Skip to content

Replace code duplication with for loop - #1

Merged
Evilcry merged 3 commits into
Evilcry:masterfrom
qpzm:master
Aug 14, 2020
Merged

Replace code duplication with for loop #1
Evilcry merged 3 commits into
Evilcry:masterfrom
qpzm:master

Conversation

@qpzm

@qpzm qpzm commented Jun 13, 2018

Copy link
Copy Markdown
Contributor

This pull request changed two things in pyOLEScanner.py as follows.

  1. Remove trailing whitespaces

  2. Same routine is repeated to match regex and append to the list.
    Therefore, I put all target strings in a list and iterate it.
    I changed known_api_revealer and shellcode_scanner like below and tested in python 2.7 environment.

def known_api_revealer(mappedOle):
    apiOffset = list()
    targets = ['CreateFileA','GetProcAddress','LoadLibraryA','WinExec',
        'GetSystemDirectory','WriteFile','ShellExecute',
        'GetWindowsDirectory','UrlDownloadToFile','GetTempPath',
        'IsBadReadPtr','IsBadWritePtr','CloseHandle','ReadFile',
        'SetFilePointer','VirtualAlloc']

    for target in targets:
        match = re.search(target, mappedOle)
        if match is not None:
            apiOffset.append("Revealed presence of {0} at offset:{1}".format(target, hex(match.start())))

    return apiOffset

@Evilcry
Evilcry merged commit c922ef4 into Evilcry:master Aug 14, 2020
@Evilcry

Evilcry commented Aug 15, 2020

Copy link
Copy Markdown
Owner

Sorry I saw just yesterday the MR, merged, thank you very much!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants