library/src/buffer_analysis/ASCII/BP-BufferAnalysisASCII.cc
// run secondary analysis on extracted strings
run secondary analysis on extracted strings
run secondary analysis on extracted strings
BP_ERROR_T BP_RunSecondaryStringAnalysisOnExtractedStrings(P_BP_BUFFER_ANALYSIS buff_analysis)
{
	if(!buff_analysis)
		return ERR_FAILURE;
	if(!buff_analysis->ascii)
		return ERR_FAILURE;
	if(!buff_analysis->ascii->string_n)
		return ERR_FAILURE;
	size_t n = 0;
	P_BP_BUFFER_ANALYSIS_ASCII_STRINGS curr_string = NULL;
	char * string_iter = NULL;
	for(; n < buff_analysis->ascii->string_n; n++)
	{
		curr_string = &buff_analysis->ascii->strings[n];
		curr_string->string_quote_info = BP_CheckIfBufferIsQuoted
		(
			(char *) curr_string->address_of_string_in_buffer,
			curr_string->string_length
		);
		string_iter = (char *) bpcalloc(curr_string->string_length+10, 1);
		if(!string_iter)
			break;
		memcpy(string_iter, curr_string->address_of_string_in_buffer, curr_string->string_length);
		curr_string->string_flags.is_unix_file_path               = (BP_BOOL) BP_StringIsPathURL  (string_iter);
		curr_string->string_flags.is_url                          = (BP_BOOL) BP_StringIsURL      (string_iter, BP_FALSE);
		curr_string->string_flags.is_strict_url_matching_with_tld = (BP_BOOL) BP_StringIsURL(string_iter, BP_TRUE);
		curr_string->string_flags.is_host_url                     = (BP_BOOL) BP_StringIsHostURL  (string_iter);
		curr_string->string_flags.is_base_url                     = (BP_BOOL) BP_StringIsBaseURL  (string_iter);
		curr_string->string_flags.is_script_url                   = (BP_BOOL) BP_StringIsScriptURL(string_iter);
		curr_string->string_flags.is_path_url                     = (BP_BOOL) BP_StringIsPathURL  (string_iter);
		if(curr_string->string_length >= 3)
		if(memcmp(&curr_string->address_of_string_in_buffer[curr_string->string_length-4], ".so", 3) == 0)
			curr_string->string_flags.is_dynamic_so = BP_TRUE;
		if(BP_FileAtPathExists(string_iter) == BP_TRUE)
		{
			curr_string->string_flags.exists_as_file_on_filesystem = (BP_BOOL) BP_TRUE;
			if(curr_string->string_flags.exists_as_file_on_filesystem)
			{
				curr_string->string_flags.exists_as_file_on_filesystem_and_is_readable = (BP_BOOL) BP_FileAtPathExistsAndIsReadable(string_iter);
				curr_string->string_flags.exists_as_file_on_filesystem_and_is_writable = (BP_BOOL) BP_FileAtPathExistsAndIsWritable(string_iter);
			}
		}
		bpfree(string_iter);
		string_iter = NULL;
	}
	return ERR_SUCCESS;
}
BP_ERROR_T BP_RunSecondaryStringAnalysisOnExtractedStrings ( P_BP_BUFFER_ANALYSIS buff_analysis ) { if ( ! buff_analysis ) return ERR_FAILURE ; if ( ! buff_analysis -> ascii ) return ERR_FAILURE ; if ( ! buff_analysis -> ascii -> string_n ) return ERR_FAILURE ; size_t n = 0 ; P_BP_BUFFER_ANALYSIS_ASCII_STRINGS curr_string = NULL ; char * string_iter = NULL ; for ( ; n < buff_analysis -> ascii -> string_n ; n ++ ) { curr_string = & buff_analysis -> ascii -> strings [ n ] ; curr_string -> string_quote_info = BP_CheckIfBufferIsQuoted ( ( char * ) curr_string -> address_of_string_in_buffer , curr_string -> string_length ) ; string_iter = ( char * ) bpcalloc ( curr_string -> string_length + 10 , 1 ) ; if ( ! string_iter ) break ; memcpy ( string_iter , curr_string -> address_of_string_in_buffer , curr_string -> string_length ) ; curr_string -> string_flags . is_unix_file_path = ( BP_BOOL ) BP_StringIsPathURL ( string_iter ) ; curr_string -> string_flags . is_url = ( BP_BOOL ) BP_StringIsURL ( string_iter , BP_FALSE ) ; curr_string -> string_flags . is_strict_url_matching_with_tld = ( BP_BOOL ) BP_StringIsURL ( string_iter , BP_TRUE ) ; curr_string -> string_flags . is_host_url = ( BP_BOOL ) BP_StringIsHostURL ( string_iter ) ; curr_string -> string_flags . is_base_url = ( BP_BOOL ) BP_StringIsBaseURL ( string_iter ) ; curr_string -> string_flags . is_script_url = ( BP_BOOL ) BP_StringIsScriptURL ( string_iter ) ; curr_string -> string_flags . is_path_url = ( BP_BOOL ) BP_StringIsPathURL ( string_iter ) ; if ( curr_string -> string_length >= 3 ) if ( memcmp ( & curr_string -> address_of_string_in_buffer [ curr_string -> string_length - 4 ] , " " , 3 ) == 0 ) curr_string -> string_flags . is_dynamic_so = BP_TRUE ; if ( BP_FileAtPathExists ( string_iter ) == BP_TRUE ) { curr_string -> string_flags . exists_as_file_on_filesystem = ( BP_BOOL ) BP_TRUE ; if ( curr_string -> string_flags . exists_as_file_on_filesystem ) { curr_string -> string_flags . exists_as_file_on_filesystem_and_is_readable = ( BP_BOOL ) BP_FileAtPathExistsAndIsReadable ( string_iter ) ; curr_string -> string_flags . exists_as_file_on_filesystem_and_is_writable = ( BP_BOOL ) BP_FileAtPathExistsAndIsWritable ( string_iter ) ; } } bpfree ( string_iter ) ; string_iter = NULL ; } return ERR_SUCCESS ; }
run secondary analysis on extracted strings
run secondary analysis on extracted strings
// check to ensure we have an analysis structure // ensure we have an ascii analysis structure // ensure we have strings in the ascii analysis structure // walk each individual string and mark applicable strings // reference to the current string // string used for checking regex constants, allocated dynamically // and automatically freed on loop. // walk every entry in the strings array, run analysis on each // Set the current string reference for easier // readability. // check if the buffer is quoted // attempt to allocate space here // copy in the string (extra space ensures buffer is null terminated) // check for .so // now check if it's a likely file or not // now check if the file exists // if it exists, check if its read/writeable // destroy the iter on loop