sSignature) +//{ +// return elffile->compareHeader(sSignature); +//} + +bool scriptELF::compare(QString sSignature,unsigned int nOffset) +{ + return elffile->compare(sSignature.toUpper(),nOffset); +} +bool scriptELF::compareEP(QString sSignature,unsigned int nOffset) +{ + // return elffile->compareEPfast(sSignature); + return elffile->compareEP(sSignature,nOffset); +} + +//bool scriptELF::compareEPn(QString sSignature,unsigned int nOffset) +//{ +// return elffile->compareEPn(sSignature,nOffset); +//} + +QString scriptELF::getFileDirectory() +{ + return elffile->getFileDirectory(); +} + +QString scriptELF::getFileBaseName() +{ + return elffile->getFileBaseName(); +} + +QString scriptELF::getFileSuffix() +{ + return elffile->getFileSuffix(); +} + +QString scriptELF::getFileCompleteSuffix() +{ + return elffile->getFileCompleteSuffix(); +} + +unsigned int scriptELF::getSize() +{ + return elffile->size(); +} + +QString scriptELF::getString(unsigned int nOffset, unsigned int nSize) +{ + return elffile->getString(nOffset,nSize); +} + +unsigned int scriptELF::readDword(unsigned int nOffset) +{ + return elffile->readDword(nOffset); +} + +unsigned short scriptELF::readWord(unsigned int nOffset) +{ + return elffile->readWord(nOffset); +} + +unsigned char scriptELF::readByte(unsigned int nOffset) +{ + return elffile->readByte(nOffset); +} +int scriptELF::findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue) +{ + return elffile->findByte(nOffset,nSize,cValue); +} + +int scriptELF::findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue) +{ + return elffile->findWord(nOffset,nSize,sValue); +} + +int scriptELF::findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue) +{ + return elffile->findDword(nOffset,nSize,nValue); +} + +int scriptELF::findString(unsigned int nOffset, unsigned int nSize, QString sValue) +{ + return elffile->findString(nOffset,nSize,sValue); +} + +int scriptELF::findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return elffile->findSignature(nOffset,nSize,sSignature); +} + +bool scriptELF::isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return elffile->isSignaturePresent(nOffset,nSize,sSignature); +} + +//bool scriptELF::compareReg(QString sSignature,unsigned int nOffset) +//{ +// return elffile->_compare(sSignature,nOffset); +//} + +bool scriptELF::isSectionNamePresent(QString sSectionName) +{ + return elffile->isSectionNamePresent(sSectionName); +} + +bool scriptELF::isStringInTablePresent(QString sSectionName, QString sString) +{ + return elffile->isStringInTablePresent(sSectionName,sString); +} + +float scriptELF::calculateEntropy(unsigned int nOffset, unsigned int nSize) +{ + return elffile->calculateEntropy(nOffset,nSize); +} + +QString scriptELF::getSignature(unsigned int nOffset, unsigned int nSize) +{ + return elffile->getSignature(nOffset,nSize); +} + +QString scriptELF::calculateMD5(unsigned int nOffset, unsigned int nSize) +{ + return elffile->calculateMD5(nOffset,nSize); +} + +unsigned int scriptELF::getSectionFileOffset(int nSection) +{ + return elffile->getSectionFileOffset(nSection); +} + +unsigned int scriptELF::getSectionFileSize(int nSection) +{ + return elffile->getSectionFileSize(nSection); +} + +int scriptELF::getSectionNumber(QString sSectionName) +{ + return elffile->getSectionNumber(sSectionName); +} + +long long scriptELF::RVAToOffset(unsigned long long nRVA) +{ + return elffile->RVAToOffset(nRVA); +} + +long long scriptELF::VAToOffset(unsigned long long nVA) +{ + return elffile->VAToOffset(nVA); +} + +long long scriptELF::OffsetToVA(unsigned long long nOffset) +{ + return elffile->OffsetToVA(nOffset); +} + +long long scriptELF::OffsetToRVA(unsigned long long nOffset) +{ + return elffile->OffsetToRVA(nOffset); +} + +unsigned int scriptELF::getProgramFileOffset(int nProgram) +{ + return elffile->getProgramFileOffset(nProgram); +} + +unsigned int scriptELF::getProgramFileSize(int nProgram) +{ + return elffile->getProgramFileSize(nProgram); +} + +unsigned int scriptELF::getOverlaySize() +{ + return elffile->getOverlaySize(); +} + +unsigned int scriptELF::getOverlayOffset() +{ + return elffile->getOverlayOffset(); +} + +bool scriptELF::isOverlayPresent() +{ + return elffile->isOverlayPresent(); +} + +int scriptELF::getNumberOfSections() +{ + return elffile->getNumberOfSections(); +} + +int scriptELF::getNumberOfPrograms() +{ + return elffile->getNumberOfPrograms(); +} + +QString scriptELF::getSectionName(int nSection) +{ + return elffile->getSectionName(nSection); +} + +bool scriptELF::compareOverlay(QString sSignature, unsigned int nOffset) +{ + return compareOverlay(sSignature,nOffset); +} + +long long scriptELF::getEntryPointOffset() +{ + return elffile->getEntryPointOffset(); +} diff --git a/die_source/scriptelf.h b/die_source/scriptelf.h new file mode 100644 index 0000000000000..66b91c463adfc --- /dev/null +++ b/die_source/scriptelf.h @@ -0,0 +1,114 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#ifndef SCRIPTELF_H +#define SCRIPTELF_H + +#include "scriptgeneric.h" +#include "../elffile.h" + +class scriptELF : public scriptGeneric +{ + Q_OBJECT +public: + explicit scriptELF(QObject *parent = 0); + void setData(ELFFile *elffile); + + +public slots: + QString getGeneralOptions(); + + unsigned short getElfHeader_type(); + unsigned short getElfHeader_machine(); + unsigned int getElfHeader_version(); + unsigned int getElfHeader_entry(); + unsigned long long getElfHeader_entry64(); + unsigned int getElfHeader_phoff(); + unsigned long long getElfHeader_phoff64(); + unsigned int getElfHeader_shoff(); + unsigned long long getElfHeader_shoff64(); + unsigned int getElfHeader_flags(); + unsigned short getElfHeader_ehsize(); + unsigned short getElfHeader_phentsize(); + unsigned short getElfHeader_phnum(); + unsigned short getElfHeader_shentsize(); + unsigned short getElfHeader_shnum(); + unsigned short getElfHeader_shstrndx(); + + bool compareEP(QString sSignature,unsigned int nOffset=0); + // bool compareEPn(QString sSignature,unsigned int nOffset); + // bool compareHeader(QString sSignature); + bool compare(QString sSignature,unsigned int nOffset=0); + QString getFileDirectory(); + QString getFileBaseName(); + QString getFileSuffix(); + QString getFileCompleteSuffix(); + unsigned int getSize(); + QString getString(unsigned int nOffset,unsigned int nSize=50); + unsigned int readDword(unsigned int nOffset); + unsigned short readWord(unsigned int nOffset); + unsigned char readByte(unsigned int nOffset); + int findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue); + int findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue); + int findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue); + int findString(unsigned int nOffset, unsigned int nSize, QString sValue); + int findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature); + bool isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature); + + // bool compareReg(QString sSignature,unsigned int nOffset); + + bool isSectionNamePresent(QString sSectionName); + bool isStringInTablePresent(QString sSectionName, QString sString); + + float calculateEntropy(unsigned int nOffset, unsigned int nSize); + QString getSignature(unsigned int nOffset,unsigned int nSize); + QString calculateMD5(unsigned int nOffset, unsigned int nSize); + + unsigned int getSectionFileOffset(int nSection); + unsigned int getSectionFileSize(int nSection); + int getSectionNumber(QString sSectionName); + + long long RVAToOffset(unsigned long long nRVA); + long long VAToOffset(unsigned long long nVA); + long long