viper-framework / viper

Binary analysis and management framework
Other
1.54k stars 351 forks source link

[Module update] Radiff2 new features #667

Closed TcM1911 closed 6 years ago

TcM1911 commented 6 years ago

Example output:

viper > find name upatre
+---+----------+-----------------------+----------------------------------+--------------------------------------------+
| # | Name     | Mime                  | MD5                              | Tags                                       |
+---+----------+-----------------------+----------------------------------+--------------------------------------------+
| 1 | upatre-1 | application/x-dosexec | 7a1f26753d6e70076f15149feffbe233 | possible_includes_base64_packed_functions, |
|   |          |                       |                                  | ispe32, iswindowsgui, hasrichsignature     |
+---+----------+-----------------------+----------------------------------+--------------------------------------------+
| 2 | upatre-2 | application/x-dosexec | f44b714297a01a8d72e21fe658946782 | anti_dbg, screenshot, ispe32,              |
|   |          |                       |                                  | iswindowsgui, fasm_15x,                    |
|   |          |                       |                                  | fasm_v13x_additional,                      |
|   |          |                       |                                  | fasm_v15x_additional, fasm_v15x, fasm_v13x |
+---+----------+-----------------------+----------------------------------+--------------------------------------------+
| 3 | upatre-3 | application/x-dosexec | 4d6c045c4cca49f8e556a7fb96e28635 | ispe32, iswindowsgui, hasoverlay,          |
|   |          |                       |                                  | hasrichsignature                           |
+---+----------+-----------------------+----------------------------------+--------------------------------------------+
| 4 | upatre-4 | application/x-dosexec | 6e67fb3835da739a11570bba44a19dbc | anti_dbg, screenshot, ispe32,              |
|   |          |                       |                                  | iswindowsgui, fasm_15x,                    |
|   |          |                       |                                  | fasm_v13x_additional,                      |
|   |          |                       |                                  | fasm_v15x_additional, fasm_v15x, fasm_v13x |
+---+----------+-----------------------+----------------------------------+--------------------------------------------+
| 5 | upatre-5 | application/x-dosexec | 41859ac8b90080471dfb315bf439d6f4 | anti_dbg, screenshot, ispe32,              |
|   |          |                       |                                  | iswindowsgui, fasm_15x,                    |
|   |          |                       |                                  | fasm_v13x_additional,                      |
|   |          |                       |                                  | fasm_v15x_additional, fasm_v15x, fasm_v13x |
+---+----------+-----------------------+----------------------------------+--------------------------------------------+
viper > radiff --table
[*] Generating table, this might take a while...
[+] Processing sample: 1 of 5
[+] Processing sample: 2 of 5
[+] Processing sample: 3 of 5
[+] Processing sample: 4 of 5
[+] Processing sample: 5 of 5
+-------+--------------+--------------+--------------+--------------+--------------+
| entry | (1) upatre-1 | (2) upatre-2 | (3) upatre-3 | (4) upatre-4 | (5) upatre-5 |
+-------+--------------+--------------+--------------+--------------+--------------+
| 1     | 100          | 0.57         | 0.0          | 0.57         | 0.55         |
| 2     | 0.57         | 100          | 0.0          | 99.96        | 21.79        |
| 3     | 0            | 0            | 100          | 0            | 0            |
| 4     | 0.57         | 99.96        | 0.0          | 100          | 21.79        |
| 5     | 0.55         | 21.79        | 0.0          | 21.79        | 100          |
+-------+--------------+--------------+--------------+--------------+--------------+