From eddd441a74407bfd1cb5a53f21a3bd5e5b2baac7 Mon Sep 17 00:00:00 2001 From: evilcel3ri Date: Fri, 24 Mar 2023 13:16:09 +0100 Subject: [PATCH 01/13] Removing sha for dexo_func + adding |safe to dexofuzzy_hash --- bazaar/core/services/search.py | 2 +- bazaar/core/utils.py | 2 +- bazaar/templates/front/report/m_androcfg.html | 27 +++++++++++++++++++ 3 files changed, 29 insertions(+), 2 deletions(-) diff --git a/bazaar/core/services/search.py b/bazaar/core/services/search.py index e84861f..91f78c9 100644 --- a/bazaar/core/services/search.py +++ b/bazaar/core/services/search.py @@ -87,7 +87,7 @@ def similarity_search(search_hash, algorithm, ignore_sha=''): ) case 'func_hash': results = get_matching_items_by_ssdeep_func( - search_hash, 25, settings.ELASTICSEARCH_APK_INDEX, ignore_sha + search_hash, 25, settings.ELASTICSEARCH_APK_INDEX ) except Exception as e: logging.error(e) diff --git a/bazaar/core/utils.py b/bazaar/core/utils.py index 7d0e07c..3a58925 100644 --- a/bazaar/core/utils.py +++ b/bazaar/core/utils.py @@ -306,7 +306,7 @@ def get_matching_items_by_ssdeep(ssdeep_value, threshold_grade, index, sha256): return sha256_list_to_return -def get_matching_items_by_ssdeep_func(ssdeep_value, threshold_grade, index, sha256): +def get_matching_items_by_ssdeep_func(ssdeep_value, threshold_grade, index): chunksize, chunk, double_chunk = ssdeep_value.split(':') chunksize = int(chunksize) es = Elasticsearch( diff --git a/bazaar/templates/front/report/m_androcfg.html b/bazaar/templates/front/report/m_androcfg.html index e0dc2d2..265ad14 100644 --- a/bazaar/templates/front/report/m_androcfg.html +++ b/bazaar/templates/front/report/m_androcfg.html @@ -1,6 +1,7 @@ {% if andro_cfg %}

Control flow graphs analysis

+<<<<<<< HEAD

Information computed by Pithus.

@@ -20,6 +21,32 @@

{{ r.rule.title }}

{% endfor %} +======= + {% for r in andro_cfg.rules %} +
+
+

{{ r.rule.title }}

+
+
+ +
+ {% if r.cfg_file %} +
+ + + +>>>>>>> 8f7c8db (Removing sha for dexo_func + adding |safe to dexofuzzy_hash)
{% if r.cfg_file %}
From a9951eb792c702eacfc9d18cbe6a308ab337a369 Mon Sep 17 00:00:00 2001 From: evilcel3ri Date: Mon, 27 Mar 2023 16:42:22 +0200 Subject: [PATCH 02/13] final fix --- bazaar/core/utils.py | 1 - bazaar/templates/front/report/m_androcfg.html | 6 +++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/bazaar/core/utils.py b/bazaar/core/utils.py index 3a58925..2bfa88a 100644 --- a/bazaar/core/utils.py +++ b/bazaar/core/utils.py @@ -39,7 +39,6 @@ def compute_status(status): 'running': running } - def get_sha256_of_file_path(file_path): sha256_hash = hashlib.sha256() with open(file_path, "rb") as f: diff --git a/bazaar/templates/front/report/m_androcfg.html b/bazaar/templates/front/report/m_androcfg.html index 265ad14..7f5f46f 100644 --- a/bazaar/templates/front/report/m_androcfg.html +++ b/bazaar/templates/front/report/m_androcfg.html @@ -32,9 +32,9 @@

