Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

simplify language configuration #896

Merged
merged 1 commit into from
Nov 9, 2023
Merged

simplify language configuration #896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion floss/language/go/extract.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,9 @@ def get_string_blob_strings(pe: pefile.PE, min_length) -> Iterable[StaticString]
try:
string_blob_start, string_blob_end = find_string_blob_range(pe, struct_strings)
except ValueError:
logger.warning("Failed to find string blob range: Go version may be unsupported.")
logger.warning(
"Failed to find string blob range: Is this a Go binary? If so, the Go version may be unsupported."
)
return

with floss.utils.timing("collect string blob strings"):
Expand Down
30 changes: 20 additions & 10 deletions floss/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -546,28 +546,38 @@ def main(argv=None) -> int:

static_runtime = get_runtime_diff(interim)

lang_id = identify_language(sample, static_strings)

# set language configurations
if (lang_id == Language.GO and args.language == "") or args.language == Language.GO.value:
lang_id: Language
if args.language == Language.GO.value:
lang_id = Language.GO
elif args.language == Language.RUST.value:
lang_id = Language.RUST
elif args.language == Language.DOTNET.value:
lang_id = Language.DOTNET
elif args.language == "none":
lang_id = Language.UNKNOWN
else:
lang_id = identify_language(sample, static_strings)
Comment on lines +551 to +560
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if args.language == Language.GO.value:
lang_id = Language.GO
elif args.language == Language.RUST.value:
lang_id = Language.RUST
elif args.language == Language.DOTNET.value:
lang_id = Language.DOTNET
elif args.language == "none":
lang_id = Language.UNKNOWN
else:
lang_id = identify_language(sample, static_strings)
lang_id_mapping = {
Language.GO.value: Language.GO,
Language.RUST.value: Language.RUST,
Language.DOTNET.value: Language.DOTNET,
"none": Language.UNKNOWN,
}
lang_id = lang_id_mapping.get(args.language, identify_language(sample, static_strings))

I suggest adopting this mapping approach for language identification. What do you think?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's neat, please submit a PR as this is already merged now

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay! 😄


if lang_id == Language.GO:
if analysis.enable_tight_strings or analysis.enable_stack_strings or analysis.enable_decoded_strings:
logger.warning(
"FLOSS handles Go static strings, but string deobfuscation may be inaccurate and take a long time"
)
results.metadata.language = Language.GO.value

elif (lang_id == Language.RUST and args.language == "") or args.language == Language.RUST.value:
elif lang_id == Language.RUST:
if analysis.enable_tight_strings or analysis.enable_stack_strings or analysis.enable_decoded_strings:
logger.warning(
"FLOSS handles Rust static strings, but string deobfuscation may be inaccurate and take a long time"
)
results.metadata.language = Language.RUST.value

elif (lang_id == Language.DOTNET and args.language == "") or args.language == Language.DOTNET.value:
logger.warning(".NET language-specific string extraction is not supported")
logger.warning(" will NOT deobfuscate any .NET strings")
elif lang_id == Language.DOTNET:
logger.warning(".NET language-specific string extraction is not supported yet")
logger.warning("Furthermore, FLOSS does NOT attempt to deobfuscate any strings from .NET binaries")

# let's enable .NET strings after we can deobfuscate them
# enable .NET strings once we can extract them
# results.metadata.language = Language.DOTNET.value

# TODO for pure .NET binaries our deobfuscation algorithms do nothing, but for mixed-mode assemblies they may
Expand Down Expand Up @@ -604,7 +614,7 @@ def main(argv=None) -> int:
if not lang_id:
logger.info("extracting static strings")
else:
if (lang_id == Language.GO and args.language == "") or args.language == Language.GO.value:
if lang_id == Language.GO:
logger.info("extracting language-specific Go strings")

interim = time()
Expand All @@ -615,7 +625,7 @@ def main(argv=None) -> int:
static_strings, results.strings.language_strings, args.min_length
)

elif (lang_id == Language.RUST and args.language == "") or args.language == Language.RUST.value:
elif lang_id == Language.RUST:
logger.info("extracting language-specific Rust strings")

interim = time()
Expand Down