OffsetToVA(unsigned long long nOffset); + long long OffsetToRVA(unsigned long long nOffset); + + unsigned int getProgramFileOffset(int nProgram); + unsigned int getProgramFileSize(int nProgram); + + unsigned int getOverlaySize(); + unsigned int getOverlayOffset(); + bool isOverlayPresent(); + + + int getNumberOfSections(); + int getNumberOfPrograms(); + + QString getSectionName(int nSection); + + + bool compareOverlay(QString sSignature,unsigned int nOffset=0); + + long long getEntryPointOffset(); +private: + ELFFile *elffile; +}; + +#endif // SCRIPTELF_H diff --git a/die_source/scriptgeneric.cpp b/die_source/scriptgeneric.cpp new file mode 100644 index 0000000000000..22216945e3380 --- /dev/null +++ b/die_source/scriptgeneric.cpp @@ -0,0 +1,50 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#include "scriptgeneric.h" + +scriptGeneric::scriptGeneric(QObject *parent) : + QObject(parent) +{ +} + +void scriptGeneric::_log(QString sString) +{ + emit appendError(sString); +} + + +unsigned int scriptGeneric::swapBytes(unsigned int nValue) +{ + unsigned int nResult; + + ((char *)(&nResult))[3]=((char *)(&nValue))[0]; + ((char *)(&nResult))[2]=((char *)(&nValue))[1]; + ((char *)(&nResult))[1]=((char *)(&nValue))[2]; + ((char *)(&nResult))[0]=((char *)(&nValue))[3]; + + return nResult; +} + +QString scriptGeneric::upperCase(QString sString) +{ + return sString.toUpper(); +} + diff --git a/die_source/scriptgeneric.h b/die_source/scriptgeneric.h new file mode 100644 index 0000000000000..e525e3701fedc --- /dev/null +++ b/die_source/scriptgeneric.h @@ -0,0 +1,73 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#ifndef SCRIPTGENERIC_H +#define SCRIPTGENERIC_H + +#include +#include +#include + +class scriptGeneric : public QObject +{ + Q_OBJECT +public: + explicit scriptGeneric(QObject *parent = 0); + +signals: + void appendError(QString sString); + + +public slots: + void _log(QString sString); + unsigned int swapBytes(unsigned int nValue); + QString upperCase(QString sString); + + virtual bool compare(QString sSignature,unsigned int nOffset)=0; + // virtual bool compareReg(QString sSignature,unsigned int nOffset)=0; + // virtual bool compareHeader(QString sSignature)=0; + virtual bool compareEP(QString sSignature,unsigned int nOffset)=0; + // virtual bool compareEP(unsigned int nOffset,QString sSignature)=0; + + virtual QString getString(unsigned int nOffset,unsigned int nSize=50)=0; + virtual unsigned int readDword(unsigned int nOffset)=0; + virtual unsigned short readWord(unsigned int nOffset)=0; + virtual unsigned char readByte(unsigned int nOffset)=0; + virtual unsigned int getSize()=0; + virtual QString getFileDirectory()=0; + virtual QString getFileBaseName()=0; // new + virtual QString getFileSuffix()=0; // new + virtual QString getFileCompleteSuffix()=0; // new + virtual int findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue)=0; + virtual int findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue)=0; + virtual int findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue)=0; + virtual int findString(unsigned int nOffset, unsigned int nSize, QString sValue)=0; + virtual int findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature)=0; + virtual bool isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature)=0; + virtual float calculateEntropy(unsigned int nOffset, unsigned int nSize)=0; + virtual QString getSignature(unsigned int nOffset,unsigned int nSize)=0; + + virtual QString calculateMD5(unsigned int nOffset, unsigned int nSize)=0; + +public slots: + +}; + +#endif // SCRIPTGENERIC_H diff --git a/die_source/scriptmach.cpp b/die_source/scriptmach.cpp new file mode 100644 index 0000000000000..14ed603741190 --- /dev/null +++ b/die_source/scriptmach.cpp @@ -0,0 +1,293 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#include "scriptmach.h" + +scriptMACH::scriptMACH(QObject *parent) : + scriptGeneric(parent) +{ +} + +void scriptMACH::setData(MACHFile *machfile) +{ + this->machfile=machfile; + + // emit appendError("Test2"); +} + + +//bool scriptMACH::compareHeader(QString sSignature) +//{ +// return machfile->compareHeader(sSignature); +//} + +bool scriptMACH::compare(QString sSignature,unsigned int nOffset) +{ + return machfile->_compare(sSignature,nOffset); +} +bool scriptMACH::compareEP(QString sSignature,unsigned int nOffset) +{ + // return machfile->compareEPfast(sSignature); + + return machfile->compareEP(sSignature,nOffset); +} + +//bool scriptMACH::compareEPn(QString sSignature,unsigned int nOffset) +//{ +// return machfile->compareEPn(sSignature,nOffset); +//} + +QString scriptMACH::getFileDirectory() +{ + return machfile->getFileDirectory(); +} + +QString scriptMACH::getFileBaseName() +{ + return machfile->getFileBaseName(); +} + +QString scriptMACH::getFileSuffix() +{ + return machfile->getFileSuffix(); +} + +QString scriptMACH::getFileCompleteSuffix() +{ + return machfile->getFileCompleteSuffix(); +} +QString scriptMACH::getString(unsigned int nOffset, unsigned int nSize) +{ + return machfile->getString(nOffset,nSize); +} + +unsigned int scriptMACH::readDword(unsigned int nOffset) +{ + return machfile->readDword(nOffset); +} + +unsigned short scriptMACH::readWord(unsigned int nOffset) +{ + return machfile->readWord(nOffset); +} + +unsigned char scriptMACH::readByte(unsigned int nOffset) +{ + return machfile->readByte(nOffset); +} + +unsigned int scriptMACH::getSize() +{ + return machfile->size(); +} +int scriptMACH::findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue) +{ + return machfile->findByte(nOffset,nSize,cValue); +} + +int scriptMACH::findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue) +{ + return machfile->findWord(nOffset,nSize,sValue); +} + +int scriptMACH::findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue) +{ + return machfile->findDword(nOffset,nSize,nValue); +} + +int scriptMACH::findString(unsigned int nOffset, unsigned int nSize, QString sValue) +{ + return machfile->findString(nOffset,nSize,sValue); +} + +int scriptMACH::findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return machfile->findSignature(nOffset,nSize,sSignature); +} + +bool scriptMACH::isSectionNamePresent(QString sSectionName) +{ + return machfile->isSectionNamePresent(sSectionName); +} + +bool scriptMACH::isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return machfile->isSignaturePresent(nOffset,nSize,sSignature); +} + +bool scriptMACH::compareReg(QString sSignature,unsigned int nOffset) +{ + return compare(sSignature,nOffset); +} + +bool scriptMACH::isLibraryPresent(QString sLibrary) +{ + return machfile->isLibraryPresent(sLibrary); +} + +unsigned int scriptMACH::getLibraryCurrentVersion(QString sLibrary) +{ + return machfile->getLibraryCurrentVersion(sLibrary); +} + +int scriptMACH::getSectionNumber(QString sSectionName) +{ + return machfile->getSectionNumber(sSectionName); +} + +QString scriptMACH::getGeneralOptions() +{ + QString sResult; + + unsigned int nFileType=machfile->getHeader_filetype(); + + if(nFileType==MH_OBJECT) + { + sResult+="OBJ"; + } + else if(nFileType==MH_EXECUTE) + { + sResult+="EXE"; + } + else if(nFileType==MH_CORE) + { + sResult+="CORE"; + } + else if(nFileType==MH_DYLIB) + { + sResult+="DYLIB"; + } + else if(nFileType==MH_BUNDLE) + { + sResult+="BUNDLE"; + } + + + + if(machfile->isMACH64()) + { + sResult+="64"; + } + else + { + sResult+="32"; + } + + return sResult; +} + +int scriptMACH::getNumberOfSections() +{ + return machfile->getNumberOfSections(); +} + +int scriptMACH::getNumberOfSegments() +{ + return