Improve ida pro support and fix issue #24 (#25)

* This commit improves the cwe_checker_to_ida tool. First, it fixes
issue #24. Second, it introduces some unit tests for
cwe_checker_to_ida. Third, cwe_checker_to_ida parses newer cwe checks
like cwe415 or cwe787. Forth, updated description of
cwe_checker_to_ida in README.md.

README.md

@@ -32,9 +32,12 @@ Its main focus are ELF binaries that are commonly found on Linux and Unix operat
 
 Please note that some of the above analyses only are partially implemented at the moment. Furthermore, false positives are to be expected due to shortcuts and the nature of static analysis as well as over-approximation.
 
-*cwe_checker* comes with a script called `cwe_checker_to_ida`, which parses the output of *cwe_checker* and generates a IDAPython script. This script annotates the found CWEs in IDA Pro, which helps during manual analysis of a binary. The following screenshot shows some results:
+*cwe_checker* comes with a script called `cwe_checker_to_ida`, which parses the output of *cwe_checker* and generates a IDAPython script. This script annotates the found CWEs in IDA Pro, which helps during manual analysis of a binary. The colors represent the  severeness of the found issues (yellow, orange, or red). The following screenshot shows some results:
+
+<p align="center">
+    <img src="doc/images/example_ida_anotation.png" alt="IDA Pro anotation" width="50%" height="50%"/>
+</p>
 
-![](https://github.com/fkie-cad/cwe_checker/raw/master/doc/images/example_ida_anotation.png "IDA Pro anotation")
 ## Why use cwe_checker? ##
 The following arguments should convince you to give *cwe_checker* a try:
 -  it is very easy to setup, just build the Docker container!

cwe_checker_to_ida/CweCheckerParser.py

 import logging
 
-colors = {"CWE190": "0xBBBBBB",
-          "CWE215": None,
-          "CWE243": None,
-          "CWE332": None,
-          "CWE367": "0xFF15AA",
-          "CWE426": "0xAA15FF",
-          "CWE457": "0x4286F4",
-          "CWE467": "0xFFD400",
-          "CWE476": "0x2AFF00",
-          "CWE676": "0x8833FF",
-          "CWE-782": "0xCC00BB",
+RED = 0x6666FF
+ORANGE = 0x6699FF
+YELLOW = 0xC0FFFF
+
+colors = {'CWE190': YELLOW,
+          'CWE215': None,
+          'CWE243': None,
+          'CWE248': YELLOW,
+          'CWE332': None,
+          'CWE367': ORANGE,
+          'CWE415': RED,
+          'CWE416': RED,
+          'CWE426': ORANGE,
+          'CWE457': YELLOW,
+          'CWE467': ORANGE,
+          'CWE476': ORANGE,
+          'CWE560': YELLOW,
+          'CWE676': RED,
+          'CWE782': ORANGE,
+          'CWE787': RED,
           }
 
 
@@ -43,7 +52,7 @@ class CweWarningParser(object):
         try:
             splitted_line = warning.split('WARN')
             cwe_warning = splitted_line[1].replace(
-                'u32', '').replace("64u", '').replace(':', '')
+                'u32', '').replace('64u', '').replace(':', '')
 
             cwe_name = self._remove_color(cwe_warning.split(')')[0]) + ')'
             cwe_name = cwe_name.split('{')[0].strip() + ' ' + cwe_name.split('}')[1].strip()
@@ -55,7 +64,7 @@ class CweWarningParser(object):
 
             return CweWarning(cwe_name, plugin_version, cwe_message)
         except Exception as e:
-            logging.error('[CweWarningParser] Error while parsing CWE warning: %s.' % str(e))
+            logging.error('[CweWarningParser] Error while parsing CWE warning: %s.', str(e))
             return None
 
 
@@ -63,74 +72,95 @@ class Parser(object):
 
     def __init__(self, result_path):
         self._result_path = result_path
-        self._parsers = {"CWE190": self._parse_cwe190,
-                         "CWE215": self._not_highlighted,
-                         "CWE243": self._not_highlighted,
-                         "CWE332": self._not_highlighted,
-                         "CWE367": self._parse_at,
-                         "CWE426": self._parse_at,
-                         "CWE457": self._parse_cwe457,
-                         "CWE467": self._parse_cwe467,
-                         "CWE476": self._parse_cwe476,
-                         "CWE676": self._parse_cwe676,
-                         "CWE782": self._parse_cwe782,
+        self._parsers = {'CWE125': self.parse_path,
+                         'CWE190': self.parse_cwe190,
+                         'CWE215': self.not_highlighted,
+                         'CWE243': self.not_highlighted,
+                         'CWE248': self.parse_at,
+                         'CWE332': self.not_highlighted,
+                         'CWE367': self.parse_at,
+                         'CWE415': self.parse_path,
+                         'CWE416': self.parse_path,
+                         'CWE426': self.parse_at,
+                         'CWE457': self.parse_cwe457,
+                         'CWE467': self.parse_cwe467,
+                         'CWE476': self.parse_cwe476,
+                         'CWE560': self.parse_cwe560,
+                         'CWE676': self.parse_cwe676,
+                         'CWE782': self.parse_cwe782,
+                         'CWE787': self.parse_path,
                          }
 
     def _read_in_config(self):
         lines = None
-        with open(self._result_path, "r") as f:
+        with open(self._result_path, 'r') as f:
             lines = f.readlines()
         if not lines:
-            print("[Parser] Could not read in file %s" % self._result_path)
+            print('[Parser] Could not read in file %s' % self._result_path)
             raise Exception()
         return lines
 
