自动生成jsonl文件

ida_file_cerate.bat

@@ -0,0 +1,18 @@
+@echo off
+setlocal enabledelayedexpansion
+
+set "IDA_PATH=D:\IDA_Pro_v6.8\idaq.exe"
+set "FOLDER_PATH=D:\bishe\Gencoding\A2C"
+set "SCRIPT_PATH=../raw-feature-extractor/preprocessing_ida.py"
+set "SAVE_PATH=../store/"
+set "LOG_PATH=../log/"
+
+
+
+for %%f in ("%FOLDER_PATH%\*.exe") do (
+    echo !time! %%f
+    %IDA_PATH% -c -B -S"%SCRIPT_PATH% --path %SAVE_PATH%" %%f
+    )
+
+endlocal
+

raw-feature-extractor/preprocessing_ida.py

@@ -1,3 +1,4 @@
+import idc
 from func import *
 from raw_graphs import *
 from idc import *
@@ -13,8 +14,11 @@ def parse_command():
 
 
 if __name__ == '__main__':
+    # def main_op(store_file_path):
     args = parse_command()
+    # path = os.path.join("../")
     path = idc.ARGV[2]
+    print os.getcwd()
     analysis_flags = idc.GetShortPrm(idc.INF_START_AF)
     analysis_flags &= ~idc.AF_IMMOFF
     # turn off "automatically make offset" heuristic
@@ -25,3 +29,6 @@ if __name__ == '__main__':
     fullpath = os.path.join(path, binary_name)
     pickle.dump(cfgs, open(fullpath, 'w'))
     idc.Exit(0)
+
+
+

raw-feature-extractor/print_test.py

@@ -1,4 +1,5 @@
 # -*- coding: UTF-8 -*-
+import os
 import sys
 from matplotlib import pyplot as plt
 import networkx as nx
@@ -7,11 +8,6 @@ import hashlib
 import json
 
 
-def print_obj(obj):
-    "打印对象的所有属性"
-    print(obj.__dict__)
-
-
 def calc_sha256(file_path):
     with open(file_path, 'rb') as f:
         bytes = f.read()
@@ -25,73 +21,85 @@ import pickle
 # sub_10F20 308  反编译代码有字符串，但是这个特征提取里没有字符串 constant，可能是间接引用的，不识别。看了下所有函数的特征，几乎都没有字符串常量，可能都是写在别的地方然后引用的。
 # sub_166C4 393
 if __name__ == '__main__':
-    file_path = '../3c580f5beca53b6599e5f04d3aa68a34bd50521d7ec5d7163849eb69f53a4150.exe'
+    file_name_list = os.listdir('../A2C/')
-    testpath = '../store/3c580f5beca53b6599e5f04d3aa68a34bd50521d7ec5d7163849eb69f53a4150.exe.ida'
+    res_file = "../sample.jsonl"
-    fr = open(testpath, 'r')
+    sample_file = open(res_file, mode='a')
-    data1 = pickle.load(fr)  # 一个二进制文件的acfgs
+    for file_name in file_name_list:
-    # function_edges
+        print file_name
-    function_edge_start = []
+        file_path = '../A2C/' + file_name
-    function_edge_end = []
+        testpath = '../store/' + file_name + '.ida'
-    for item in data1.raw_graph_list[0].old_g.edges:
+        if os.path.exists(testpath) and os.path.splitext(file_path)[-1].lower() == '.exe':
-        function_edge_start.append(item[0])
+            fr = open(testpath, 'r')
-        function_edge_end.append(item[1])
+            data1 = pickle.load(fr)  # 一个二进制文件的acfgs
-    function_edges = [function_edge_start, function_edge_end]
+            # funtion num
-    fun_name_temp = []
+            function_number = len(data1.raw_graph_list)
-    # function hsah
+            if function_number == 0:
-    file_hash = calc_sha256(file_path)
+                continue
-    # funtion num
+            # function_edges
-    function_number = len(data1.raw_graph_list)
+            function_edge_start = []
-    acfg_list = []
+            function_edge_end = []
-    # 函数级特征
+            for item in data1.raw_graph_list[0].old_g.edges:
-    for i in range(len(data1.raw_graph_list)):
+                function_edge_start.append(item[0])
-
+                function_edge_end.append(item[1])
-        # function name
+            function_edges = [function_edge_start, function_edge_end]
-        fun_name_temp.append(data1.raw_graph_list[i].funcname)
+            fun_name_temp = []
-        # block features
+            # function hsah
-        temp_G = data1.raw_graph_list[i].old_g
+            file_hash = calc_sha256(file_path)
-        # block_number
-        block_number = len(temp_G.node)
-        # block_features
-        acfg_list_item_feature = []
-        for temp in range(len(temp_G.node)):
-            block_features = []
-            # call
-            block_features.append(temp_G.node[temp]['numCalls'])
-            # transfer
-            block_features.append(temp_G.node[temp]['numTIs'])
-            # arithmetic
-            block_features.append(temp_G.node[temp]['numAs'])
-            # logic
-            block_features.append(temp_G.node[temp]['numLIs'])
-            # compare
-            block_features.append(temp_G.node[temp]['numCom'])
-            # move
-            block_features.append(temp_G.node[temp]['numMov'])
-            # termination
-            block_features.append(temp_G.node[temp]['numTerm'])
-            # date declaration
-            block_features.append(temp_G.node[temp]['numDD'])
-            # total instructions
-            block_features.append(temp_G.node[temp]['numIns'])
-            # string or integer constants
-            block_features.append(len(temp_G.node[temp]['strings']) if len(temp_G.node[temp]['strings']) != 0 else len(
-                temp_G.node[temp]['consts']))
-            # offspring
-            block_features.append(temp_G.node[temp]['offs'])
-            acfg_list_item_feature.append(block_features)
-        edge_list_start = []
-        edge_list_end = []
-        for item in temp_G.edges:
-            edge_list_start.append(item[0])
-            edge_list_end.append(item[1])
-        block_edges = [edge_list_start, edge_list_end]
-        acfg_list_item = {"block_number": block_number, "block_edges": block_edges, "block_features": acfg_list_item_feature}
-        acfg_list.append(acfg_list_item)
-
-    json_temp = {"function_edges": function_edges, "acfg_list": acfg_list, "function_names": fun_name_temp, "hash": file_hash, "function_number": function_number}
-    json_str = json.dumps(json_temp)
-    print json_str
-
 