{{ r.rule.title }}

{% for f in r.findings %}
  • {{f.call_by}} - - + href="{% url "front:get_andgrocfg_code" sha256 f.evidence_file %}">{{f.call_by}} + +
    • {% endfor %} From be150ba87a52030c4e98a507fa49666777d6a475 Mon Sep 17 00:00:00 2001 From: evilcel3ri Date: Wed, 29 Mar 2023 16:53:52 +0200 Subject: [PATCH 03/13] Boiler plate compare --- bazaar/front/urls.py | 5 ++-- bazaar/front/view.py | 13 ++++++++++ bazaar/templates/front/compare_analysis.html | 25 ++++++++++++++++++++ 3 files changed, 41 insertions(+), 2 deletions(-) create mode 100644 bazaar/templates/front/compare_analysis.html diff --git a/bazaar/front/urls.py b/bazaar/front/urls.py index febe0b6..702b204 100644 --- a/bazaar/front/urls.py +++ b/bazaar/front/urls.py @@ -5,7 +5,7 @@ download_sample_view, my_rule_edit_view, my_rule_create_view, my_rule_delete_view, og_card_view, \ my_retrohunt_view, get_andgrocfg_code, get_genom, basic_url_download_view, report_status_view, instance_status, \ remove_bookmark_sample_view, add_bookmark_sample_view, workspace_view, add_comment_view, delete_comment_view, \ - notifications_view, notification_delete_view, dl_hidden + notifications_view, notification_delete_view, dl_hidden, compare_analysis_view app_name = "front" urlpatterns = [ @@ -36,5 +36,6 @@ path("comment//add", view=add_comment_view, name="add_comment"), path("comment//delete", view=delete_comment_view, name="delete_comment"), path("notifications", view=notifications_view, name="notifications_url"), - path("notifications//delete", view=notification_delete_view, name="notifications_url") + path("notifications//delete", view=notification_delete_view, name="notifications_url"), + path("compare//to/", view=compare_analysis_view, name="compare_analysis") ] diff --git a/bazaar/front/view.py b/bazaar/front/view.py index 480527c..4dac401 100644 --- a/bazaar/front/view.py +++ b/bazaar/front/view.py @@ -853,3 +853,16 @@ def get_genom(request): def instance_status(request): return render(request, 'front/instance_status.html') + + +def compare_analysis_view(request, left_sha, right_sha): + es = Elasticsearch(settings.ELASTICSEARCH_HOSTS) + + try: + left_result = es.get(index=settings.ELASTICSEARCH_APK_INDEX, id=left_sha)['_source'] + right_result = es.get(index=settings.ELASTICSEARCH_APK_INDEX, id=right_sha)['_source'] + except Exception as e: + logging.exception(e) + return redirect(reverse_lazy('front:home')) + + return render(request, 'front/compare_analysis.html', context={'left_analysis': left_result, 'right_analysis': right_result}) diff --git a/bazaar/templates/front/compare_analysis.html b/bazaar/templates/front/compare_analysis.html new file mode 100644 index 0000000..34b5bbe --- /dev/null +++ b/bazaar/templates/front/compare_analysis.html @@ -0,0 +1,25 @@ +{% extends "base.html" %} +{% load static %} +{% load crispy_forms_tags %} + +{% block whole_content %} +
    +
    +
    +
    +

    Compare two analysis

    +
    + +
    + it works +
    +
    + +
    + {{left_analysis }} +
    + + +
    +
    +{% endblock whole_content %} \ No newline at end of file From b6a795b39160eb4ce3d011eb3d8dda02f3211158 Mon Sep 17 00:00:00 2001 From: evilcel3ri Date: Thu, 30 Mar 2023 16:26:13 +0200 Subject: [PATCH 04/13] save --- bazaar/templates/front/compare_analysis.html | 276 ++++++++++++++++++- 1 file changed, 270 insertions(+), 6 deletions(-) diff --git a/bazaar/templates/front/compare_analysis.html b/bazaar/templates/front/compare_analysis.html index 34b5bbe..53ed5b8 100644 --- a/bazaar/templates/front/compare_analysis.html +++ b/bazaar/templates/front/compare_analysis.html @@ -14,12 +14,276 @@

    Compare two analysis

    it works
    - -
    - {{left_analysis }} -
    - -
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + {% for p in left_analysis.apkid|dictsort:"filename" %} + + {% for p in right_analysis.apkid|dictsort:"filename" %} + + + + + + + + + + + + + + + + + +
    Left APK (report)Right APK (report)
    +

    Handle

    +     		+

    {{ left_analysis.handle }}

    +     		+

    {{ right_analysis.handle }}

    +
    +

    App name

    +     		{{left_analysis.app_name}}{{right_analysis.app_name}}
    MD5{{left_analysis.md5}}{{right_analysis.md5}}
    SHA1{{left_analysis.sha1}}{{right_analysis.sha1}}
    SHA256{{left_analysis.sha256}}{{right_analysis.sha256}}
    Size{{left_analysis.size}}{{right_analysis.size}}
    Frosting data + {% if left_analysis.frosting_data.is_frosted %} + Frosted + {% else %} + Not frosted + {% endif %} + {% if d.frosting_data.v2_signature_blocks|length > 0 %} +
    + Blocks found within V2 signature: +
      + {% for elt in d.frosting_data.v2_signature_blocks %} +
    • {{ elt.value }}: {{ elt.comment }}
      • + {% endfor %} +
    + {% endif %} +
    		+ {% if right_analysis.frosting_data.is_frosted %} + Frosted + {% else %} + Not frosted + {% endif %} + {% if d.frosting_data.v2_signature_blocks|length > 0 %} +
    + Blocks found within V2 signature: +
      + {% for elt in d.frosting_data.v2_signature_blocks %} +
    • {{ elt.value }}: {{ elt.comment }}
      • + {% endfor %} +
    + {% endif %} +
    +

    Main activity

    +     		+

    {{left_analysis.main_activity}}

    +     		+

    {{right_analysis.main_activity}}

    +
    +

    Activities

    +     		+
      + {% for activity in left_analysis.activities %} +
    • + 
      {{activity}}
      +
      • + {% endfor %} +
    +     		+
      + {% for activity in right_analysis.activities %} +
    • + 
      {{activity}}
      +
      • + {% endfor %} +
    +
    Receivers + 
    {% for s in left_analysis.receivers %}{{ s }}
    {% endfor %}
    +     		+ 
    {% for s in right_analysis.receivers %}{{ s }}
    {% endfor %}
    +
    Services + 
    {% for s in left_analysis.services %}{{ s }}
    {% endfor %}
    +     		+ 
    {% for s in right_analysis.services %}{{ s }}
    {% endfor %}
    +
    APKiD{{ p.filename }} + {% for k, v in p.matches.items %} + {{ k }} +
      + {% for c in v %} +
    • {{ c }}
      • + {% endfor %} +
    + {% endfor %} + {% endfor %} +     		{{ p.filename }} + {% for k, v in p.matches.items %} + {{ k }} +
      + {% for c in v %} +
    • {{ c }}
      • + {% endfor %} +
    + {% endfor %} + {% endfor %} +
    Certificate + {% for c in left_analysis.certificates %} +
      +
    • {{ c.fingerprint_md5 }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_md5 %} + + + +
      • +
    • {{ c.fingerprint_sha1 }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_sha1 %} + + + +
      • +
    • {{ c.fingerprint_sha256 }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_sha256 %} + + + +
      • +
    • {{ c.issuer }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.issuer %}
      • +
    • {{ c.not_before }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.not_before %} +
      • +
    • {{ c.not_after }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.not_after %} +
      • + {% endfor %} +
    +     		+ {% for c in right_analysis.certificates %} +
      +
    • {{ c.fingerprint_md5 }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_md5 %} + + + +
      • +
    • {{ c.fingerprint_sha1 }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_sha1 %} + + + +
      • +
    • {{ c.fingerprint_sha256 }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_sha256 %} + + + +
      • +
    • {{ c.issuer }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.issuer %}
      • +
    • {{ c.not_before }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.not_before %} +
      • +
    • {{ c.not_after }} + {% include "front/report/m_copy_to_clipboard.html" with data=c.not_after %} +
      • + {% endfor %} +
    +
    +

    Permissions

    +     		+
      + {% for permission in left_analysis.permissions %} +
    • {{permission}}
      • + {% endfor %} +
    +     		+
      + {% for permission in right_analysis.permissions %} +
    • {{permission}}
      • + {% endfor %} +
    +
    +{{left_analysis}} + + {% endblock whole_content %} \ No newline at end of file From 4a877a6105e2b3788f1ee91dca6436a12e55a301 Mon Sep 17 00:00:00 2001 From: evilcel3ri Date: Fri, 31 Mar 2023 18:10:07 +0200 Subject: [PATCH 05/13] save --- bazaar/front/forms.py | 47 ++ bazaar/front/urls.py | 4 + bazaar/front/view.py | 24 +- bazaar/templates/front/compare_analysis.html | 473 ++++++++----------- 4 files changed, 272 insertions(+), 276 deletions(-) diff --git a/bazaar/front/forms.py b/bazaar/front/forms.py index 345c090..77f51e4 100644 --- a/bazaar/front/forms.py +++ b/bazaar/front/forms.py @@ -63,3 +63,50 @@ class Meta: "rows": 5, }), } + + +class CompareSearchForm(forms.Form): + left_hash = forms.CharField() + right_hash = forms.CharField() + + def do_search(self): + print(self.cleaned_data['left_hash']) + left_hash = self.cleaned_data['left_hash'] + + results = None + query = { + "query": { + "query_string": { + "default_field": "sha256", + "query": left_hash, + } + }, + "highlight": { + "fields": { + "*": {"pre_tags": [""], "post_tags": [""]} + } + }, + "aggs": { + "permissions": { + "terms": {"field": "permissions.keyword"} + }, + "domains": { + "terms": {"field": "domains_analysis._name.keyword"} + }, + "android_features": { + "terms": {"field": "features.keyword"} + } + }, + "sort": {"analysis_date": "desc"}, + "_source": ["apk_hash", "sha256", "uploaded_at", "icon_base64", "handle", "app_name", + "version_code", "size", "dexofuzzy.apk", "quark.threat_level", "vt", "is_signed", "frosting_data.is_frosted", "features"], + "size": 50, + } + es = Elasticsearch(settings.ELASTICSEARCH_HOSTS) + try: + raw_results = es.search(index=settings.ELASTICSEARCH_APK_INDEX, body=query) + results = transform_hl_results(raw_results) + except Exception as e: + return [], [], None + + return results diff --git a/bazaar/front/urls.py b/bazaar/front/urls.py index 702b204..104bd10 100644 --- a/bazaar/front/urls.py +++ b/bazaar/front/urls.py @@ -30,6 +30,7 @@ path("similar/", view=similarity_search_view, name="similarity_search"), path("androcfg//", view=get_andgrocfg_code, name="get_andgrocfg_code"), path("androcfg/all", view=get_genom, name="get_genom"), +<<<<<<< HEAD path("status", view=instance_status, name="instance_status"), path("url/", view=basic_url_download_view, name="basic_url_download"), path("workspace/", view=workspace_view, name="workspace"), @@ -37,5 +38,8 @@ path("comment//delete", view=delete_comment_view, name="delete_comment"), path("notifications", view=notifications_view, name="notifications_url"), path("notifications//delete", view=notification_delete_view, name="notifications_url"), +======= + path("compare/", view=compare_analysis_view, name="compare_analysis"), +>>>>>>> 3ca8256 (save) path("compare//to/", view=compare_analysis_view, name="compare_analysis") ] diff --git a/bazaar/front/view.py b/bazaar/front/view.py index 4dac401..4b87fa3 100644 --- a/bazaar/front/view.py +++ b/bazaar/front/view.py @@ -31,10 +31,17 @@ from bazaar.core.services import GenomService from bazaar.core.services import NotificationsService +<<<<<<< HEAD from bazaar.core.models import Yara, Bookmark, Comment, Notification from bazaar.core.modules.pithus import retrohunt from bazaar.core.utils import get_matching_items_by_dexofuzzy from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, BasicUrlDownloadForm, CommentForm +======= +from bazaar.core.models import Yara +from bazaar.core.tasks import analyze, retrohunt +from bazaar.core.utils import get_sha256_of_file, get_matching_items_by_dexofuzzy +from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, BasicUrlDownloadForm, CompareSearchForm +>>>>>>> 3ca8256 (save) from bazaar.front.og import generate_og_card from bazaar.front.utils import get_similarity_matrix, generate_world_map, \ get_sample_timeline, get_andro_cfg_storage_path @@ -855,14 +862,13 @@ def instance_status(request): return render(request, 'front/instance_status.html') -def compare_analysis_view(request, left_sha, right_sha): - es = Elasticsearch(settings.ELASTICSEARCH_HOSTS) +def compare_analysis_view(request, *args, **kwargs): + if request.method == 'GET': + # print(request.__dict__) - try: - left_result = es.get(index=settings.ELASTICSEARCH_APK_INDEX, id=left_sha)['_source'] - right_result = es.get(index=settings.ELASTICSEARCH_APK_INDEX, id=right_sha)['_source'] - except Exception as e: - logging.exception(e) - return redirect(reverse_lazy('front:home')) + f = CompareSearchForm(request.GET) + print(f) - return render(request, 'front/compare_analysis.html', context={'left_analysis': left_result, 'right_analysis': right_result}) + left_result = "" + right_result = "" + return render(request, 'front/compare_analysis.html', context={'left_analysis': left_result, 'right_analysis': right_result}) diff --git a/bazaar/templates/front/compare_analysis.html b/bazaar/templates/front/compare_analysis.html index 53ed5b8..31bea07 100644 --- a/bazaar/templates/front/compare_analysis.html +++ b/bazaar/templates/front/compare_analysis.html @@ -1,289 +1,228 @@ {% extends "base.html" %} {% load static %} {% load crispy_forms_tags %} +{% load get %} +{% load comma_to_br %} {% block whole_content %} -
    -
    +
    +

