rendered paste bodyimport binascii, hashlibfrom signatures import signaturesclass Matcher(object): def load(self, dataset): self.signatures = [] for sig in signatures: name, size, match, crc, hash, relocs = sig pos = 0 real = False while True: off, data = match[0] realpos = pos = dataset.find(data, pos) if pos == -1: break real = True for off2, data2 in match[1:]: pos2 = dataset.find(data2, pos) if pos2 - pos != off2 - off: real = False break pos, off = pos2, off2 pos = realpos + len(data) if real: break if real: self.signatures.append(sig) print '%i/%i signatures loaded' % (len(self.signatures), len(signatures)) def match(self, dataset): funcs = [] for sig in self.signatures: name, size, match, crc, hash, relocs = sig pos = 0 while True: off, data = match[0] realpos = pos = dataset.find(data, pos) if pos == -1: break real = True for off2, data2 in match[1:]: pos2 = dataset.find(data2, pos) if pos2 - pos != off2 - off: real = False break pos, off = pos2, off2 pos = realpos + len(data) func = self.matchsig(sig, dataset, realpos) if func != None: funcs.append(func) return funcs def matchsig(self, sig, dataset, pos): name, size, match, crc, hash, relocs = sig func = dataset[pos:pos+size] for off, size in relocs.items(): func = func[:off] + ('\0' * size) + func[off+size:] if crc != binascii.crc32(func): return None if hash != hashlib.sha1(func).digest(): return None print name, 'matched' return name, pos