Skip to content

Instantly share code, notes, and snippets.

@IlluminatiFish
Last active June 4, 2021 00:49
Show Gist options
  • Save IlluminatiFish/b4e4298a7ac8a87a4d91b41a33f3cdb4 to your computer and use it in GitHub Desktop.
Save IlluminatiFish/b4e4298a7ac8a87a4d91b41a33f3cdb4 to your computer and use it in GitHub Desktop.
A function that enables you to get the intersecting strings from the list of files defined in the function parameter along with an adjustable string size, could be used for YARA rule generation.
#
# This program is a utility used by myself that I have released
# to the public under the GPLv3 license
#
# Copyright (c) 2021 IlluminatiFish.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 3.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see http://www.gnu.org/licenses/.
#
import re
def get_strings(files, string_size):
'''
Gets the strings of at least size :param string_size: out of the raw files listed in :param files:
:param files: A list of files that you want to find strings for.
:param string_size: The minimum size of the strings you want to find.
:returns: The strings found in the listed files, whether that be intersected strings or just plain strings for one file.
'''
chars = b"[a-zA-Z0-9~@#$^*()_+=[\]{}|\\,.?: -]{%d,100}" % string_size
all_strings = []
for file in files:
file_data = open(file, 'rb').read()
strings = re.findall(chars, file_data)
all_strings.append(strings)
if len(files) >= 2:
result = set(all_strings[0]).intersection(*all_strings[1:])
elif len(files) == 1:
result = strings
else:
print('[-] You need at least 2 files to compare, to find intersecting strings!')
print('[~] Files tested: ')
for file in files:
print(f' - Name: {file}')
print()
string_file = open('results.txt', 'a')
if bool(result) is True: # If the set is not empty
print(f'[*] Found(count={len(result)}) the following intersecting strings(size={string_size}):')
for string in result:
if len(string.decode().strip()) > 0: # Gets rid of bytes filled with just spaces
print(f' - {string.decode()}')
string_file.write(string.decode()+'\n')
string_file.close()
elif bool(result) is False:
print(f'[!] Did not find any intersecting strings(size={string_size}) between your files')
get_strings(['file1.ext', 'file2.ext'], 6)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment