I. Mach-O/python/CrimsonUroboros.py

@@ -0,0 +1,285 @@
+#!/usr/bin/env python3
+import lief
+import uuid
+import argparse
+import subprocess
+from asn1crypto.cms import ContentInfo
+import os
+import sys
+
+### --- I. MACH-O --- ###
+class SnakeI:
+    def __init__(self, binaries):
+        '''When initiated, the program parses a Universal binary (binaries parameter) and extracts the ARM64 Mach-O. If the file is not in a universal format but is a valid ARM64 Mach-O, it is taken as a binary parameter during initialization.'''
+        self.binary = self.parseFatBinary(binaries)
+        self.fat_offset = self.binary.fat_offset # For various calculations, if ARM64 Mach-O extracted from Universal Binary 
+        self.prot_map = {
+        0: '---',
+        1: 'r--',
+        2: '-w-',
+        3: 'rw-',
+        4: '--x',
+        5: 'r-x',
+        6: '-wx',
+        7: 'rwx'
+        }
+        self.segment_flags_map = {
+        0x1: 'SG_HIGHVM',
+        0x2: 'SG_FVMLIB',
+        0x4: 'SG_NORELOC',
+        0x8: 'SG_PROTECTED_VERSION_1',
+        0x10: 'SG_READ_ONLY',
+        }
+    
+    def mapProtection(self, numeric_protection):
+        '''Maps numeric protection to its string representation.'''
+        return self.prot_map.get(numeric_protection, 'Unknown')
+    
+    def getSegmentFlags(self, flags):
+        '''Maps numeric segment flags to its string representation.'''
+        return self.segment_flags_map.get(flags, '')
+        #return " ".join(activated_flags)
+        
+    def parseFatBinary(self, binaries):
+        '''Parse Mach-O file, whether compiled for multiple architectures or just for a single one. It returns the ARM64 binary if it exists. If not, it exits the program.'''
+        for binary in binaries:
+            if binary.header.cpu_type == lief.MachO.CPU_TYPES.ARM64:
+                arm64_bin = binary
+        if arm64_bin == None:
+            print('The specified Mach-O file is not in ARM64 architecture.')
+            exit()
+        return arm64_bin
+
+    def getFileType(self):
+        """Extract and return the file type from a binary object's header."""
+        return self.binary.header.file_type.name
+
+    def getHeaderFlags(self):
+        '''Return binary header flags.'''
+        return self.binary.header.flags_list
+
+    def getEndianess(self):
+        '''Check the endianness of a binary based on the system and binary's magic number.'''
+        magic = self.binary.header.magic.name
+        endianness = sys.byteorder
+        if endianness == 'little' and (magic == 'MAGIC_64' or magic == 'MAGIC' or magic == 'FAT_MAGIC'):
+            return 'little'
+        else:
+            return 'big'
+    
+    def getBinaryHeader(self):
+        '''https://lief-project.github.io/doc/stable/api/python/macho.html#header'''
+        return self.binary.header
+
+    def getLoadCommands(self):
+        '''https://lief-project.github.io/doc/stable/api/python/macho.html#loadcommand'''
+        return self.binary.commands
+
+    def getSegments(self):
+        '''Extract segmenents from binary and return a human readable string: https://lief-project.github.io/doc/stable/api/python/macho.html#lief.MachO.SegmentCommand'''
+        segment_info = []
+        for segment in self.binary.segments:
+            name = segment.name
+            va_start = '0x' + format(segment.virtual_address, '016x')
+            va_end = '0x' + format(int(va_start, 16) + segment.virtual_size, '016x')
+            file_start = hex(segment.file_size + self.fat_offset)
+            file_end = hex(int(file_start, 16) + segment.file_size)
+            init_prot = self.mapProtection(segment.init_protection)
+            max_prot = self.mapProtection(segment.max_protection)            
+            flags = self.getSegmentFlags(segment.flags)
+            if flags != '':
+                segment_info.append(f'{name.ljust(16)}{init_prot}/{max_prot.ljust(8)} VM: {va_start}-{va_end.ljust(24)} FILE: {file_start}-{file_end} ({flags})')
+            else:
+                segment_info.append(f'{name.ljust(16)}{init_prot}/{max_prot.ljust(8)} VM: {va_start}-{va_end.ljust(24)} FILE: {file_start}-{file_end}')                
+        return segment_info
+
+    def getSections(self):
+        '''Extract sections from binary and return in human readable format: https://lief-project.github.io/doc/stable/api/python/macho.html#lief.MachO.Section'''
+        sections_info = []
+        sections_info.append("SEGMENT".ljust(14) + "SECTION".ljust(20) + "TYPE".ljust(28) + "VIRTUAL MEMORY".ljust(32) + "FILE".ljust(26) + "FLAGS".ljust(40))
+        sections_info.append(len(sections_info[0])*"=")
+        for section in self.binary.sections:
+            segment_name = section.segment_name
+            section_name = section.fullname
+            section_type = section.type.name
+            section_va_start = hex(section.virtual_address)
+            section_va_end = hex(section.virtual_address + section.offset)
+            section_size_start = hex(section.offset + self.fat_offset)
+            section_size_end = hex(section.size + section.offset + self.fat_offset)
+            section_flags_list = section.flags_list
+            flags_strings = [flag.name for flag in section_flags_list]
+            flags = " ".join(flags_strings)
+            sections_info.append((f'{segment_name.ljust(14)}{section_name.ljust(20)}{section_type.ljust(28)}{section_va_start}-{section_va_end.ljust(20)}{section_size_start}-{section_size_end}\t\t({flags})'))
+        return sections_info
+
+    def getSymbols(self):
+        '''Get all symbols from the binary (LC_SYMTAB, Chained Fixups, Exports Trie): https://lief-project.github.io/doc/stable/api/python/macho.html#symbol'''
+        return self.binary.symbols
+
+    def getChainedFixups(self):
+        '''Return Chained Fixups information: https://lief-project.github.io/doc/latest/api/python/macho.html#chained-binding-info'''
+        return self.binary.dyld_chained_fixups
+        
+    def getExportTrie(self):
+        '''Return Export Trie information: https://lief-project.github.io/doc/latest/api/python/macho.html#dyldexportstrie-command'''
+        try:
+            return self.binary.dyld_exports_trie.show_export_trie()
+        except:
+            return "NO EXPORT TRIE"
+
+    def getUUID(self):
+        '''Return UUID as string and in UUID format: https://lief-project.github.io/doc/stable/api/python/macho.html#uuidcommand'''
+        for cmd in self.binary.commands:
+            if isinstance(cmd, lief.MachO.UUIDCommand):
+                uuid_bytes = cmd.uuid
+                break
+        uuid_string = str(uuid.UUID(bytes=bytes(uuid_bytes)))
+        return uuid_string
+
+    def getMain(self):
+        '''Determine the entry point of an executable.'''
+        return self.binary.main_command
+    
+    def getStringSection(self):
+        '''Return strings from the __cstring (string table).'''
+        extracted_strings = set()
+        for section in self.binary.sections:
+            if section.type == lief.MachO.SECTION_TYPES.CSTRING_LITERALS:
+                extracted_strings.update(section.content.tobytes().split(b'\x00'))
+        return extracted_strings
+
+    def findAllStringsInBinary(self):
+        '''Check every binary section to find strings.'''
+        extracted_strings = ""
+        byte_set = set()
+        for section in self.binary.sections:
+            byte_set.update(section.content.tobytes().split(b'\x00'))
+        for byte_item in byte_set:
+            try:
+                decoded_string = byte_item.decode('utf-8')
+                extracted_strings += decoded_string + "\n"
+            except UnicodeDecodeError:
+                pass
+        return extracted_strings
+### --- --- --- ### 
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Mach-O files parser for binary analysis.")
+    ### --- I. MACH-O --- ### 
+    parser.add_argument('-p', '--path', required=True, help="Path to the Mach-O file.")
+    parser.add_argument('--file_type', action='store_true', help="Print binary file type.")
+    parser.add_argument('--header_flags', action='store_true', help="Print binary header flags.")
+    parser.add_argument('--endian', action='store_true', help="Print binary endianess.")
+    parser.add_argument('--header', action='store_true', help="Print binary header.")
+    parser.add_argument('--load_commands', action='store_true', help="Print binary load commands names.")
+    parser.add_argument('--segments', action='store_true', help="Print binary segments in human friendly form.")
+    parser.add_argument('--sections', action='store_true', help="Print binary sections in human friendly form.")
+    parser.add_argument('--symbols', action='store_true', help="Print all binary symbols.")
+    parser.add_argument('--chained_fixups', action='store_true', help="Print Chained Fixups information.")
+    parser.add_argument('--exports_trie', action='store_true', help="Print Export Trie information.")
+    parser.add_argument('--uuid', action='store_true', help="Print UUID.")
+    parser.add_argument('--main', action='store_true', help="Print entry point and stack size.")
+    parser.add_argument('--strings_section', action='store_true', help="Print strings from __cstring section.")
+    parser.add_argument('--all_strings', action='store_true', help="Print strings from all sections.")
+    parser.add_argument('--save_strings', help="Parse all sections, detect strings and save them to a file.")
+    parser.add_argument('--info', action='store_true', default=False , help="Print header, load commands, segments, sections, symbols and strings.")
+    
+    args = parser.parse_args()
+    file_path = os.path.abspath(args.path)
+    
+    ### --- I. MACH-O --- ###
+    try: # Check if the file is in a valid Mach-O format
+        if os.path.exists(file_path):
+            binaries = lief.MachO.parse(file_path)
+            snake_instance = SnakeI(binaries)
+        else:
+            print(f'The file {file_path} does not exist.')
+            exit()
+    except Exception as e: # Exit if not
+        print(f"An error occurred: {e}")
+        exit()
+    
+    if args.file_type: # Print binary file type
+        print(f'File type: {snake_instance.getFileType()}')
+    
+    if args.header_flags: # Print binary header flags
+        header_flag_list = snake_instance.getHeaderFlags()
+        print("Header flags:", " ".join(header_flag.name for header_flag in header_flag_list))
+
+    if args.endian: # Print binary endianess
+        print(f'Endianess: {snake_instance.getEndianess()}')
+        
+    if args.header: # Print binary header
+        print(snake_instance.getBinaryHeader())
+
+    if args.load_commands: # Print binary load commands
+        load_commands_list = snake_instance.getLoadCommands()
+        print("Load Commands:", " ".join(load_command.command.name for load_command in load_commands_list))
+          
+    if args.segments: # Print binary segments in human friendly form
+        for segment in snake_instance.getSegments():
+            print(segment)
+    
+    if args.sections: # Print binary sections in human friendly form
+        for section in snake_instance.getSections():
+            print(section)
+            
+    if args.symbols: # Print symbols
+        for symbol in snake_instance.getSymbols():
+            print(symbol.name)
+
+    if args.chained_fixups: # Print Chained Fixups information
+        print(snake_instance.getChainedFixups())
+        
+    if args.exports_trie: # Print Exports Trie information 
+        print(snake_instance.getExportTrie())    
+        
+    if args.uuid: # Print UUID
+        print(f'UUID: {snake_instance.getUUID()}')
+
+    if args.main: # Print entry point and stack size
+        print(f'Entry point: {hex(snake_instance.getMain().entrypoint)}')
+        print(f'Stack size: {hex(snake_instance.getMain().stack_size)}')
+        
+    if args.strings_section: # Print strings from __cstring section
+        print('Strings from __cstring section:')
+        print('-------------------------------')
+        for string in (snake_instance.getStringSection()):
+            print(string)
+    
+    if args.all_strings: # Print strings from all sections.
+        print(snake_instance.findAllStringsInBinary())
+
+    if args.save_strings: # Parse all sections, detect strings and save them to a file
+        extracted_strings = snake_instance.findAllStringsInBinary()
+        with open(args.save_strings, 'a') as f:
+            for s in extracted_strings:
+                f.write(s)
+
+    if args.info: # Print all info about the binary
+        print('\n<=== HEADER ===>')
+        print(snake_instance.getBinaryHeader())
+        print('\n<=== LOAD COMMANDS ===>')
+        for lcd in snake_instance.getLoadCommands():
+            print(lcd)
+            print("="*50)
+        print('\n<=== SEGMENTS ===>')
+        for segment in snake_instance.getSegments():
+            print(segment)
+        print('\n<=== SECTIONS ===>')
+        for section in snake_instance.getSections():
+            print(section)
+        print('\n<=== SYMBOLS  ===>')
+        for symbol in snake_instance.getSymbols():
+            print(symbol.name)
+        print('\n<=== STRINGS ===>')
+        print('Strings from __cstring section:')
+        print('-------------------------------')
+        for string in (snake_instance.getStringSection()):
+            print(string)
+        print('\n<=== UUID ===>')
+        print(f'{snake_instance.getUUID()}')
+        print('\n<=== ENDIANESS ===>')
+        print(snake_instance.getEndianess())
+        print('\n<=== ENTRYPOINT ===>')
+        print(f'{hex(snake_instance.getMain().entrypoint)}')

I. Mach-O/python/MachOFileFinder.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+import os
+import lief
+import sys
+import argparse
+
+class MachOFileFinder:
+    '''Class for finding ARM64 Mach-O binaries in a given directory.'''
+
+    def __init__(self, directory_path, recursive=False):
+        '''Constructor to initialize the directory path and recursive flag.'''
+        self.directory_path = directory_path
+        self.recursive = recursive
+
+    def parse_fat_binary(self, binaries):
+        '''Function to parse Mach-O file, whether compiled for multiple architectures or just for a single one.
+        It returns the ARM64 binary if it exists. If not, it exits the program.'''
+        arm64_bin = None
+        for binary in binaries:
+            if binary.header.cpu_type == lief.MachO.CPU_TYPES.ARM64:
+                arm64_bin = binary
+        return arm64_bin
+
+    def process_directory(self, root, files):
+        '''Method to process all files in the specified directory.'''
+        for file_name in files:
+            file_path = os.path.abspath(os.path.join(root, file_name))
+            try:
+                binaries = lief.MachO.parse(file_path)
+                binary = self.parse_fat_binary(binaries)
+                if binary is not None:
+                    print(f"{binary.header.file_type.name}:{file_path}")
+            except:
+                pass  # Ignore parsing errors or non-Mach-O files
+
+    def process_files(self):
+        '''Method to process files based on the specified search type.'''
+        for root, dirs, files in os.walk(self.directory_path):
+            self.process_directory(root, files)
+
+            if not self.recursive:
+                break  # Break the loop if not searching recursively
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description='Find ARM64 Mach-O binaries in a directory.')
+    parser.add_argument('path', metavar='PATH', type=str, help='the directory path to search for Mach-O binaries')
+    parser.add_argument('-r', '--recursive', action='store_true', help='search recursively (default: false)')
+
+    args = parser.parse_args()
+    directory_path = args.path
+
+    if not os.path.isdir(directory_path):
+        print(f"Error: {directory_path} is not a valid directory.")
+        sys.exit(1)
+
+    macho_finder = MachOFileFinder(directory_path, recursive=args.recursive)
+    macho_finder.process_files()