Skip to content

Y
yara-python
Commit 7360bf2e by plusvic
Options

Simplify code for handling module data

parent aae3a570
Showing with 114 additions and 161 deletions
yara-python.c
...@@ -394,216 +394,166 @@ typedef struct _CALLBACK_DATA ...@@ -394,216 +394,166 @@ typedef struct _CALLBACK_DATA
// Forward declarations for handling module data. // Forward declarations for handling module data.
PyObject* handle_module_data(YR_OBJECT_STRUCTURE* module_structure); PyObject* convert_structure_to_python(
PyObject* handle_module_list(YR_OBJECT_ARRAY* array_object); YR_OBJECT_STRUCTURE* structure);
PyObject* handle_module_dictionary(YR_OBJECT_DICTIONARY* dictionary_object);
PyObject* handle_module_data(YR_OBJECT_STRUCTURE* module_structure)
{
PyObject* dict;
PyObject* object;
SIZED_STRING* sz;
YR_OBJECT* module_object;
YR_STRUCTURE_MEMBER* module_member;
dict = PyDict_New(); PyObject* convert_array_to_python(
YR_OBJECT_ARRAY* array);
PyObject* convert_dictionary_to_python(
YR_OBJECT_DICTIONARY* dictionary);
if (dict == NULL) PyObject* convert_object_to_python(
return dict; YR_OBJECT* object)
{
SIZED_STRING* sized_string;
PyObject* result = NULL;
module_member = module_structure->members; if (object == NULL)
while (module_member) return NULL;
switch(object->type)
{ {
object = NULL; case OBJECT_TYPE_INTEGER:
module_object = (YR_OBJECT*) module_member->object; if (((YR_OBJECT_INTEGER*) object)->value != UNDEFINED)
result = Py_BuildValue(
"i", ((YR_OBJECT_INTEGER*) object)->value);
break;
switch(module_object->type) case OBJECT_TYPE_STRING:
{ sized_string = ((YR_OBJECT_STRING*) object)->value;
case OBJECT_TYPE_INTEGER: if (sized_string != NULL)
if (((YR_OBJECT_INTEGER*) module_object)->value == UNDEFINED) result = PyBytes_FromStringAndSize(
break; sized_string->c_string, sized_string->length);
break;
object = Py_BuildValue("i", case OBJECT_TYPE_STRUCTURE:
((YR_OBJECT_INTEGER*) module_object)->value); result = convert_structure_to_python((YR_OBJECT_STRUCTURE*) object);
break; break;
case OBJECT_TYPE_STRING:
sz = ((YR_OBJECT_STRING*) module_object)->value;
if (sz == NULL)
break;
object = PyBytes_FromStringAndSize(sz->c_string, sz->length); case OBJECT_TYPE_ARRAY:
break; result = convert_array_to_python((YR_OBJECT_ARRAY*) object);
case OBJECT_TYPE_STRUCTURE: break;
object = handle_module_data((YR_OBJECT_STRUCTURE*) module_object);
break; case OBJECT_TYPE_FUNCTION:
case OBJECT_TYPE_ARRAY: // Do nothing with functions...
if (((YR_OBJECT_ARRAY*) module_object)->items == NULL) break;
break;
object = handle_module_list((YR_OBJECT_ARRAY*) module_object); case OBJECT_TYPE_REGEXP:
break; // Fairly certain you can't have these. :)
case OBJECT_TYPE_FUNCTION: break;
// Do nothing with functions...
break;
case OBJECT_TYPE_REGEXP:
// Fairly certain you can't have these. :)
break;
case OBJECT_TYPE_DICTIONARY:
object = handle_module_dictionary((YR_OBJECT_DICTIONARY*) module_object);
break;
case OBJECT_TYPE_FLOAT:
if (((YR_OBJECT_DOUBLE*) module_object)->value == UNDEFINED)
break;
object = Py_BuildValue("d", ((YR_OBJECT_DOUBLE*) module_object)->value); case OBJECT_TYPE_DICTIONARY:
break; result = convert_dictionary_to_python((YR_OBJECT_DICTIONARY*) object);
default: break;
break;
}
if (object != NULL) case OBJECT_TYPE_FLOAT:
{ if (!isnan(((YR_OBJECT_DOUBLE*) object)->value))
PyDict_SetItemString(dict, module_object->identifier, object); result = Py_BuildValue("d", ((YR_OBJECT_DOUBLE*) object)->value);
Py_DECREF(object); break;
}
module_member = module_member->next; default:
break;
} }
return dict; return result;
} }
PyObject* handle_module_list(YR_OBJECT_ARRAY* array_object) PyObject* convert_structure_to_python(
YR_OBJECT_STRUCTURE* structure)
{ {
int i; YR_STRUCTURE_MEMBER* member;
YR_OBJECT* item;
SIZED_STRING* sz;
PyObject* object;
PyObject* list = PyList_New(0);
if (list == NULL) PyObject* py_object;
return list; PyObject* py_dict = PyDict_New();
// If there is nothing in the list, return an empty Python list if (py_dict == NULL)
if (array_object->items == NULL) return py_dict;
return list;
for (i = 0; i < array_object->items->count; i++) member = structure->members;
{
object = NULL;
item = array_object->items->objects[i];
if (item == NULL) while (member != NULL)
continue; {
py_object = convert_object_to_python(member->object);
