-
Notifications
You must be signed in to change notification settings - Fork 228
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
plugins/device_tree: Use
AnalysisPluginV0
Version bumped because unknown-model is now also part of the summary.
- Loading branch information
Showing
3 changed files
with
75 additions
and
56 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,38 +1,73 @@ | ||
from analysis.PluginBase import AnalysisBasePlugin | ||
import io | ||
|
||
import pydantic | ||
|
||
from helperFunctions.tag import TagColor | ||
from objects.file import FileObject | ||
from plugins.mime_blacklists import MIME_BLACKLIST_COMPRESSED | ||
from analysis.plugin.compat import AnalysisBasePluginAdapterMixin | ||
from analysis.plugin import AnalysisPluginV0, Tag | ||
from typing import Optional, List, Dict | ||
|
||
from ..internal.device_tree_utils import dump_device_trees | ||
|
||
|
||
class AnalysisPlugin(AnalysisBasePlugin): | ||
""" | ||
Device Tree Plug-in | ||
""" | ||
|
||
NAME = 'device_tree' | ||
DESCRIPTION = 'get the device tree in text from the device tree blob' | ||
VERSION = '1.0.1' | ||
MIME_BLACKLIST = [*MIME_BLACKLIST_COMPRESSED, 'audio', 'image', 'video'] # noqa: RUF012 | ||
FILE = __file__ | ||
|
||
def process_object(self, file_object: FileObject): | ||
file_object.processed_analysis[self.NAME] = {'summary': []} | ||
|
||
device_trees = dump_device_trees(file_object.binary) | ||
if device_trees: | ||
file_object.processed_analysis[self.NAME]['device_trees'] = device_trees | ||
for result in device_trees: | ||
model = result.get('model') | ||
if model: | ||
file_object.processed_analysis[self.NAME]['summary'].append(model) | ||
self.add_analysis_tag( | ||
file_object=file_object, | ||
tag_name=self.NAME, | ||
value=self.NAME.replace('_', ' '), | ||
color=TagColor.ORANGE, | ||
propagate=False, | ||
) | ||
class AnalysisPlugin(AnalysisPluginV0, AnalysisBasePluginAdapterMixin): | ||
class Schema(pydantic.BaseModel): | ||
class DeviceTree(pydantic.BaseModel): | ||
header: Optional[dict] | ||
device_tree: Optional[str] | ||
model: Optional[str] | ||
description: Optional[str] | ||
offset: int | ||
|
||
#: A list of device trees | ||
device_trees: List[DeviceTree] | ||
|
||
def __init__(self): | ||
metadata = AnalysisPluginV0.MetaData( | ||
name='device_tree', | ||
description='get the device tree in text from the device tree blob', | ||
version='1.1.0', | ||
system_version=None, | ||
dependencies=[], | ||
mime_blacklist=[*MIME_BLACKLIST_COMPRESSED, 'audio', 'image', 'video'], | ||
mime_whitelist=[], | ||
timeout=10, | ||
Schema=AnalysisPlugin.Schema, | ||
) | ||
super().__init__(metadata=metadata) | ||
|
||
return file_object | ||
def summarize(self, result: Schema): | ||
models = [] | ||
for device_tree in result.device_trees: | ||
model = device_tree.model | ||
if not model: | ||
continue | ||
models.append(model) | ||
|
||
if not models: | ||
return ['unknown-model'] | ||
|
||
return models | ||
|
||
def analyze( | ||
self, | ||
file_handle: io.FileIO, | ||
virtual_file_path: dict, | ||
analyses: Dict[str, dict], | ||
) -> Optional[Schema]: | ||
del virtual_file_path, analyses | ||
device_trees = dump_device_trees(file_handle.readall()) | ||
if len(device_trees) == 0: | ||
return None | ||
return AnalysisPlugin.Schema(device_trees=device_trees) | ||
|
||
def get_tags(self, result, summary): | ||
del result, summary | ||
return [ | ||
Tag( | ||
name=self.metadata.name, | ||
value='device tree', | ||
color=TagColor.ORANGE, | ||
), | ||
] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters