morphdetect/analyzer.cpp at master · nastya/morphdetect · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
#include "analyzer.h"
#include <cstring>
#include <dirent.h>
#include <iostream>
#include <errno.h>

namespace detect_similar
{

using namespace std;

Analyzer::Analyzer()
{
	_shellcodes_loaded = false;
}

Analyzer::Analyzer(const unsigned char* data, uint size)
{
	_data.link(data, size);
	_shellcodes_loaded = false;
}

Analyzer::~Analyzer()
{
	clear();
}

void Analyzer::load(const unsigned char* data, uint size)
{
	_data.link(data, size);
}

void Analyzer::clear()
{
	_shellcodes.clear();
	_shellcodes_loaded = false;
}

void Analyzer::loadShellcodes(char* dirName)
{
	clear();

	string dir(dirName);
	DIR *dp;
	struct dirent *dirp;
	if ((dp = opendir(dirName)) == NULL)
	{
		cerr << "Error(" << errno << ") opening " << dir << endl;
		return;
	}
	while ((dirp = readdir(dp)) != NULL)
	{
		if (strcmp(dirp->d_name,".") == 0 || strcmp(dirp->d_name,"..") == 0)
			continue;
		string file(dirp->d_name);
		_shellcodes.push_back(Sample(file, dir + file));
	}
	closedir(dp);

	_shellcodes_loaded = true;
}

bool Analyzer::loaded()
{
	return _shellcodes_loaded;
}

ostream & Analyzer::operator<<(ostream &s)
{
	s << _className << endl;
	s << _shellcodes.size() << endl;
	for (auto it = _shellcodes.begin(); it != _shellcodes.end(); ++it)
		s << it->name << " " << it->size << endl;
	for (auto it = _shellcodes.begin(); it != _shellcodes.end(); ++it)
		s.write((const char *) it->data, it->size);
	return s;
}
istream & Analyzer::operator>>(istream &s)
{
	string name;
	s >> name;
	if (name != _className)
	{
		cerr << "Invalid model" << endl;
		_shellcodes_loaded = false;
		return s;
	}
	clear();
	int amountShellcodes;
	s >> amountShellcodes;

	for (int i = 0; i < amountShellcodes; i++)
	{
		s >> name;
		int shellcodeSize;
		s >> shellcodeSize;
		_shellcodes.push_back(Sample(name, shellcodeSize));
	}
	s.ignore();
	for (int i = 0; i < amountShellcodes; i++)
	{
		s.read((char *) _shellcodes[i].data, _shellcodes[i].size);
	}
	_shellcodes_loaded = true;
	return s;
}

ostream & operator<<(ostream &s, Analyzer &x)
{
	return x.operator<<(s);
}
istream & operator>>(istream &s, Analyzer &x)
{
	return x.operator>>(s);
}

} //namespace detect_similar