[Autogenerated] to get a better understanding of these analysis techniques,
let's consider the following demo.
We'll start off by reviewing the p file module documentation.
The goal of this demo is to identify packed executable and
will achieve this based on two techniques.
First based on the low number of imports and second
based on the sections marked, read, write and execute.
So let's get started in line with the other demos.
We'll first start with the documentation page for the p file
python module and one cool section in the documentation can be
found in the usage examples category.
This provides you with more details about this module and
how you can get the most out of it.
Now let's return to Visual Studio Code for a practical example,
I will start a Python import the file and analyze One of the falls
there is a method called show warnings that will display a list of
warnings about the fall based on this.
We can already see that this file is identified as a
packed executable While this is cool.
It's also important to know how these detection mechanisms work under the hood.
So we'll attempt to implement the detection of packed
executable based on the number of imports.
So I'll create a function called get imports and provide the path
to the fall since not all files are p files.
I will use a try except statement I will create a new p file object,
everyone the parsed data directories method as it's also
specified in the documentation as well.
To keep the count of the total number of functions.
I will create a new variable and this will be called total
functions and I will set it to zero.
Then I will iterate through all of the imported DLL
libraries in a for loop for each DLL.
The number of functions imported will be added to the number of total
functions outside of the for loop I'll print the path to the fall
followed by the number of imported the LLS and also the total number of
imported functions in the accept clause.
I will just print a simple error message with this function
completed I'll had a new argument called dash analyze imports and
finally I will add an if statement specific to this argument that
illiterates through all of the falls and cause the function which
will print the results.
Now let's test this out first I will call this for one of the
sample files and it can be noticed the low number of DLS but
also functions for comparison.
I'll run this against all the suspicious faults in the samples
directory and there are a couple of outstanding findings.
The one file that stands out which can be classified as a packed
executable is again file for while this technique provides us a high
level of insight into DLS and functions imported.
It's time to move forward and implement another technique based
on the characteristics of the fall sections.
I have already written the function that for a file
section specified as an argument.
It will go through and verify using the bit wise and
operation and the mask of the corresponding flag.
These are concatenate ID into the result which will be
returned by the function with this in place.
I can move forward and start writing the code for the
function that will analyze the sections.
This will be called analyze sections and will take the
path to the file as the argument.
Since the file might not be a P file,
I will use again a try statement Next I'll create API object and
use the path that was provided as an argument.
Then I want to print this path so it's clear which file is analyzed in a
for loop I'll iterate through all of the sections and for each of the
sections I will extract the name and because it's binary,
I do have to decode it as well as remove any trailing null
characters and finally I will use a format string to print the
name of the section as well as the section.
Flags which is returned by the get flags function outside of the for loop
I'll print a new line so the output will be much easier to read in case
the fall is not API fall and cannot be passed.
An error message will be displayed now in the main body of the script,
I will add a new argument called analyze P sections and correlate
the new function with the newly created argument.
I will iterate through all of the falls and for each one of them,
I will call the function analyze sections and provide
the path to the fall as argument.
Now, let's test this out and see how it works.
I will expand the terminal a bit And the previous assumption is now confirmed.
File 3 1 and two all have standard sections and flags,
but we can clearly see that file four has two sections called U.
P.
X.
And both of these are marked, read, write and execute.
This is really interesting, but you don't have to stop here.
You can combine these functions into a single detection as well.