+            acfg_list = []
+            # 函数级特征
+            for i in range(len(data1.raw_graph_list)):
 
+                # function name
+                fun_name_temp.append(data1.raw_graph_list[i].funcname)
+                # block features
+                temp_G = data1.raw_graph_list[i].old_g
+                # block_number
+                block_number = len(temp_G.node)
+                # block_features
+                acfg_list_item_feature = []
+                for temp in range(len(temp_G.node)):
+                    block_features = []
+                    # call
+                    block_features.append(temp_G.node[temp]['numCalls'])
+                    # transfer
+                    block_features.append(temp_G.node[temp]['numTIs'])
+                    # arithmetic
+                    block_features.append(temp_G.node[temp]['numAs'])
+                    # logic
+                    block_features.append(temp_G.node[temp]['numLIs'])
+                    # compare
+                    block_features.append(temp_G.node[temp]['numCom'])
+                    # move
+                    block_features.append(temp_G.node[temp]['numMov'])
+                    # termination
+                    block_features.append(temp_G.node[temp]['numTerm'])
+                    # date declaration
+                    block_features.append(temp_G.node[temp]['numDD'])
+                    # total instructions
+                    block_features.append(temp_G.node[temp]['numIns'])
+                    # string or integer constants
+                    block_features.append(
+                        len(temp_G.node[temp]['strings']) if len(temp_G.node[temp]['strings']) != 0 else len(
+                            temp_G.node[temp]['consts']))
+                    # offspring
+                    block_features.append(temp_G.node[temp]['offs'])
+                    acfg_list_item_feature.append(block_features)
+                edge_list_start = []
+                edge_list_end = []
+                for item in temp_G.edges:
+                    edge_list_start.append(item[0])
+                    edge_list_end.append(item[1])
+                block_edges = [edge_list_start, edge_list_end]
+                acfg_list_item = {"block_number": block_number, "block_edges": block_edges,
+                                  "block_features": acfg_list_item_feature}
+                acfg_list.append(acfg_list_item)
 
+            json_temp = {"function_edges": function_edges, "acfg_list": acfg_list, "function_names": fun_name_temp,
+                         "hash": file_hash, "function_number": function_number}
+            json_str = json.dumps(json_temp)
+            sample_file.write(json_str)
+        else:
+            print "删除文件" + file_path
+            os.remove(file_path)
+    sample_file.close()