switch(array_object->prototype_item->type) if (py_object != NULL)
{ {
case OBJECT_TYPE_INTEGER: PyDict_SetItemString(py_dict, member->object->identifier, py_object);
if (((YR_OBJECT_INTEGER*) item)->value == UNDEFINED) Py_DECREF(py_object);
break;
object = Py_BuildValue("i", ((YR_OBJECT_INTEGER*) item)->value);
break;
case OBJECT_TYPE_STRING:
if (((YR_OBJECT_STRING*) item)->value == NULL)
break;
sz = ((YR_OBJECT_STRING*) item)->value;
object = PyBytes_FromStringAndSize(sz->c_string, sz->length);
break;
case OBJECT_TYPE_STRUCTURE:
object = handle_module_data((YR_OBJECT_STRUCTURE*) item);
break;
case OBJECT_TYPE_FLOAT:
if (((YR_OBJECT_DOUBLE*) item)->value == UNDEFINED)
break;
object = Py_BuildValue("d", ((YR_OBJECT_DOUBLE*) item)->value);
break;
default:
break;
} }
// object can be NULL because handle_module_data() can return NULL. member =member->next;
if (object != NULL)
{
PyList_Append(list, object);
Py_DECREF(object);
}
} }
return list; return py_dict;
} }
PyObject* handle_module_dictionary(YR_OBJECT_DICTIONARY* dictionary_object) PyObject* convert_array_to_python(
YR_OBJECT_ARRAY* array)
{ {
int i; int i;
YR_OBJECT* item;
SIZED_STRING* sz;
PyObject* object;
PyObject* dict = PyDict_New();
if (dict == NULL) PyObject* py_object;
return dict; PyObject* py_list = PyList_New(0);
// If there is nothing in the YARA dictionary, return an empty Python dict if (py_list == NULL)
if (dictionary_object->items == NULL) return py_list;
return dict;
for (i = 0; i < dictionary_object->items->used; i++) // If there is nothing in the list, return an empty Python list
if (array->items == NULL)
return py_list;
for (i = 0; i < array->items->count; i++)
{ {
object = NULL; py_object = convert_object_to_python(array->items->objects[i]);
if (dictionary_object->items->objects + i == NULL) if (py_object != NULL)
continue; {
PyList_Append(py_list, py_object);
Py_DECREF(py_object);
}
}
item = dictionary_object->items->objects[i].obj; return py_list;
}
if (item == NULL)
continue;
switch(dictionary_object->prototype_item->type) PyObject* convert_dictionary_to_python(
{ YR_OBJECT_DICTIONARY* dictionary)
case OBJECT_TYPE_INTEGER: {
if (((YR_OBJECT_INTEGER*) item)->value == UNDEFINED) int i;
break;
object = Py_BuildValue("i", ((YR_OBJECT_INTEGER*) item)->value); PyObject* py_object;
break; PyObject* py_dict = PyDict_New();
case OBJECT_TYPE_STRING:
if (((YR_OBJECT_STRING*) item)->value == NULL)
break;
sz = ((YR_OBJECT_STRING*) item)->value; if (py_dict == NULL)
object = PyBytes_FromStringAndSize(sz->c_string, sz->length); return py_dict;
break;
case OBJECT_TYPE_STRUCTURE:
object = handle_module_data((YR_OBJECT_STRUCTURE*) item);
break;
case OBJECT_TYPE_FLOAT:
if (((YR_OBJECT_DOUBLE*) item)->value == UNDEFINED)
break;
object = Py_BuildValue("d", ((YR_OBJECT_DOUBLE*) item)->value); // If there is nothing in the YARA dictionary, return an empty Python dict
break; if (dictionary->items == NULL)
default: return py_dict;
break;
} for (i = 0; i < dictionary->items->used; i++)
{
py_object = convert_object_to_python(dictionary->items->objects[i].obj);
// object can be NULL if the value is UNDEFINED if (py_object != NULL)
if (object != NULL)
{ {
PyDict_SetItemString(dict, PyDict_SetItemString(
dictionary_object->items->objects[i].key, py_dict,
object); dictionary->items->objects[i].key,
Py_DECREF(object); py_object);
Py_DECREF(py_object);
} }
} }
return dict; return py_dict;
} }
...@@ -689,7 +639,9 @@ int yara_callback( ...@@ -689,7 +639,9 @@ int yara_callback(
if (message == CALLBACK_MSG_MODULE_IMPORTED) if (message == CALLBACK_MSG_MODULE_IMPORTED)
{ {
gil_state = PyGILState_Ensure(); gil_state = PyGILState_Ensure();
module_info_dict = handle_module_data((YR_OBJECT_STRUCTURE*) message_data);
module_info_dict = convert_structure_to_python(
(YR_OBJECT_STRUCTURE*) message_data);
if (module_info_dict == NULL) if (module_info_dict == NULL)
return CALLBACK_CONTINUE; return CALLBACK_CONTINUE;
...@@ -699,6 +651,7 @@ int yara_callback( ...@@ -699,6 +651,7 @@ int yara_callback(
Py_DECREF(object); Py_DECREF(object);
Py_INCREF(modules_callback); Py_INCREF(modules_callback);
callback_result = PyObject_CallFunctionObjArgs( callback_result = PyObject_CallFunctionObjArgs(
modules_callback, modules_callback,
module_info_dict, module_info_dict,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment