VAD_Address_Extraction.py

import numpy as np
import os

def Extracting_Malicious_Processes():
    f=open('Malicious_Processes.txt').read().split('\n')
    # print(f)
    malwares=[]
    indexes=[]

    for i in range(0,len(f)):
        if f[i].__contains__(':'):
            pass
        else:
            indexes.append(i)
    # print(indexes)
    for i in range(0, len(indexes) - 1):
        name_pid = {}
        for j in range(indexes[i]+1, indexes[i + 1]):
           name_pid[f[j].split(':')[0]]=f[j].split(':')[1]
        malwares.append([f[indexes[i]],name_pid])
    return (malwares)

mal_name_id=Extracting_Malicious_Processes()



class VAD_Address_Extraction():
    def __init__(self):
        pass

    def Vad_Address_Extraction(self):
        rootdir = './scans/vadwalk/'
        file_name = []
        sub_dir = []
        vad_addresses=[]
        start_addresses=[]
        end_addresses=[]
        for subdir, dirs, files in os.walk(rootdir):
            for file in files:
                file_name.append(file)
                sub_dir.append(subdir)

        for z in range(17, len(file_name)):
            if sub_dir[z] == './scans/vadwalk/Benign Samples':
                continue
            else:
                f = open(sub_dir[z] + '/' + file_name[z], "r").read()
                # print(file_name[z])
                data=f.split('\n')
                pid=[]
                for i in mal_name_id:
                    if file_name[z].split('_')[0]==i[0]:
                        for j in (i[1]):
                            pid.append(i[1][j])
                        break
                    else:
                        continue
                rule_indexes=[]
                for i in range(0,len(data)):
                    if data[i].__contains__('Pid:'):
                        # print(data[i])
                        rule_indexes.append(i)
                    else:
                        continue
                vad,start,end=[],[],[]
                for i in range(0, len(rule_indexes) - 1):
                    # print(data[rule_indexes[i]])
                    if data[rule_indexes[i]].strip().split(':')[1].strip() in pid:
                        for j in range(rule_indexes[i]+4, rule_indexes[i + 1]-1):
                            # print(data[j].split(' '))
                            vad.append(data[j].split(' ')[0])
                            start.append(data[j].split(' ')[4])
                            end.append(data[j].split(' ')[5])
                    else:
                        continue
            vad_addresses.append(vad)
            start_addresses.append(start)
            end_addresses.append(end)

        # c=0

        # for i in all_addresses:
        #     c+=(len(i))
        # print(c)

        return vad_addresses,start_addresses,end_addresses


    def Vad_Address_Malwares(self):
        rootdir = './scans/vadinfo/'
        file_name,sub_dir=  [], []

        for subdir, dirs, files in os.walk(rootdir):
            for file in files:
                file_name.append(file)
                sub_dir.append(subdir)
        vad_nodes_dataset=[]
        for z in range(17, len(file_name)):
            if sub_dir[z] == './scans/vadinfo/Benign Samples':
                continue
            else:
                # print(file_name[z],z)
                pid = []
                f = open(sub_dir[z] + '/' + file_name[z], "r").read()
                for i in mal_name_id:
                    if file_name[z].split('_')[0] == i[0]:
                        for j in (i[1]):
                            pid.append(i[1][j])
                        break
                    else:
                        continue
                data = (f.split('\n'))
                vad_nodes=[]
                rule_indexes = []
                for i in range(0, len(data)):
                    if data[i].__contains__('Pid:'):
                        # print(data[i].strip())
                        rule_indexes.append(i)
                    else:
                        continue
                for i in range(0, len(rule_indexes)-1):
                    for j in range(rule_indexes[i], rule_indexes[i + 1]):
                        if (data[j].__contains__('Pid:')) and (data[j].split(':')[1].strip()) in pid:
                            print(data[j])
                            vad_type, vad_address, start_address, end_address = '', '', '', ''
                            file_object_address, file_object_name = '', ''
                            information = {}
                            for k in range(rule_indexes[i]+1,rule_indexes[i+1]):
                                flag=0
                                if (data[k].__contains__('VAD node')):
                                    vad_address = (data[k].split(' '))[3].strip()
                                    start_address = (data[k].split(' '))[5].strip()
                                    end_address = (data[k].split(' '))[7].strip()
                                    # print(data[k])
                                    # print((data[k].split(' '))[3].strip(),(data[k].split(' '))[7].strip(),(data[k].split(' '))[5].strip())
                                else:
                                    pass

                                if (data[k].__contains__('Vad Type:')):
                                    vad_type=(data[k].split(' ')[2]).strip()
                                    # print(data[k])
                                    # print(vad_type)
                                else:
                                    pass

                                if (data[k].__contains__('Object')):
                                    flag=1
                                    file_object_name=(data[k].split(' '))[3].strip()
                                    file_object_address=(data[k].split(' '))[1].strip()
                                    # print(data[k])
                                    # print(data[k].split(' ')[3].strip(),data[k].split(' ')[1].strip())
                                else:
                                    pass

                                information['Process_ID']=data[j].split(':')[1].strip()
                                information['VAD_address']=vad_address
                                information['start_address'] = start_address
                                information['end_address'] = end_address
                                information['VAD_type'] = vad_type
                                information['File_object_Name'] = file_object_name
                                information['File_object_address'] = file_object_address

                                if flag==0:
                                    print(information)
                                    continue
                                else:
                                    print(information)
                                    vad_nodes.append(information)

                            # print('End of VAD Process')
                        else:
                            continue
            vad_nodes_dataset.append(vad_nodes)
        # print(vad_nodes_dataset)
        return vad_nodes_dataset


vad=VAD_Address_Extraction()
vad.Vad_Address_Malwares()
# vad_addresses,start_addresses,end_addresses=vad.Vad_Address_Extraction()
# print(vad_addresses)
# print(start_addresses)
# print(end_addresses)





# f = open("Addresses.txt", "w")
# for i in range(0, len(vad_addresses)):
#     for j in range(0,len(vad_addresses[i])):
#         f.write(vad_addresses[i][j]+'\n')
# f.close()