Compare two analysis #117

bazaar/core/utils.py

@@ -22,7 +22,6 @@
 from scipy.spatial.distance import pdist
 import pandas as pd
 
-
 def get_sha256_of_file_path(file_path):
     sha256_hash = hashlib.sha256()
     with open(file_path, "rb") as f:
@@ -240,7 +239,7 @@ def get_matching_items_by_ssdeep(ssdeep_value, threshold_grade, index, sha256):
     return sha256_list_to_return
 
 
-def get_matching_items_by_ssdeep_func(ssdeep_value, threshold_grade, index, sha256):
+def get_matching_items_by_ssdeep_func(ssdeep_value, threshold_grade, index):
     chunksize, chunk, double_chunk = ssdeep_value.split(':')
     chunksize = int(chunksize)
     es = Elasticsearch(settings.ELASTICSEARCH_HOSTS)

bazaar/front/forms.py

@@ -48,7 +48,7 @@ def do_search(self, sha=''):
             if algorithm == 'ssdeep':
                 results = get_matching_items_by_ssdeep(hash, 25, settings.ELASTICSEARCH_SSDEEP_APK_INDEX, sha)
             if algorithm == 'func_hash':
-                results = get_matching_items_by_ssdeep_func(hash, 25, settings.ELASTICSEARCH_APK_INDEX, sha)
+                results = get_matching_items_by_ssdeep_func(hash, 25, settings.ELASTICSEARCH_APK_INDEX)
 
         except Exception as e:
             print(e)
@@ -114,3 +114,85 @@ class YaraCreateForm(ModelForm):
     class Meta:
         model = Yara
         fields = ['title', 'content', 'is_private']
+
+
+class CompareSearchForm(forms.Form):
+    left_sha = forms.CharField()
+    right_sha = forms.CharField()
+
+    def do_search(self):
+        shas = []
+        shas.append(self['left_sha'].value())
+        shas.append(self['right_sha'].value())
+
+        results = []
+        for sha in shas:
+            query = {
+                "query": {
+                    "query_string": {
+                        "default_field": "sha256",
+                        "query": sha,
+                    }
+                },
+                "highlight": {
+                    "fields": {
+                        "*": {"pre_tags": ["<mark>"], "post_tags": ["</mark>"]}
+                    }
+                },
+                "aggs": {
+                    "permissions": {
+                        "terms": {"field": "permissions.keyword"}
+                    },
+                    "domains": {
+                        "terms": {"field": "domains_analysis._name.keyword"}
+                    },
+                    "android_features": {
+                        "terms": {"field": "features.keyword"}
+                    }
+                },
+                "sort": {"analysis_date": "desc"},
+                "_source": [
+                    "uaid",
+                    "signatures",
+                    "is_signed",
+                    "is_signed_v1",
+                    "is_signed_v2",
+                    "is_signed_v3",
+                    "certificates",
+                    "dexofuzzy",
+                    "apkid",
+                    "manifest_analysis",
+                    "browsable_activities",
+                    "niap_analysis",
+                    "code_analysis",
+                    "detailed_permissions",
+                    "trackers",
+                    "quark.crimes",
+                    "android_api_analysis",
+                    "ssdeep",
+                    "version_name",
+                    "apk_hash",
+                    "app_name", 
+                    "dexofuzzy.apk", 
+                    "features"
+                    "frosting_data.is_frosted", 
+                    "handle", 
+                    "is_signed", 
+                    "md5", 
+                    "quark.threat_level", 
+                    "sha1", 
+                    "sha256", 
+                    "size", 
+                    "uploaded_at", 
+                    "version_code", 
+                    ],
+                "size": 1,
+            }
+            es = Elasticsearch(settings.ELASTICSEARCH_HOSTS)
+            try:
+                raw_results = es.search(index=settings.ELASTICSEARCH_APK_INDEX, body=query)
+                results.append(transform_hl_results(raw_results))
+            except Exception as e:
+                return []
+
+        return results

bazaar/front/urls.py

@@ -3,7 +3,7 @@
 
 from bazaar.front.view import HomeView, ReportView, basic_upload_view, similarity_search_view, export_report_view, \
     download_sample_view, my_rules_view, my_rule_edit_view, my_rule_create_view, my_rule_delete_view, og_card_view, \
-    my_retrohunt_view, get_andgrocfg_code, get_genom, basic_url_download_view
+    my_retrohunt_view, get_andgrocfg_code, get_genom, basic_url_download_view, compare_analysis_view
 
 app_name = "front"
 urlpatterns = [
@@ -23,5 +23,6 @@
     path("rules/<str:uuid>/delete", view=my_rule_delete_view, name="my_rule_delete"),
     path("rules/<str:uuid>/retro", view=my_retrohunt_view, name="my_rule_retro"),
     path("androcfg/<str:sha256>/<path:foo>", view=get_andgrocfg_code, name="get_andgrocfg_code"),
-    path("androcfg/all", view=get_genom, name="get_genom")
+    path("androcfg/all", view=get_genom, name="get_genom"),
+    path("compare/", view=compare_analysis_view, name="compare_analysis")
 ]

bazaar/front/view.py

@@ -30,7 +30,7 @@
 from bazaar.core.models import Yara
 from bazaar.core.tasks import analyze, retrohunt
 from bazaar.core.utils import get_sha256_of_file, get_matching_items_by_dexofuzzy
-from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, BasicUrlDownloadForm
+from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, BasicUrlDownloadForm, CompareSearchForm
 from bazaar.front.og import generate_og_card
 from bazaar.front.utils import transform_results, get_similarity_matrix, compute_status, generate_world_map, \
     transform_hl_results, get_sample_timeline, get_andro_cfg_storage_path
@@ -511,3 +511,22 @@ def get_genom(request):
     response = HttpResponse('\n'.join(entire_genom), content_type='text/csv')
     response['Content-Disposition'] = f'inline; filename=pithus_genom.csv'
     return response
+
+def compare_analysis_view(request, *args, **kwargs):
+    if request.method == 'GET':
+        f = CompareSearchForm(request.GET)
+
+        res = []
+        left_res = None
+        right_res = None
+        if f.is_valid:
+            res = f.do_search()
+            if res:
+                left_res = res[0][0]['source']
+                right_res = res[1][0]['source']
+            else:
+                return render(request, 'front/compare_analysis.html')
+
+        print(res)
+        return render(request, 'front/compare_analysis.html', context={'left_analysis': left_res, 'right_analysis': right_res})
+