Skip to content

Commit

Permalink
Merge pull request #1107 from avast/fileinfo-print-analysis-time
Browse files Browse the repository at this point in the history
Add printing of analysis time to retdec-fileinfo output
  • Loading branch information
metthal authored Sep 12, 2022
2 parents dcaaad5 + 00cf4ad commit c0107d1
Show file tree
Hide file tree
Showing 7 changed files with 57 additions and 14 deletions.
18 changes: 18 additions & 0 deletions src/fileinfo/file_information/file_information.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,15 @@ std::string FileInformation::getPathToFile() const
return filePath;
}

/**
* Get time when the analysis was done
* @return Analysis time
*/
std::string FileInformation::getAnalysisTime() const
{
return analysisTime;
}

std::string FileInformation::getTelfhash() const
{
return telfhash;
Expand Down Expand Up @@ -3307,6 +3316,15 @@ void FileInformation::setPathToFile(const std::string &filepath)
filePath = filepath;
}

/**
* Set when the analysis was done
* @param filepath Analysis time
*/
void FileInformation::setAnalysisTime(const std::string &analysistime)
{
analysisTime = analysistime;
}

void FileInformation::setTelfhash(const std::string &hash)
{
telfhash = hash;
Expand Down
3 changes: 3 additions & 0 deletions src/fileinfo/file_information/file_information.h
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ class FileInformation
private:
retdec::cpdetect::ReturnCode status = retdec::cpdetect::ReturnCode::OK;
std::string filePath; ///< path to input file
std::string analysisTime; ///< time when the analysis was done
std::string telfhash; ///< telfhash of ELF input file
std::string crc32; ///< CRC32 of input file
std::string md5; ///< MD5 of input file
Expand Down Expand Up @@ -78,6 +79,7 @@ class FileInformation
/// @{
retdec::cpdetect::ReturnCode getStatus() const;
std::string getPathToFile() const;
std::string getAnalysisTime() const;
std::string getTelfhash() const;
std::string getCrc32() const;
std::string getMd5() const;
Expand Down Expand Up @@ -504,6 +506,7 @@ class FileInformation
/// @{
void setStatus(retdec::cpdetect::ReturnCode state);
void setPathToFile(const std::string &filepath);
void setAnalysisTime(const std::string &analysistime);
void setTelfhash(const std::string &telfhash);
void setCrc32(const std::string &fileCrc32);
void setMd5(const std::string &fileMd5);
Expand Down
10 changes: 7 additions & 3 deletions src/fileinfo/file_presentation/json_presentation.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -97,9 +97,8 @@ bool presentSimple(
/**
* Constructor
*/
JsonPresentation::JsonPresentation(FileInformation &fileinfo_, bool verbose_)
: FilePresentation(fileinfo_)
, verbose(verbose_)
JsonPresentation::JsonPresentation(FileInformation &fileinfo_, bool verbose_, bool analysisTime_)
: FilePresentation(fileinfo_), verbose(verbose_), analysisTime(analysisTime_)
{

}
Expand Down Expand Up @@ -1322,6 +1321,11 @@ bool JsonPresentation::present()
presentFileinfoVersion(writer);
}

if(analysisTime)
{
serializeString(writer, "analysisTime", fileinfo.getAnalysisTime());
}

serializeString(writer, "inputFile", fileinfo.getPathToFile());
serializeString(writer, "dllName", fileinfo.getExportDllName());

Expand Down
5 changes: 3 additions & 2 deletions src/fileinfo/file_presentation/json_presentation.h
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,8 @@ class JsonPresentation : public FilePresentation
rapidjson::ASCII<>>;

private:
bool verbose; ///< @c true - print all information about file
bool verbose; ///< @c true - print all information about file
bool analysisTime; ///< @c true - print when the analysis was done

/// @name Auxiliary presentation methods
/// @{
Expand Down Expand Up @@ -63,7 +64,7 @@ class JsonPresentation : public FilePresentation
const IterativeSubtitleGetter &getter) const;
/// @}
public:
JsonPresentation(FileInformation &fileinfo_, bool verbose_);
JsonPresentation(FileInformation &fileinfo_, bool verbose_, bool analysisTime_);

virtual bool present() override;
};
Expand Down
9 changes: 7 additions & 2 deletions src/fileinfo/file_presentation/plain_presentation.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -348,8 +348,8 @@ void presentIterativeSimple(const IterativeSimpleGetter &getter)
/**
* Constructor
*/
PlainPresentation::PlainPresentation(FileInformation &fileinfo_, bool verbose_, bool explanatory_) :
FilePresentation(fileinfo_), verbose(verbose_), explanatory(explanatory_)
PlainPresentation::PlainPresentation(FileInformation &fileinfo_, bool verbose_, bool explanatory_, bool analysisTime_) :
FilePresentation(fileinfo_), verbose(verbose_), explanatory(explanatory_), analysisTime(analysisTime_)
{

}
Expand Down Expand Up @@ -828,6 +828,11 @@ bool PlainPresentation::present()
Log::info() << "RetDec Fileinfo version : "
<< utils::version::getVersionStringShort() << "\n";
}
if(analysisTime)
{
Log::info() << "Analysis time : "
<< fileinfo.getAnalysisTime() << "\n";
}
Log::info() << "Input file : " << fileinfo.getPathToFile() << "\n";

const std::string& dllName = fileinfo.getExportDllName();
Expand Down
7 changes: 4 additions & 3 deletions src/fileinfo/file_presentation/plain_presentation.h
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,9 @@ namespace fileinfo {
class PlainPresentation : public FilePresentation
{
private:
bool verbose; ///< @c true - print all information about file
bool explanatory; ///< @c true - print explanatory notes
bool verbose; ///< @c true - print all information about file
bool explanatory; ///< @c true - print explanatory notes
bool analysisTime; ///< @c true - print when the analysis was done

/// @name Auxiliary presentation methods
/// @{
Expand All @@ -37,7 +38,7 @@ class PlainPresentation : public FilePresentation
void presentSignatures() const;
/// @}
public:
PlainPresentation(FileInformation &fileinfo_, bool verbose_, bool explanatory_);
PlainPresentation(FileInformation &fileinfo_, bool verbose_, bool explanatory_, bool analysisTime_);

virtual bool present() override;
};
Expand Down
19 changes: 15 additions & 4 deletions src/fileinfo/fileinfo.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
#include "retdec/utils/memory.h"
#include "retdec/utils/io/log.h"
#include "retdec/utils/string.h"
#include "retdec/utils/time.h"
#include "retdec/utils/version.h"
#include "retdec/ar-extractor/detection.h"
#include "retdec/cpdetect/errors.h"
Expand Down Expand Up @@ -76,6 +77,8 @@ struct ProgParams
std::size_t epBytesCount = EP_BYTES_SIZE;
/// load flags for `fileformat`
LoadFlags loadFlags = LoadFlags::NONE;
/// flag whether to include analysis time into the output
bool analysisTime = false;

friend std::ostream& operator<<(std::ostream& os, const ProgParams& pp);
};
Expand All @@ -96,6 +99,7 @@ std::ostream& operator<<(std::ostream& os, const ProgParams& pp)
os << "max half memory : " << pp.maxMemoryHalfRAM << "\n";
os << "ep bytes count : " << pp.epBytesCount << "\n";
os << "load flags : " << pp.loadFlags << "\n";
os << "analysis time : " << pp.analysisTime << "\n";

os << "yara malware rules : " << "\n";
for (auto& r : pp.yaraMalwarePaths)
Expand Down Expand Up @@ -134,11 +138,11 @@ void fatalErrorHandler(void *user_data, const std::string& /*reason*/, bool /*ge

if(params->plainText)
{
PlainPresentation(*fileinfo, params->verbose, params->explanatory).present();
PlainPresentation(*fileinfo, params->verbose, params->explanatory, params->analysisTime).present();
}
else
{
JsonPresentation(*fileinfo, params->verbose).present();
JsonPresentation(*fileinfo, params->verbose, params->analysisTime).present();
}

exit(static_cast<int>(ReturnCode::FORMAT_PARSER_PROBLEM));
Expand Down Expand Up @@ -206,6 +210,7 @@ void printHelp()
<< " Without this parameter program print only\n"
<< " basic information.\n"
<< " --explanatory, -X Print explanatory notes (only in plain text output).\n"
<< " --analysis-time Print also analysis time into output.\n"
<< "\n"
<< "Options for specifying configuration file:\n"
<< " --config=file, -c=file\n"
Expand Down Expand Up @@ -390,6 +395,7 @@ bool doConfigString(
params.verbose = retdec::serdes::deserializeBool(root, "verbose", params.verbose);
params.explanatory = retdec::serdes::deserializeBool(root, "explanatory", params.explanatory);
params.maxMemoryHalfRAM = retdec::serdes::deserializeBool(root, "maxMemoryHalf", params.maxMemoryHalfRAM);
params.analysisTime = retdec::serdes::deserializeBool(root, "analysisTime", params.analysisTime);

if (root.HasMember("loadStrings"))
{
Expand Down Expand Up @@ -604,6 +610,10 @@ bool doParams(int argc, char **_argv, ProgParams &params)
{
params.explanatory = true;
}
else if (c == "--analysis-time")
{
params.analysisTime = true;
}
else if (c == "-S" || c == "--strings")
{
params.loadFlags = static_cast<LoadFlags>(params.loadFlags
Expand Down Expand Up @@ -773,6 +783,7 @@ int main(int argc, char* argv[])
FileInformation fileinfo;
FileDetector *fileDetector = nullptr;
fileinfo.setPathToFile(params.filePath);
fileinfo.setAnalysisTime(timestampToDate(getCurrentTimestamp()));
fileinfo.setFileFormatEnum(fileFormat);
ErrorHandlerInfo hInfo { &params, &fileinfo };
llvm::install_fatal_error_handler(fatalErrorHandler, &hInfo);
Expand Down Expand Up @@ -833,11 +844,11 @@ int main(int argc, char* argv[])
// print results on standard output
if(params.plainText)
{
PlainPresentation(fileinfo, params.verbose, params.explanatory).present();
PlainPresentation(fileinfo, params.verbose, params.explanatory, params.analysisTime).present();
}
else
{
JsonPresentation(fileinfo, params.verbose).present();
JsonPresentation(fileinfo, params.verbose, params.analysisTime).present();
}

// generate configuration file
Expand Down

0 comments on commit c0107d1

Please sign in to comment.