All pastes #776929 Raw Edit

Mine

public python v1 · immutable
·published 2007-11-16 11:35 UTC
rendered paste body
import binascii, hashlibfrom signatures import signaturesclass Matcher(object):	def load(self, dataset):		self.signatures = []		for sig in signatures:			name, size, match, crc, hash, relocs = sig			pos = 0			real = False			while True:				off, data = match[0]				realpos = pos = dataset.find(data, pos)				if pos == -1:					break				real = True				for off2, data2 in match[1:]:					pos2 = dataset.find(data2, pos)					if pos2 - pos != off2 - off:						real = False						break					pos, off = pos2, off2				pos = realpos + len(data)				if real:					break						if real:				self.signatures.append(sig)				print '%i/%i signatures loaded' % (len(self.signatures), len(signatures))		def match(self, dataset):		funcs = []		for sig in self.signatures:			name, size, match, crc, hash, relocs = sig			pos = 0			while True:				off, data = match[0]				realpos = pos = dataset.find(data, pos)				if pos == -1:					break				real = True				for off2, data2 in match[1:]:					pos2 = dataset.find(data2, pos)					if pos2 - pos != off2 - off:						real = False						break					pos, off = pos2, off2				pos = realpos + len(data)				func = self.matchsig(sig, dataset, realpos)				if func != None:					funcs.append(func)				return funcs		def matchsig(self, sig, dataset, pos):		name, size, match, crc, hash, relocs = sig				func = dataset[pos:pos+size]		for off, size in relocs.items():			func = func[:off] + ('\0' * size) + func[off+size:]				if crc != binascii.crc32(func):			return None				if hash != hashlib.sha1(func).digest():			return None				print name, 'matched'		return name, pos