Skip to content

Commit

Permalink
New cases, improved renaming and using globals/vars
Browse files Browse the repository at this point in the history
  • Loading branch information
kam193 committed Dec 26, 2024
1 parent 9b92678 commit b075e5e
Show file tree
Hide file tree
Showing 11 changed files with 116 additions and 55 deletions.
35 changes: 0 additions & 35 deletions ASTGrep/rules/extended/autofixes/python/static-variables.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -32,38 +32,3 @@ fix: $FUNC($DATA)
metadata:
extended-obfuscation: yes

---
# yaml-language-server: $schema=https://raw.githubusercontent.com/ast-grep/ast-grep/main/schemas/rule.json

id: python-set-variables-through-locals-globals
message: Variable value is set using locals or globals function
language: Python
rule:
kind: assignment
all:
- has:
field: left
kind: subscript
all:
- has:
field: value
kind: call
any:
- pattern: globals()
- pattern: locals()
- pattern: vars()
- has:
field: subscript
has:
kind: string_content
pattern: $VARIABLE
- has:
field: right
pattern: $VALUE
not:
pattern: $VARIABLE

fix: $VARIABLE = $VALUE

metadata:
extended-obfuscation: yes
23 changes: 23 additions & 0 deletions ASTGrep/rules/extended/autofixes/python/useless-expressions.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -26,3 +26,26 @@ metadata:
{
"type": "auto-fix"
}
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/ast-grep/ast-grep/main/schemas/rule.json

id: python-useless-lambda-static-call
message: Lambda is used to obfuscate a static call
language: Python
rule:
kind: lambda
has:
field: body
kind: call
pattern: $FUNC()
any:
- pattern: globals()
- pattern: locals()
- pattern: vars()

fix: $FUNC

metadata:
extended-obfuscation: yes
confirmed-obfuscation: yes
36 changes: 26 additions & 10 deletions ASTGrep/rules/extended/python/renaming-imports.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,17 +2,31 @@ id: python-renaming-imports
message: Renaming imports is sometimes used as obfuscation method
language: Python
rule:
kind: aliased_import
all:
- kind: aliased_import
has:
pattern: $ORIGINAL
nthChild: 1
- kind: aliased_import
has:
pattern: $RENAMED
nthChild: 2
not:
- has:
pattern: $ORIGINAL
nthChild: 1
- has:
pattern: $RENAMED
nthChild: 2
not:
pattern: $ORIGINAL
any:
- inside:
kind: import_statement
- inside:
kind: import_from_statement
has:
field: module_name
pattern: $MODULE_NAME
not:
regex: ^\.
# - inside:
# kind: import_from_statement
# has:
# field: module_name
# regex: ^\.

constraints:
ORIGINAL:
Expand All @@ -26,5 +40,7 @@ metadata:
deobfuscate: |
{
"type": "template",
"steps": []
"steps": [
{"func": "concat", "sources": ["MODULE_NAME", "ORIGINAL"], "separator": ".", "output": "ORIGINAL"}
]
}
45 changes: 45 additions & 0 deletions ASTGrep/rules/extended/python/simple.yml
Original file line number Diff line number Diff line change
Expand Up @@ -166,3 +166,48 @@ metadata:
{"func": "concat", "sources": ["OBJECT", "FIELD"]}
]
}
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/ast-grep/ast-grep/main/schemas/rule.json

id: python-use-variables-through-locals-globals
message: Variable value is used using locals or globals function
language: Python
rule:
kind: subscript
has:
field: value
kind: call
any:
- pattern: globals()
- pattern: locals()
- pattern: vars()
all:
- has:
field: subscript
kind: string
pattern: $VARIABLE
has:
kind: string_content
pattern: $VARIABLE_CONTENT
- not:
all:
- inside:
kind: assignment
field: left
- inside:
kind: assignment
has:
field: right
pattern: $VARIABLE_CONTENT

metadata:
extended-obfuscation: yes
confirmed-obfuscation: no
deobfuscate: |
{
"type": "fix-generate",
"steps": [
{"func": "dequote", "source": "VARIABLE"}
]
}
2 changes: 1 addition & 1 deletion ASTGrep/service/transformations.py
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,7 @@ def output(config: dict, context: dict):
def concat(config: dict, context: dict):
sources = config.get("sources", ["DATA"])
separator = config.get("separator", ".")
return separator.join(context[source] for source in sources)
return separator.join(context[source] for source in sources if source in context)


def str_concat(config: dict, context: dict):
Expand Down

This file was deleted.

Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
x = lambda ooOOODDOODODooOOoD:vars()
y = lambda ooOOODDOODODooOOoD:vars()['xcz']
z = lambda ooOOODDOODODooOOoD:vars().aaa
z2 = lambda ooOOODDOODODooOOoD:vars(a)
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
x = vars
y = lambda ooOOODDOODODooOOoD:xcz
z = lambda ooOOODDOODODooOOoD:vars().aaa
z2 = lambda ooOOODDOODODooOOoD:vars(a)
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,10 @@ np.array()
plt.plot()
bitcoin.core.script.something("aaaa")

something("aaaa")
base64.something("aaaa")

def aaa():
something("aaaa")
base64.something("aaaa")

def script(other: str):
pass
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,5 @@ globals()['sssss']=123
vars()['yes']=True

globals()['Ids'] = Ids

locals()["oooOODooOoooOoDODoooO"]("aaa")
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
IlIIIllIIllIIIlllll=aaa

sssss=123

yes=True

globals()['Ids'] = Ids

oooOODooOoooOoDODoooO("aaa")

0 comments on commit b075e5e

Please sign in to comment.