     @staticmethod
-    def _not_highlighted(warning):
+    def not_highlighted(warning):
         warning.highlight = False
         return warning
 
     @staticmethod
-    def _parse_at(warning):
-        warning.address = warning.warning.split("at ")[-1].split()[0].strip()
+    def parse_at(warning):
+        warning.address = warning.warning.split('at ')[-1].split()[0].strip()
         return warning
 
     @staticmethod
-    def _parse_cwe190(warning):
-        if "multiplication" in warning.warning:
-            warning.address = warning.warning.split("multiplication ")[1].split()[0]
+    def parse_path(warning):
+        warning.address = warning.warning.split('->')[-1].strip()
+        return warning
+
+    @staticmethod
+    def parse_cwe190(warning):
+        if 'multiplication' in warning.warning:
+            warning.address = warning.warning.split('multiplication ')[1].split()[0]
         else:
-            warning.address = warning.warning.split("addition ")[1].split()[0]
+            warning.address = warning.warning.split('addition ')[1].split()[0]
+        return warning
+
+    @staticmethod
+    def parse_cwe248(warning):
+        warning.address = warning.warning.split('at ')[-1].split(':')[0].strip()
+        return warning
+
+    @staticmethod
+    def parse_cwe457(warning):
+        warning.address = warning.warning.split('at ')[-1].split(':')[0].strip()
         return warning
 
     @staticmethod
-    def _parse_cwe457(warning):
-        warning.address = warning.warning.split("at ")[-1].split(":")[0].strip()
+    def parse_cwe467(warning):
+        warning.address = warning.warning.split('at ')[1].split()[0]
         return warning
 
     @staticmethod
-    def _parse_cwe467(warning):
-        warning.address = warning.warning.split("at ")[1].split()[0]
+    def parse_cwe476(warning):
+        warning.address = warning.warning.split('at ')[1].split()[0]
         return warning
 
     @staticmethod
-    def _parse_cwe476(warning):
-        warning.address = warning.warning.split("at ")[1].split()[0]
+    def parse_cwe560(warning):
+        warning.address = warning.warning.split('Function ')[1].split()[0]
         return warning
 
     @staticmethod
-    def _parse_cwe676(warning):
-        warning.address = warning.warning.split("(")[1].split(")")[0].split(":")[0]
+    def parse_cwe676(warning):
+        warning.address = warning.warning.split('(')[-1].split(')')[0].split(':')[0]
         return warning
 
     @staticmethod
-    def _parse_cwe782(warning):
-        warning.address = warning.warning.spit("(")[1].split(")")[0].strip()
+    def parse_cwe782(warning):
+        warning.address = warning.warning.split('(')[1].split(')')[0].strip()
         return warning
 
     @staticmethod
     def _extract_cwe_number(name):
-        tmp = name.split("]")[0]
+        tmp = name.split(']')[0]
         return tmp[1:]
 
     def parse(self):
@@ -140,18 +170,14 @@ class Parser(object):
         for line in lines:
             line = line.strip()
             if 'WARN' in line:
-                try:
-                    warning = cwe_parser.parse(line)
-                    cwe_number = self._extract_cwe_number(warning.name)
-                    warning.cwe_number = cwe_number
-                    if cwe_number in self._parsers:
-                        warning = self._parsers[cwe_number](warning)
-                        warning.color = colors[warning.cwe_number]
-                        if warning.address != "UNKNOWN":
-                            result.append(warning)
-                    else:
-                        print("Warning: %s not supported." % cwe_number)
-                except Exception as e:
-                    print('Error while parsing: %s' % str(e))
-                    print(line)
+                warning = cwe_parser.parse(line)
+                cwe_number = self._extract_cwe_number(warning.name)
+                warning.cwe_number = cwe_number
+                if cwe_number in self._parsers:
+                    warning = self._parsers[cwe_number](warning)
+                    warning.color = colors[warning.cwe_number]
+                    if warning.address != 'UNKNOWN':
+                        result.append(warning)
+                else:
+                    print('Warning: %s not supported.' % cwe_number)
         return result

cwe_checker_to_ida/CweCheckerParser_test.py

+import unittest
+import CweCheckerParser
+
+class TestCweCheckerParser(unittest.TestCase):
+
+    def setUp(self):
+        self.parser = CweCheckerParser.Parser('RESULT_PATH')
+
+    def test_parse_cwe125(self):
+        cwe125_warning =  '2019-07-04 12:59:18.189 WARN : [CWE125] {0.1} (Out-of-bounds Read) 0x6e9 -> 0x6f7 -> 0x707 -> 0x713 -> 0x71f'
+        cwe_warning = CweCheckerParser.CweWarning('CWE125', '0.1', cwe125_warning)
+        expect_res = '0x71f'
+
+        res = self.parser.parse_path(cwe_warning)
+
+        self.assertEqual(res.address, expect_res)
+
+
+    def test_parse_cwe190(self):
+        cwe190_warning = '2019-07-04 11:13:05.299 WARN : [CWE190] {0.1} (Integer Overflow or Wraparound) Potential overflow due to multiplication 0x6BC:32u (malloc).'
+        cwe_warning = CweCheckerParser.CweWarning('CWE190', '0.1', cwe190_warning)
+        expect_res = '0x6BC:32u'
+
+        res = self.parser.parse_cwe190(cwe_warning)
+
+        self.assertEqual(res.address, expect_res)
+
+    def test_parse_cwe248(self):
+        cwe248_warning = '2019-07-04 11:22:27.579 WARN : [CWE248] {0.1} (Possibly Uncaught Exception) (Exception thrown at 0xC77:64u).'
+        cwe_warning = CweCheckerParser.CweWarning('CWE248', '0.1', cwe248_warning)
+        expect_res = '0xC77'
+
+        res = self.parser.parse_cwe248(cwe_warning)
+
+        self.assertEqual(res.address, expect_res)
+
+    def test_parse_cwe415(self):
+        cwe415_warning = '2019-07-04 12:59:18.189 WARN : [CWE415] {0.1} (Double Free) 0x6e9 -> 0x6f7 -> 0x707 -> 0x713 -> 0x71f'
+        cwe_warning = CweCheckerParser.CweWarning('CWE415', '0.1', cwe415_warning)
+        expect_res = '0x71f'
+
+        res = self.parser.parse_path(cwe_warning)
+
+        self.assertEqual(res.address, expect_res)
+
+    def test_parse_cwe416(self):
+        cwe416_warning = '2019-07-04 13:04:12.542 WARN : [CWE416] {0.1} (Use After Free) 0x6ee -> 0x6fc -> 0x70c -> 0x718 -> 0x72e'
+        cwe_warning = CweCheckerParser.CweWarning('CWE415', '0.1', cwe416_warning)
+        expect_res = '0x72e'
+
+        res = self.parser.parse_path(cwe_warning)
+
+        self.assertEqual(res.address, expect_res)
+
+    def test_parse_cwe457(self):
+        cwe457_warning = '2019-07-04 11:13:05.303 WARN : [CWE457] {0.1} (Use of Uninitialized Variable) Found potentially unitialized stack variable (FP + 0xFFFFFFFC:32u) in function __do_global_dtors_aux at 0x662:32u'
+        cwe_warning = CweCheckerParser.CweWarning('CWE457', '0.1', cwe457_warning)
+        expect_res = '0x662'
+
+        res = self.parser.parse_cwe457(cwe_warning)
+
+        self.assertEqual(res.address, expect_res)
+
+    def test_parse_cwe476(self):
+        cwe476_warning = '2019-07-04 11:13:05.306 WARN : [CWE476] {0.2} (NULL Pointer Dereference) There is no check if the return value is NULL at 0x6BC:32u (@malloc).'
+        cwe_warning = CweCheckerParser.CweWarning('CWE476', '0.1', cwe476_warning)
+        expect_res = '0x6BC:32u'
+
+        res = self.parser.parse_cwe476(cwe_warning)
+
+        self.assertEqual(res.address, expect_res)
+
+    def test_parse_cwe560(self):
+        cwe560_warning = '2019-07-04 10:57:14.599 WARN : [CWE560] {0.1} (Use of umask() with chmod-style Argument) Function 0x5FC:32u calls umask with argument 666'
+        cwe_warning = CweCheckerParser.CweWarning('CWE560', '0.1', cwe560_warning)
+        expect_res = '0x5FC:32u'
+
+        res = self.parser.parse_cwe560(cwe_warning)
+
+        self.assertEqual(res.address, expect_res)
+
+    def test_parse_cwe676(self):
+        cwe676_warning = '2019-07-04 11:13:05.306 WARN : [CWE676] {0.1} (Use of Potentially Dangerous Function) @make_table (0x6F3:32u) -> @memcpy.'
+        cwe_warning = CweCheckerParser.CweWarning('CWE676', '0.1', cwe676_warning)
+        expect_res = '0x6F3'
+
+        res = self.parser.parse_cwe676(cwe_warning)
+
+        self.assertEqual(res.address, expect_res)
+
+    def test_parse_cwe787(self):
+        cwe787_warning = '2019-07-04 12:59:18.189 WARN : [CWE787] {0.1} (Out-of-bounds Write) 0x6e9 -> 0x6f7 -> 0x707 -> 0x713 -> 0x71f'
+        cwe_warning = CweCheckerParser.CweWarning('CWE787', '0.1', cwe787_warning)
+        expect_res = '0x71f'
+
+        res = self.parser.parse_path(cwe_warning)
+
+        self.assertEqual(res.address, expect_res)