machfile->getNumberOfSegments(); +} + +float scriptMACH::calculateEntropy(unsigned int nOffset, unsigned int nSize) +{ + return machfile->calculateEntropy(nOffset,nSize); +} + +QString scriptMACH::getSignature(unsigned int nOffset, unsigned int nSize) +{ + return machfile->getSignature(nOffset,nSize); +} + +QString scriptMACH::calculateMD5(unsigned int nOffset, unsigned int nSize) +{ + return machfile->calculateMD5(nOffset,nSize); +} + +unsigned int scriptMACH::getSectionFileOffset(int nSection) +{ + return machfile->getSectionFileOffset(nSection); +} + +unsigned int scriptMACH::getSectionFileSize(int nSection) +{ + return machfile->getSectionFileSize(nSection); +} + +QString scriptMACH::getSectionName(int nSection) +{ + return machfile->getSectionName(nSection); +} + +QString scriptMACH::getSegmentName(int nSegment) +{ + return machfile->getSegmentName(nSegment); +} + +unsigned int scriptMACH::getSegmentFileSize(int nSegment) +{ + return machfile->getSegmentFileSize(nSegment); +} + +unsigned int scriptMACH::getSegmentFileOffset(int nSegment) +{ + return machfile->getSegmentFileOffset(nSegment); +} +long long scriptMACH::RVAToOffset(unsigned long long nRVA) +{ + return machfile->RVAToOffset(nRVA); +} + +long long scriptMACH::VAToOffset(unsigned long long nVA) +{ + return machfile->VAToOffset(nVA); +} + +long long scriptMACH::OffsetToVA(unsigned long long nOffset) +{ + return machfile->OffsetToVA(nOffset); +} + +long long scriptMACH::OffsetToRVA(unsigned long long nOffset) +{ + return machfile->OffsetToRVA(nOffset); +} + +unsigned int scriptMACH::getOverlaySize() +{ + return machfile->getOverlaySize(); +} + +unsigned int scriptMACH::getOverlayOffset() +{ + return machfile->getOverlayOffset(); +} + +bool scriptMACH::isOverlayPresent() +{ + return machfile->isOverlayPresent(); +} + +bool scriptMACH::compareOverlay(QString sSignature, unsigned int nOffset) +{ + return machfile->compareOverlay(sSignature,nOffset); +} + +long long scriptMACH::getEntryPointOffset() +{ + return machfile->getEntryPointOffset(); +} diff --git a/die_source/scriptmach.h b/die_source/scriptmach.h new file mode 100644 index 0000000000000..2e175345020e6 --- /dev/null +++ b/die_source/scriptmach.h @@ -0,0 +1,94 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#ifndef SCRIPTMACH_H +#define SCRIPTMACH_H + +#include "scriptgeneric.h" +#include "../machfile.h" + +class scriptMACH : public scriptGeneric +{ + Q_OBJECT +public: + explicit scriptMACH(QObject *parent = 0); + void setData(MACHFile *machfile); + +public slots: + + bool compareEP(QString sSignature,unsigned int nOffset=0); + // bool compareEPn(QString sSignature,unsigned int nOffset); + + QString getString(unsigned int nOffset,unsigned int nSize=50); + unsigned int readDword(unsigned int nOffset); + unsigned short readWord(unsigned int nOffset); + unsigned char readByte(unsigned int nOffset); + unsigned int getSize(); + // bool compareHeader(QString sSignature); + bool compare(QString sSignature,unsigned int nOffset=0); + QString getFileDirectory(); + QString getFileBaseName(); + QString getFileSuffix(); + QString getFileCompleteSuffix(); + int findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue); + int findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue); + int findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue); + int findString(unsigned int nOffset, unsigned int nSize, QString sValue); + int findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature); + bool isSectionNamePresent(QString sSectionName); + bool isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature); + bool compareReg(QString sSignature,unsigned int nOffset); + bool isLibraryPresent(QString sLibrary); + unsigned int getLibraryCurrentVersion(QString sLibrary); + int getSectionNumber(QString sSectionName); + + QString getGeneralOptions(); + int getNumberOfSections(); + int getNumberOfSegments(); + + float calculateEntropy(unsigned int nOffset, unsigned int nSize); + QString getSignature(unsigned int nOffset,unsigned int nSize); + QString calculateMD5(unsigned int nOffset, unsigned int nSize); + + unsigned int getSectionFileOffset(int nSection); + unsigned int getSectionFileSize(int nSection); + + QString getSectionName(int nSection); + + QString getSegmentName(int nSegment); + unsigned int getSegmentFileSize(int nSegment); + unsigned int getSegmentFileOffset(int nSegment); + + long long RVAToOffset(unsigned long long nRVA); + long long VAToOffset(unsigned long long nVA); + long long OffsetToVA(unsigned long long nOffset); + long long OffsetToRVA(unsigned long long nOffset); + + unsigned int getOverlaySize(); + unsigned int getOverlayOffset(); + bool isOverlayPresent(); + + bool compareOverlay(QString sSignature,unsigned int nOffset=0); + long long getEntryPointOffset(); +private: + MACHFile *machfile; +}; + +#endif // SCRIPTMACH_H diff --git a/die_source/scriptmsdos.cpp b/die_source/scriptmsdos.cpp new file mode 100644 index 0000000000000..7c2257bfac1aa --- /dev/null +++ b/die_source/scriptmsdos.cpp @@ -0,0 +1,162 @@ +#include "scriptmsdos.h" + +scriptMSDOS::scriptMSDOS(QObject *parent) : + scriptGeneric(parent) +{ +} + +void scriptMSDOS::setData(MSDOSFile *msdosfile) +{ + this->msdosfile=msdosfile; + + // emit appendError("Test2"); +} + +//bool scriptMSDOS::compareHeader(QString sSignature) +//{ +// return msdosfile->compareHeader(sSignature); +//} + +bool scriptMSDOS::compare(QString sSignature,unsigned int nOffset) +{ + return msdosfile->compare(sSignature,nOffset); +} +bool scriptMSDOS::compareEP(QString sSignature,unsigned int nOffset) +{ + return msdosfile->compareEP(sSignature,nOffset); +} + +//bool scriptMSDOS::compareEPn(QString sSignature,unsigned int nOffset) +//{ +// return msdosfile->compareEPn(sSignature,nOffset); +//} + +QString scriptMSDOS::getFileDirectory() +{ + return msdosfile->getFileDirectory(); +} + +QString scriptMSDOS::getFileBaseName() +{ + return msdosfile->getFileBaseName(); +} + +QString scriptMSDOS::getFileSuffix() +{ + return msdosfile->getFileSuffix(); +} + +QString scriptMSDOS::getFileCompleteSuffix() +{ + return msdosfile->getFileCompleteSuffix(); +} +QString scriptMSDOS::getString(unsigned int nOffset, unsigned int nSize) +{ + return msdosfile->getString(nOffset,nSize); +} + +unsigned int scriptMSDOS::readDword(unsigned int nOffset) +{ + return msdosfile->readDword(nOffset); +} + +unsigned short scriptMSDOS::readWord(unsigned int nOffset) +{ + return msdosfile->readWord(nOffset); +} + +unsigned char scriptMSDOS::readByte(unsigned int nOffset) +{ + return msdosfile->readByte(nOffset); +} + +unsigned int scriptMSDOS::getSize() +{ + return msdosfile->size(); +} +int scriptMSDOS::findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue) +{ + return msdosfile->findByte(nOffset,nSize,cValue); +} + +int scriptMSDOS::findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue) +{ + return msdosfile->findWord(nOffset,nSize,sValue); +} + +int scriptMSDOS::findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue) +{ + return msdosfile->findDword(nOffset,nSize,nValue); +} + +int scriptMSDOS::findString(unsigned int nOffset, unsigned int nSize, QString sValue) +{ + return msdosfile->findString(nOffset,nSize,sValue); +} + +int scriptMSDOS::findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return msdosfile->findSignature(nOffset,nSize,sSignature); +} + +bool scriptMSDOS::isNE() +{ + return msdosfile->isNE(); +} + +bool scriptMSDOS::isLE() +{ + return msdosfile->isLE(); +} + +bool scriptMSDOS::isLX() +{ + return msdosfile->isLX(); +} + +bool scriptMSDOS::isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return msdosfile->isSignaturePresent(nOffset,nSize,sSignature); +} + +float scriptMSDOS::calculateEntropy(unsigned int nOffset, unsigned int nSize) +{ + return msdosfile->calculateEntropy(nOffset,nSize); +} + +QString scriptMSDOS::getSignature(unsigned int nOffset, unsigned int nSize) +{ + return msdosfile->getSignature(nOffset,nSize); +} + +QString scriptMSDOS::calculateMD5(unsigned int nOffset, unsigned int nSize) +{ + return msdosfile->calculateMD5(nOffset,nSize); +} + + + +unsigned int scriptMSDOS::getOverlayOffset() +{ + return msdosfile->getOverlayOffset(); +} + +unsigned int scriptMSDOS::getOverlaySize() +{ + return msdosfile->getOverlaySize(); +} + +bool scriptMSDOS::isOverlayPresent() +{ + return msdosfile->isOverlayPresent(); +} + +bool scriptMSDOS::compareOverlay(QString sSignature, unsigned int nOffset) +{ + return msdosfile->compareOverlay(sSignature,nOffset); +} + +int scriptMSDOS::getEntryPointOffset() +{ + return msdosfile->getEntryPointOffset(); +} diff --git a/die_source/scriptmsdos.h b/die_source/scriptmsdos.h new file mode 100644 index 0000000000000..e80358ed1f24f --- /dev/null +++ b/die_source/scriptmsdos.h @@ -0,0 +1,76 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#ifndef SCRIPTMSDOS_H +#define SCRIPTMSDOS_H + +#include "scriptgeneric.h" +#include "../msdosfile.h" + +class scriptMSDOS : public scriptGeneric +{ + Q_OBJECT +public: + explicit scriptMSDOS(QObject *parent = 0); + void setData(MSDOSFile *msdosfile); + + +public slots: + + bool compareEP(QString sSignature,unsigned int nOffset=0); + // bool compareEPn(QString sSignature,unsigned int nOffset); + + QString getString(unsigned int nOffset,unsigned int nSize=50); + unsigned int readDword(unsigned int nOffset); + unsigned short readWord(unsigned int nOffset); + unsigned char readByte(unsigned int nOffset); + unsigned int getSize(); + // bool compareHeader(QString sSignature); + bool compare(QString sSignature,unsigned int nOffset=0); + QString getFileDirectory(); + QString getFileBaseName(); + QString getFileSuffix(); + QString getFileCompleteSuffix(); + int findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue); + int findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue); + int findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue); + int findString(unsigned int nOffset, unsigned int nSize, QString sValue); + int findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature); + + bool isNE(); + bool isLE(); + bool isLX(); + + bool isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature); + + float calculateEntropy(unsigned int nOffset, unsigned int nSize); + QString getSignature(unsigned int nOffset,unsigned int nSize); + QString calculateMD5(unsigned int nOffset, unsigned int nSize); + unsigned int getOverlayOffset(); + unsigned int getOverlaySize(); + bool isOverlayPresent(); + bool compareOverlay(QString sSignature,unsigned int nOffset=0); + + int getEntryPointOffset(); +private: + MSDOSFile *msdosfile; +}; + +#endif // SCRIPTMSDOS_H diff --git a/die_source/scriptpe.cpp b/die_source/scriptpe.cpp new file mode 100644 index 0000000000000..01d49e40ad3dc --- /dev/null +++ b/die_source/scriptpe.cpp @@ -0,0 +1,714 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#include "scriptpe.h" + +scriptPE::scriptPE(QObject *parent) : + scriptGeneric(parent) +{ +} + +void scriptPE::setData(PEFile *pefile) +{ + this->pefile=pefile; +} + +bool scriptPE::isRichSignaturePresent() +{ + return pefile->isRichSignaturePresent(); +} +QString scriptPE::getCompilerVersion() +{ + QString sResult; + int nMajor=pefile->getOptionalHeader_MajorLinkerVersion(); + int nMinor=pefile->getOptionalHeader_MinorLinkerVersion(); + + sResult=QString("%1.%2").arg(nMajor).arg(nMinor); + + return sResult; +} +QString scriptPE::getGeneralOptions() +{ + QString sResult; + + bool bIs64=pefile->isPEPlus(); + bool bIsDll=pefile->isDll(); + bool bIsDriver=pefile->isDriver(); + + QString sType; + QString sBits; + + if(bIs64) + { + sBits="64"; + } + else + { + sBits="32"; + } + + if(bIsDll) + { + sType="DLL"; + } + else if(bIsDriver) + { + sType="Driver"; + } + else + { + sType="EXE"; + } + + sResult=QString("%1%2").arg(sType).arg(sBits); + + return sResult; +} +//bool scriptPE::compareHeader(QString sSignature) +//{ +// return pefile->compareHeader(sSignature); +//} + +bool scriptPE::compare(QString sSignature,unsigned int nOffset) +{ + return pefile->compare(sSignature,nOffset); +} + +//bool scriptPE::compareReg(QString sSignature,unsigned int nOffset) +//{ +//// sSignature=sSignature.toUpper().remove(QChar(' ')); +// sSignature=pefile->convertSignature(sSignature); + +// if((sSignature.contains("$"))||(sSignature.contains("#"))) +// { +//// qDebug(sSignature.toAscii().data()); +//// unsigned int nEP=pefile->getEntryPointOffset(); +//// unsigned int nOffset=nEP; +// unsigned int nDword=0; +// unsigned short sWord=0; +// unsigned char cByte=0; +// unsigned int nRVA=0; +// QString sSeq; +// while(true) +// { +// if(sSignature.left(8)=="$$$$$$$$") +// { +// nDword=pefile->readDword(nOffset); +// if(nDword==-1) return false; + +// nRVA=pefile->OffsetToRVA(nOffset); +// if(nRVA==-1) return false; + +// nRVA+=(int)nDword+4; + +// nOffset=pefile->RVAToOffset(nRVA); +// if(nRVA==-1) return false; + +// sSignature=sSignature.mid(8); +// } +// else if(sSignature.left(4)=="$$$$") +// { +// sWord=pefile->readWord(nOffset); +// if(sWord==-1) return false; + +// nRVA=pefile->OffsetToRVA(nOffset); +// if(nRVA==-1) return false; + +// nRVA+=(int)sWord+2; + +// nOffset=pefile->RVAToOffset(nRVA); +// if(nRVA==-1) return false; + +// sSignature=sSignature.mid(4); +// } +// else if(sSignature.left(2)=="$$") +// { +// cByte=pefile->readByte(nOffset); +// if(cByte==-1) return false; + +// nRVA=pefile->OffsetToRVA(nOffset); +// if(nRVA==-1) return false; + +// nRVA+=(int)cByte+1; + +// nOffset=pefile->RVAToOffset(nRVA); +// if(nRVA==-1) return false; + +// sSignature=sSignature.mid(2); +// } +// else if(sSignature.left(8)=="########") +// { +// nDword=pefile->readDword(nOffset); +// if(nDword==-1) return false; + +// nOffset=pefile->VAToOffset(nDword); +// if(nRVA==-1) return false; + +// sSignature=sSignature.mid(8); +// } + +// if(sSignature=="") +// { +// return true; +// } + + +// sSeq=sSignature.section("$",0,0); + +// if(sSeq.contains("#")) +// { +// sSeq=sSignature.section("#",0,0); +// } + +//// if(nOffset==nEP) +//// { +//// if(!pefile->compareEPfast(sSeq.toAscii().data())) +//// { +//// return false; +//// } +//// } +//// else +//// { +//// if(!pefile->compare(nOffset,sSeq)) +//// { +//// return false; +//// } +//// } +// if(!pefile->_compare(sSeq,nOffset)) +// { +// return false; +// } + + +// nOffset+=sSeq.size()/2; +// sSignature=sSignature.mid(sSeq.size()); +// } +// } +// else +// { +// return pefile->_compare(sSignature,nOffset); +// } +//} +bool scriptPE::compareEP(QString sSignature,unsigned int nOffset) +{ + return pefile->compareEP(sSignature,nOffset); + // sSignature=pefile->convertSignature(sSignature); + + // if((sSignature.contains("$"))||(sSignature.contains("#"))) + // { + // unsigned int nEP=pefile->getEntryPointOffset(); + // return compareReg(sSignature,nEP+nOffset); + // } + // else + // { + // if(nOffset) + // { + // return compareReg(sSignature,pefile->getEntryPointOffset()+nOffset); + // } + // else + // { + // return pefile->compareEPfast(sSignature); + // } + + // } +} + +//bool scriptPE::compareEPn(QString sSignature,unsigned int nOffset) +//{ +// return pefile->compareEPn(sSignature,nOffset); +//} + +bool scriptPE::compareOverlay(QString sSignature,unsigned int nOffset) +{ + return pefile->compareOverlay(sSignature,nOffset); +} +bool scriptPE::isSectionNamePresent(QString sSectionName) +{ + return pefile->isSectionNamePresent(sSectionName); +} +bool scriptPE::isSectionNamePresentExp(QString sSectionName) +{ + return pefile->isSectionNamePresentExp(sSectionName); +} + +bool scriptPE::isLibraryPresent(QString sLibraryName) +{ + return pefile->isLibraryPresent(sLibraryName); +} + +bool scriptPE::isLibraryFunctionPresent(QString sLibraryName, QString sFunctionName) +{ + return pefile->isLibraryFunctionPresent(sLibraryName,sFunctionName); +} + +QString scriptPE::getImportLibraryName(unsigned int nImport) +{ + return pefile->getImportLibraryName(nImport); +} + +unsigned int scriptPE::getMajorLinkerVersion() +{ + return pefile->getOptionalHeader_MajorLinkerVersion(); +} + +unsigned int scriptPE::getMinorLinkerVersion() +{ + return pefile->getOptionalHeader_MinorLinkerVersion(); +} + +QString scriptPE::getImportFunctionName(unsigned int nImport, unsigned int nFunctionNumber) +{ + //#ifndef QT_NO_DEBUG + // QTime scanTime=QTime::currentTime(); + //#endif + + QString sResult=pefile->getImportFunctionName(nImport,nFunctionNumber); + + //#ifndef QT_NO_DEBUG + // qDebug("getImportFunctionName: %d msec",scanTime.msecsTo(QTime::currentTime())); + //#endif + + return sResult; +} +unsigned int scriptPE::getNumberOfImportThunks(unsigned int nImport) +{ + //#ifndef QT_NO_DEBUG + // QTime scanTime=QTime::currentTime(); + //#endif + + //#ifndef QT_NO_DEBUG + // qDebug("getNumberOfImportThunks: %d msec",scanTime.msecsTo(QTime::currentTime())); + //#endif + + unsigned nResult=pefile->getNumberOfImportThunks(nImport); + + return nResult; +} +unsigned int scriptPE::getSizeOfCode() +{ + return pefile->getOptionalHeader_SizeOfCode(); +} + +unsigned int scriptPE::getSizeOfUninitializedData() +{ + return pefile->getOptionalHeader_SizeOfUninitializedData(); +} + +int scriptPE::getNumberOfSections() +{ + return pefile->getFileHeader_NumberOfSections(); +} + +unsigned int scriptPE::getImageBase() +{ + return pefile->getOptionalHeader_ImageBase(); +} + +bool scriptPE::isDll() +{ + return pefile->isDll(); +} + +bool scriptPE::isDriver() +{ + return pefile->isDriver(); +} + +unsigned int scriptPE::getSectionFileSize(int nSectionNumber) +{ + return pefile->getSection_SizeOfRawData(nSectionNumber); +} + +unsigned int scriptPE::getSectionFileOffset(int nSectionNumber) +{ + return pefile->getSection_PointerToRawData(nSectionNumber); +} + +QString scriptPE::getSectionName(int nSectionNumber) +{ + return pefile->getSectionNameAsString(nSectionNumber); +} + +unsigned int scriptPE::getSectionCharacteristics(int nSectionNumber) +{ + return pefile->getSection_Characteristics(nSectionNumber); +} + +unsigned int scriptPE::getSectionVirtualSize(int nSectionNumber) +{ + return pefile->getSection_VirtualSize(nSectionNumber); +} + +unsigned int scriptPE::getSectionVirtualAddress(int nSectionNumber) +{ + return pefile->getSection_VirtualAddress(nSectionNumber); +} + +QString scriptPE::getString(unsigned int nOffset,unsigned int nSize) +{ + return pefile->getString(nOffset,nSize); +} + +int scriptPE::getNumberOfImports() +{ + return pefile->getNumberOfImports(); +} + +int scriptPE::getResourceNameOffset(QString sName) +{ + return pefile->getResourceNameOffsetFast(sName); +} + +unsigned int scriptPE::getResourceNameSize(QString sName) +{ + return pefile->getResourceNameSizeFast(sName); +} + +bool scriptPE::isConsole() +{ + return pefile->getOptionalHeader_Subsystem()==IMAGE_SUBSYSTEM_WINDOWS_CUI; +} + +int scriptPE::findSignature(unsigned int nOffset,unsigned int nSize,QString sSignature) +{ + return pefile->findSignature(nOffset,nSize,sSignature); +} + +bool scriptPE::isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return pefile->isSignaturePresent(nOffset,nSize,sSignature); +} + +bool scriptPE::isSignatureInSectionPresent(unsigned int nSection, QString sSignature) +{ + if(pefile->getFileHeader_NumberOfSections()>=1) + { + unsigned int nOffset=pefile->getSection_PointerToRawData(nSection); + unsigned int nSize=pefile->getSection_SizeOfRawData(nSection); + + return isSignaturePresent(nOffset,nSize,sSignature); + } + + return false; +} + +unsigned short scriptPE::getMachineType() +{ + return pefile->getFileHeader_Machine(); +} + +unsigned int scriptPE::getAddressOfEntryPoint() +{ + return pefile->getOptionalHeader_AddressOfEntryPoint(); +} + +int scriptPE::getEntryPointSection() +{ + return pefile->getEntryPointSection(); +} + +int scriptPE::getImportSection() +{ + return pefile->getImportSection(); +} + +int scriptPE::getRelocsSection() +{ + return pefile->getRelocsSection(); +} + +int scriptPE::getResourceSection() +{ + return pefile->getResourceSection(); +} + +int scriptPE::getExportSection() +{ + return pefile->getExportSection(); +} + +int scriptPE::getTLSSection() +{ + return pefile->getTLSSection(); +} + +int scriptPE::getSectionNumber(QString sSectionName) +{ + return pefile->getSectionNumber(sSectionName); +} +int scriptPE::getSectionNumberExp(QString sSectionName) +{ + return pefile->getSectionNumberExp(sSectionName); +} +QString scriptPE::getSectionNameCollision(QString sString1,QString sString2) +{ + return pefile->getSectionNameCollision(sString1,sString2); +} + +bool scriptPE::isOverlayPresent() +{ + return pefile->isOverlayPresent(); +} + +unsigned int scriptPE::calculateSizeOfHeaders() +{ + return pefile->calculateSizeOfHeaders(); +} + +QString scriptPE::getFileVersion() +{ + return pefile->getFileVersion(); +} + +QString scriptPE::getVersionStringInfo(QString sKey) +{ + return pefile->getVersionStringInfo(sKey); +} + +QString scriptPE::getManifest() +{ + return pefile->getManifest(); +} + +float scriptPE::calculateEntropy(unsigned int nOffset, unsigned int nSize) +{ + return pefile->calculateEntropy(nOffset,nSize); +} + +QString scriptPE::getSignature(unsigned int nOffset, unsigned int nSize) +{ + return pefile->getSignature(nOffset,nSize); +} + +QString scriptPE::calculateMD5(unsigned int nOffset, unsigned int nSize) +{ + return pefile->calculateMD5(nOffset,nSize); +} + +bool scriptPE::compareHeader(QString sSignature) +{ + return pefile->compare(sSignature,0); +} + +bool scriptPE::isDosStubPresent() +{ + return pefile->isDosStubPresent(); +} + +unsigned int scriptPE::getDosStubOffset() +{ + return pefile->getDosStubOffset(); +} + +unsigned int scriptPE::getDosStubSize() +{ + return pefile->getDosStubSize(); +} + +unsigned int scriptPE::getNumberOfResources() +{ + return pefile->getNumberOfResources(); +} + +int scriptPE::getResourceOffsetByNumber(unsigned int nNumber) +{ + return pefile->getResourceOffsetByNumber(nNumber); +} + +unsigned int scriptPE::getResourceSizeByNumber(unsigned int nNumber) +{ + return pefile->getResourceSizeByNumber(nNumber); +} + +unsigned int scriptPE::getResourceIdByNumber(unsigned int nNumber) +{ + return pefile->getResourceIdByNumber(nNumber); +} + +QString scriptPE::getResourceNameByNumber(unsigned int nNumber) +{ + return pefile->getResourceNameByNumber(nNumber); +} + +QString scriptPE::getResourceTypeByNumber(unsigned int nNumber) +{ + return pefile->getResourceTypeByNumber(nNumber); +} + +unsigned int scriptPE::getNumberOfRichIDs() +{ + return pefile->getNumberOfRichIDs(); +} + +bool scriptPE::isRichVersionPresent(unsigned int nVersion) +{ + return pefile->isRichVersionPresent(nVersion); +} + +bool scriptPE::isSignedFile() +{ + return pefile->isSignedFile(); +} + +QString scriptPE::getPEFileVersion(QString sFileName) +{ + QString sResult; + PEFile __pe; + + if(__pe.setFileName(sFileName)) + { + if(__pe.isValid()) + { + sResult=__pe.getFileVersion(); + } + } + + return sResult; +} + +QString scriptPE::getFileDirectory() +{ + return pefile->getFileDirectory(); +} + +QString scriptPE::getFileBaseName() +{ + return pefile->getFileBaseName(); +} + +QString scriptPE::getFileSuffix() +{ + return pefile->getFileSuffix(); +} + +QString scriptPE::getFileCompleteSuffix() +{ + return pefile->getFileCompleteSuffix(); +} + +bool scriptPE::isNET() +{ + return pefile->isNETPresent(); +} + +QString scriptPE::getNETVersion() +{ + return pefile->getCLI_MetaData_Version(); +} + +bool scriptPE::compareEP_NET(QString sSignature,unsigned int nOffset) +{ + return pefile->compareEP_NET(sSignature,nOffset); +} + +bool scriptPE::isNETStringPresent(QString sString) +{ + return pefile->isCLI_MetaData_StringPresent(sString); +} + +bool scriptPE::isNETUnicodeStringPresent(QString sString) +{ + return pefile->isCLI_MetaData_UnicodeStringPresent(sString); +} + +unsigned int scriptPE::getSize() +{ + return pefile->size(); +} + +unsigned int scriptPE::getOverlayOffset() +{ + return pefile->getOverlayOffset(); +} + +unsigned int scriptPE::getOverlaySize() +{ + return pefile->getOverlaySize(); +} + +bool scriptPE::isResourceNamePresent(QString sName) +{ + return pefile->isResourceNamePresentFast(sName); +} + +unsigned int scriptPE::readDword(unsigned int nOffset) +{ + return pefile->readDword(nOffset); +} + +unsigned short scriptPE::readWord(unsigned int nOffset) +{ + return pefile->readWord(nOffset); +} + +unsigned char scriptPE::readByte(unsigned int nOffset) +{ + return pefile->readByte(nOffset); +} + +long long scriptPE::RVAToOffset(unsigned long long nRVA) +{ + return pefile->RVAToOffset(nRVA); +} + +long long scriptPE::VAToOffset(unsigned long long nVA) +{ + return pefile->VAToOffset(nVA); +} + +long long scriptPE::OffsetToVA(unsigned long long nOffset) +{ + return pefile->OffsetToVA(nOffset); +} + +long long scriptPE::OffsetToRVA(unsigned long long nOffset) +{ + return pefile->OffsetToRVA(nOffset); +} + +long long scriptPE::getEntryPointOffset() +{ + return pefile->getEntryPointOffset(); +} + +int scriptPE::findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue) +{ + return pefile->findByte(nOffset,nSize,cValue); +} + +int scriptPE::findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue) +{ + return pefile->findWord(nOffset,nSize,sValue); +} + +int scriptPE::findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue) +{ + return pefile->findDword(nOffset,nSize,nValue); +} + +int scriptPE::findString(unsigned int nOffset, unsigned int nSize, QString sValue) +{ + return pefile->findString(nOffset,nSize,sValue); +} + +bool scriptPE::isPEPlus() +{ + return pefile->isPEPlus(); +} diff --git a/die_source/scriptpe.h b/die_source/scriptpe.h new file mode 100644 index 0000000000000..014378fbeb5df --- /dev/null +++ b/die_source/scriptpe.h @@ -0,0 +1,160 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#ifndef SCRIPTPE_H +#define SCRIPTPE_H + +#include "scriptgeneric.h" +#include "scriptbinary.h" +#include "../pefile.h" + +class scriptPE : public scriptGeneric +{ + Q_OBJECT +public: + explicit scriptPE(QObject *parent = 0); + void setData(PEFile *pefile); + +public slots: + unsigned short getMachineType(); + + bool isRichSignaturePresent(); + QString getCompilerVersion(); + QString getGeneralOptions(); + + bool compareEP(QString sSignature,unsigned int nOffset=0); + // bool compareEPn(QString sSignature,unsigned int nOffset); + bool compareOverlay(QString sSignature,unsigned int nOffset=0); + bool isSectionNamePresent(QString sSectionName); + bool isSectionNamePresentExp(QString sSectionName); + bool isLibraryPresent(QString sLibraryName); + bool isLibraryFunctionPresent(QString sLibraryName, QString sFunctionName); + QString getImportLibraryName(unsigned int nImport); + QString getImportFunctionName(unsigned int nImport, unsigned int nFunctionNumber); + unsigned int getNumberOfImportThunks(unsigned int nImport); + unsigned int getSizeOfCode(); + unsigned int getSizeOfUninitializedData(); + int getNumberOfSections(); + unsigned int getImageBase(); + bool isDll(); + bool isDriver(); + unsigned int getSectionFileSize(int nSectionNumber); + unsigned int getSectionFileOffset(int nSectionNumber); + QString getSectionName(int nSectionNumber); + unsigned int getSectionCharacteristics(int nSectionNumber); + unsigned int getSectionVirtualSize(int nSectionNumber); + unsigned int getSectionVirtualAddress(int nSectionNumber); + + unsigned int getAddressOfEntryPoint(); + unsigned int getMajorLinkerVersion(); + unsigned int getMinorLinkerVersion(); + + int getEntryPointSection(); + int getImportSection(); + int getRelocsSection(); + int getResourceSection(); + int getExportSection(); + int getTLSSection(); + + int getSectionNumber(QString sSectionName); + int getSectionNumberExp(QString sSectionName); + QString getSectionNameCollision(QString sString1, QString sString2); + bool isOverlayPresent(); + unsigned int calculateSizeOfHeaders(); + QString getFileVersion(); + QString getPEFileVersion(QString sFileName); + bool isPEPlus(); + + bool isNET(); + QString getNETVersion(); + bool compareEP_NET(QString sSignature,unsigned int nOffset=0); + + bool isNETStringPresent(QString sString); + bool isNETUnicodeStringPresent(QString sString); + + unsigned int getOverlayOffset(); + unsigned int getOverlaySize(); + bool isResourceNamePresent(QString sName); + + long long RVAToOffset(unsigned long long nRVA); + long long VAToOffset(unsigned long long nVA); + long long OffsetToVA(unsigned long long nOffset); + long long OffsetToRVA(unsigned long long nOffset); + + long long getEntryPointOffset(); + + // bool compareHeader(QString sSignature); + bool compare(QString sSignature,unsigned int nOffset=0); + // bool compareReg(QString sSignature,unsigned int nOffset); + QString getFileDirectory(); + QString getFileBaseName(); + QString getFileSuffix(); + QString getFileCompleteSuffix(); + unsigned int getSize(); + unsigned int readDword(unsigned int nOffset); + unsigned short readWord(unsigned int nOffset); + unsigned char readByte(unsigned int nOffset); + int findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue); + int findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue); + int findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue); + int findString(unsigned int nOffset, unsigned int nSize, QString sValue); + int findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature); + QString getString(unsigned int nOffset,unsigned int nSize=50); + + int getNumberOfImports(); + + int getResourceNameOffset(QString sName); + unsigned int getResourceNameSize(QString sName); + bool isConsole(); + + bool isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature); + bool isSignatureInSectionPresent(unsigned int nSection,QString sSignature); + + QString getVersionStringInfo(QString sKey); + QString getManifest(); + + float calculateEntropy(unsigned int nOffset, unsigned int nSize); + QString getSignature(unsigned int nOffset,unsigned int nSize); + QString calculateMD5(unsigned int nOffset, unsigned int nSize); + + bool compareHeader(QString sSignature); + + bool isDosStubPresent(); + unsigned int getDosStubOffset(); + unsigned int getDosStubSize(); + + unsigned int getNumberOfResources(); + int getResourceOffsetByNumber(unsigned int nNumber); + unsigned int getResourceSizeByNumber(unsigned int nNumber); + unsigned int getResourceIdByNumber(unsigned int nNumber); + QString getResourceNameByNumber(unsigned int nNumber); + QString getResourceTypeByNumber(unsigned int nNumber); + + unsigned int getNumberOfRichIDs(); + bool isRichVersionPresent(unsigned int nID); + bool isSignedFile(); +private: + PEFile *pefile; + // int nEPOffset; + // int nFileSize; + +}; + +#endif // SCRIPTPE_H diff --git a/die_source/scripttext.cpp b/die_source/scripttext.cpp new file mode 100644 index 0000000000000..ec3c8b30f5424 --- /dev/null +++ b/die_source/scripttext.cpp @@ -0,0 +1,149 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#include "scripttext.h" + +scriptText::scriptText(QObject *parent) : + scriptGeneric(parent) +{ +} + +void scriptText::setData(Binary *binary) +{ + this->binary=binary; +} +bool scriptText::isPlainText() +{ + return binary->isPlainText(); +} + +bool scriptText::compare(QString sSignature,unsigned int nOffset) +{ + return binary->_compare(sSignature,nOffset); +} + +//bool scriptText::compareHeader(QString sSignature) +//{ +// return binary->compareHeader(sSignature); +//} + +bool scriptText::compareEP(QString sSignature,unsigned int nOffset) +{ + return binary->compareEP(sSignature,nOffset); +} + +//bool scriptText::compareEPn(QString sSignature,unsigned int nOffset) +//{ +// return binary->compare(sSignature,nOffset); +//} +//void scriptText::_log(QString sString) +//{ +// emit appendError(sString); +//} + +QString scriptText::getString(unsigned int nOffset, unsigned int nSize) +{ + return binary->getString(nOffset,nSize); +} + +unsigned int scriptText::readDword(unsigned int nOffset) +{ + return binary->readDword(nOffset); +} + +unsigned short scriptText::readWord(unsigned int nOffset) +{ + return binary->readWord(nOffset); +} + +unsigned char scriptText::readByte(unsigned int nOffset) +{ + return binary->readByte(nOffset); +} + +unsigned int scriptText::getSize() +{ + return binary->size(); +} + +QString scriptText::getFileDirectory() +{ + return binary->getFileDirectory(); +} + +QString scriptText::getFileBaseName() +{ + return binary->getFileBaseName(); +} + +QString scriptText::getFileSuffix() +{ + return binary->getFileSuffix(); +} + +QString scriptText::getFileCompleteSuffix() +{ + return binary->getFileCompleteSuffix(); +} + +int scriptText::findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue) +{ + return binary->findByte(nOffset,nSize,cValue); +} + +int scriptText::findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue) +{ + return binary->findWord(nOffset,nSize,sValue); +} + +int scriptText::findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue) +{ + return binary->findDword(nOffset,nSize,nValue); +} + +int scriptText::findString(unsigned int nOffset, unsigned int nSize, QString sValue) +{ + return binary->findString(nOffset,nSize,sValue); +} + +int scriptText::findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return binary->findSignature(nOffset,nSize,sSignature); +} + +bool scriptText::isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature) +{ + return binary->isSignaturePresent(nOffset,nSize,sSignature); +} + +float scriptText::calculateEntropy(unsigned int nOffset, unsigned int nSize) +{ + return binary->calculateEntropy(nOffset,nSize); +} + +QString scriptText::getSignature(unsigned int nOffset, unsigned int nSize) +{ + return binary->getSignature(nOffset,nSize); +} + +QString scriptText::calculateMD5(unsigned int nOffset, unsigned int nSize) +{ + return binary->calculateMD5(nOffset,nSize); +} diff --git a/die_source/scripttext.h b/die_source/scripttext.h new file mode 100644 index 0000000000000..ea1713ffc9b3b --- /dev/null +++ b/die_source/scripttext.h @@ -0,0 +1,72 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#ifndef SCRIPTTEXT_H +#define SCRIPTTEXT_H + +#include "scriptgeneric.h" +#include "../textfile.h" + +class scriptText : public scriptGeneric +{ + Q_OBJECT +public: + explicit scriptText(QObject *parent = 0); + void setData(Binary *binary); + +signals: + // void appendError(QString sString); + +public slots: + // void _log(QString sString); + // unsigned int swapBytes(unsigned int nValue); + // QString upperCase(QString sString); + bool isPlainText(); + + bool compare(QString sSignature,unsigned int nOffset=0); + // bool compareHeader(QString sSignature); + bool compareEP(QString sSignature,unsigned int nOffset=0); + // bool compareEPn(QString sSignature,unsigned int nOffset); + + QString getString(unsigned int nOffset,unsigned int nSize=50); + unsigned int readDword(unsigned int nOffset); + unsigned short readWord(unsigned int nOffset); + unsigned char readByte(unsigned int nOffset); + unsigned int getSize(); + QString getFileDirectory(); + QString getFileBaseName(); + QString getFileSuffix(); + QString getFileCompleteSuffix(); + int findByte(unsigned int nOffset, unsigned int nSize, unsigned char cValue); + int findWord(unsigned int nOffset, unsigned int nSize, unsigned short sValue); + int findDword(unsigned int nOffset, unsigned int nSize, unsigned int nValue); + int findString(unsigned int nOffset, unsigned int nSize, QString sValue); + int findSignature(unsigned int nOffset, unsigned int nSize, QString sSignature); + bool isSignaturePresent(unsigned int nOffset, unsigned int nSize, QString sSignature); + + float calculateEntropy(unsigned int nOffset, unsigned int nSize); + QString getSignature(unsigned int nOffset,unsigned int nSize); + QString calculateMD5(unsigned int nOffset, unsigned int nSize); +private: + Binary *binary; + +}; + +#endif // SCRIPTTEXT_H diff --git a/die_source/singlefilescan.cpp b/die_source/singlefilescan.cpp new file mode 100644 index 0000000000000..404e039cc1fb4 --- /dev/null +++ b/die_source/singlefilescan.cpp @@ -0,0 +1,286 @@ +#include "singlefilescan.h" + +static QCoreApplication* app=0; +static int argc = 0; + +SingleFileScan::SingleFileScan(QObject *parent): + QObject(parent) +{ + // sDataBase="###[unknown]###"; +} + +//void SingleFileScan::setOptions(__DIE_OPTIONS *pOptions) +//{ +// this->pOptions=pOptions; + +// Scan::loadScripts(pOptions); +//} + +void SingleFileScan::flagsToOptions(unsigned int nFlags, __DIE_OPTIONS *pOptions) +{ + pOptions->bShowErrors=nFlags&DIE_SHOWERRORS; + pOptions->bScanShowOptionsDIE=nFlags&DIE_SHOWOPTIONS; + pOptions->bScanShowVersionDIE=nFlags&DIE_SHOWVERSION; + pOptions->bScanSubfolders=false; + pOptions->bShowEntropy=nFlags&DIE_SHOWENTROPY; + pOptions->bSingleLineOutput=nFlags&DIE_SINGLELINEOUTPUT; + pOptions->bShowFileFormatOnce=nFlags&DIE_SHOWFILEFORMATONCE; + pOptions->bFullScan=nFlags&DIE_FULLSCAN; + pOptions->bShowScanTime=false; + pOptions->sm=SM_DIE; + pOptions->pMutexResult=0; +} + +QString SingleFileScan::process(QString sFileName) +{ + sResult.clear(); + + Scan scan; + + QObject::connect(&scan,SIGNAL(die_appendSignatureSignal(QString)),this,SLOT(appendSignature(QString)),Qt::DirectConnection); + + if(options.bShowErrors) + { + QObject::connect(&scan,SIGNAL(appendError(QString)),this,SLOT(appendError(QString)),Qt::DirectConnection); + } + + scan.setData(&options); + scan.setRun(true); + + scan.analize(sFileName,options.bFullScan); + + if(options.bShowEntropy) + { + float fEntropy=Binary::calculateEntropy(sFileName); + appendMessage(QString("Entropy: %1").arg(fEntropy)); + } + + scan.setRun(false); + + return sResult; +} + +QString SingleFileScan::firstBytes(QString sFileName,unsigned int nSize) +{ + QByteArray baResult; + QString sType=Binary::getType(sFileName); + + if((sType=="PE+(64)")||(sType=="PE")) + { + PEFile file; + + if(file.setFileName(sFileName)) + { + file.entryPointLoad(); + baResult=file.readArrayFromEntryPoint(nSize); + } + } + else if((sType=="ELF")||(sType=="ELF64")) + { + ELFFile file; + + if(file.setFileName(sFileName)) + { + file.entryPointLoad(); + baResult=file.readArrayFromEntryPoint(nSize); + } + } + else if((sType=="MACH")||(sType=="MACH64")) + { + MACHFile file; + + if(file.setFileName(sFileName)) + { + file.entryPointLoad(); + baResult=file.readArrayFromEntryPoint(nSize); + } + } + else if(sType=="MSDOS") + { + MSDOSFile file; + + if(file.setFileName(sFileName)) + { + file.entryPointLoad(); + baResult=file.readArrayFromEntryPoint(nSize); + } + } + else + { + Binary file; + + if(file.setFileName(sFileName)) + { + file.entryPointLoad(); + baResult=file.readArrayFromEntryPoint(nSize); + } + } + + return baResult.toHex().data(); +} + +void SingleFileScan::setDataBase(QString sDataBase) +{ + if(sDataBase=="") + { + sDataBase=__DefaultDataBasePath; + } + + if(options.sDataBasePath!=sDataBase) + { + options.sDataBasePath=sDataBase; + Scan::die_loadScripts(&options); +#ifdef QT_DEBUG + qDebug("New database: %s",sDataBase.toLatin1().data()); +#endif + } + else + { +#ifdef QT_DEBUG + qDebug("old database: %s",options.sDataBasePath.toLatin1().data()); +#endif + } +} + +__DIE_OPTIONS SingleFileScan::options={}; + +void SingleFileScan::appendMessage(QString sMessage) +{ + if((sResult!="")&&(options.bSingleLineOutput)) + { + sResult+="; "; + } + + sResult+=sMessage; + + if(options.bSingleLineOutput) + { + + } + else + { + sResult+="\n"; + } +} + +void SingleFileScan::appendSignature(QString sMessage) +{ + QString sType=sMessage.section(": ",0,0); + + if((options.bShowFileFormatOnce)&&(sType==sCurrentType)) + { + sMessage=sMessage.section(": ",1,-1); + } + else + { + sCurrentType=sType; + } + + appendMessage(sMessage); +} + +void SingleFileScan::appendError(QString sMessage) +{ + appendMessage(sMessage); +} + +#ifdef Q_WS_WIN +bool WINAPI _DllMain(_In_ HINSTANCE hinstDLL,_In_ DWORD fdwReason,_In_ LPVOID lpvReserved) +{ + switch(fdwReason) + { + case DLL_PROCESS_ATTACH: + { + break; + } + + case DLL_PROCESS_DETACH: + { + if(app) + { + delete app; + } + + break; + } + } + + return(TRUE); +} +#endif + +int __DIE_scan(QString szFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags,QString sDataBase) +{ + SingleFileScan sfs; + + // __DIE_OPTIONS options; + + // options.sDataBasePath=sDataBase; + sfs.flagsToOptions(nFlags,&sfs.options); + sfs.setDataBase(sDataBase); + // sfs.setOptions(&options); + + QString sResult=sfs.process(szFileName); + + int nSize=sResult.size(); + + if(nSize +#include +#include "_options.h" +#include "scan.h" + +class SingleFileScan : public QObject +{ + Q_OBJECT +public: + SingleFileScan(QObject *parent = 0); + + // void setOptions(__DIE_OPTIONS *pOptions); + static void flagsToOptions(unsigned int nFlags,__DIE_OPTIONS *pOptions); + QString process(QString sFileName); + static QString firstBytes(QString sFileName,unsigned int nSize); + + static void setDataBase(QString sDataBase); + + static __DIE_OPTIONS options; +public slots: + +private slots: + void appendMessage(QString sMessage); + void appendSignature(QString sMessage); + void appendError(QString sMessage); +private: + // __DIE_OPTIONS *pOptions; + QString sResult; + QString sCurrentType; +}; +#ifdef Q_WS_WIN +bool WINAPI _DllMain(_In_ HINSTANCE hinstDLL,_In_ DWORD fdwReason,_In_ LPVOID lpvReserved); +#endif +int __DIE_scan(QString szFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags,QString sDataBase); +int __DIE_scanExA(char *pszFileName, char *pszOutBuffer, int nOutBufferSize, unsigned int nFlags, char *pszDataBase); +int __DIE_scanExW(wchar_t *pwszFileName, char *pszOutBuffer, int nOutBufferSize, unsigned int nFlags, wchar_t *pwszDataBase); +int __DIE_scanA(char *pszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags); +int __DIE_scanW(wchar_t *pwszFileName,char *pszOutBuffer,int nOutBufferSize,unsigned int nFlags); +char *__DIE_versionA(void); +wchar_t *__DIE_versionW(void); + +#endif // SINGLEFILESCAN_H diff --git a/die_source/utils.cpp b/die_source/utils.cpp new file mode 100644 index 0000000000000..7488648c06649 --- /dev/null +++ b/die_source/utils.cpp @@ -0,0 +1,127 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#include "utils.h" + +Utils::Utils() +{ +} + +QString Utils::getApplicationPath() +{ + QString sResult; + sResult=qApp->applicationDirPath(); +#ifndef QT_NO_DEBUG +#ifdef Q_WS_WIN + sResult="C:\\tmp_build\\qt5\\die\\die_source"; +#endif +#ifdef Q_OS_MAC + sResult="/Volumes/DATA/prepare/qt/DIE_source"; +#endif +#ifdef Q_OS_LINUX + sResult="/home/trix/ownCloud/prepare/qt/DIE_source"; +#endif +#endif + + return sResult; +} + +QString Utils::getPath(QString sFileName) +{ + QFileInfo fi; + fi.setFile(sFileName); + // fi.path(); + return fi.path(); +} + +QString Utils::getLastDirecory(__DIE_OPTIONS *pOptions) +{ + if(pOptions->sLastDirectory=="") + { + pOptions->sLastDirectory=getApplicationPath(); + } + + return pOptions->sLastDirectory; +} + +QString Utils::convertPath(QString sPath) +{ + if(sPath.contains("$app")) + { + sPath=sPath.replace("$app",getApplicationPath()).replace("/",QDir::separator()); + } + + return sPath; +} + +QString Utils::getDataBasePath(__DIE_OPTIONS *pOptions) +{ + if(pOptions->sDataBasePath=="") + { + pOptions->sDataBasePath=__DefaultDataBasePath; + } + + return convertPath(pOptions->sDataBasePath); +} + +QString Utils::getEditorPath(__DIE_OPTIONS *pOptions) +{ + return convertPath(pOptions->sEditorPath); +} + +QString Utils::getHelpPath(__DIE_OPTIONS *pOptions) +{ + return convertPath(pOptions->sHelpPath); +} + +QString Utils::getInfoPath(__DIE_OPTIONS *pOptions) +{ + return convertPath(pOptions->sInfoPath); +} + +QString Utils::getPluginsPath(__DIE_OPTIONS *pOptions) +{ + return convertPath(pOptions->sPluginsPath); +} + +QString Utils::getQSSPath(__DIE_OPTIONS *pOptions) +{ + return convertPath(pOptions->sQSSPath); +} + +QString Utils::getLangsPath(__DIE_OPTIONS *pOptions) +{ + return convertPath(pOptions->sLangsPath); +} + +QString Utils::getScriptsPath(__DIE_OPTIONS *pOptions) +{ + return convertPath(pOptions->sScriptsPath); +} + +QString Utils::getSearchPath(__DIE_OPTIONS *pOptions) +{ + return convertPath(pOptions->sSearchPath); +} + +QString Utils::getDefaultFont() +{ + return ""; +} diff --git a/die_source/utils.h b/die_source/utils.h new file mode 100644 index 0000000000000..8297b5fef73bf --- /dev/null +++ b/die_source/utils.h @@ -0,0 +1,52 @@ +// Copyright (c) 2012-2018 hors +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: + +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. + +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +#ifndef UTILS_H +#define UTILS_H + +#include "_options.h" +#include +#include + +class Utils +{ +public: + Utils(); + + static QString getApplicationPath(); + static QString getPath(QString sFileName); + static QString getLastDirecory(__DIE_OPTIONS *pOptions); + + static QString convertPath(QString sPath); + + static QString getDataBasePath(__DIE_OPTIONS *pOptions); + static QString getEditorPath(__DIE_OPTIONS *pOptions); + static QString getHelpPath(__DIE_OPTIONS *pOptions); + static QString getInfoPath(__DIE_OPTIONS *pOptions); + static QString getPluginsPath(__DIE_OPTIONS *pOptions); + static QString getQSSPath(__DIE_OPTIONS *pOptions); + static QString getLangsPath(__DIE_OPTIONS *pOptions); + static QString getScriptsPath(__DIE_OPTIONS *pOptions); + static QString getSearchPath(__DIE_OPTIONS *pOptions); + + static QString getDefaultFont(); +}; + +#endif // UTILS_H