    Compare two analysis

    - it works +
    +
    +
    +
    + +
    +
    +
    +
    + +
    +
    +
    + +
    +
    +
    - -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - {% for p in left_analysis.apkid|dictsort:"filename" %} - - {% for p in right_analysis.apkid|dictsort:"filename" %} - - - - - - - + {% if left_analysis and right_analysis %} +
    Left APK (report)Right APK (report)
    -

    Handle

    -     		-

    {{ left_analysis.handle }}

    -     		-

    {{ right_analysis.handle }}

    -
    -

    App name

    -     		{{left_analysis.app_name}}{{right_analysis.app_name}}
    MD5{{left_analysis.md5}}{{right_analysis.md5}}
    SHA1{{left_analysis.sha1}}{{right_analysis.sha1}}
    SHA256{{left_analysis.sha256}}{{right_analysis.sha256}}
    Size{{left_analysis.size}}{{right_analysis.size}}
    Frosting data - {% if left_analysis.frosting_data.is_frosted %} - Frosted - {% else %} - Not frosted - {% endif %} - {% if d.frosting_data.v2_signature_blocks|length > 0 %} -
    - Blocks found within V2 signature: -
      - {% for elt in d.frosting_data.v2_signature_blocks %} -
    • {{ elt.value }}: {{ elt.comment }}
      • - {% endfor %} -
    - {% endif %} -
    		- {% if right_analysis.frosting_data.is_frosted %} - Frosted - {% else %} - Not frosted - {% endif %} - {% if d.frosting_data.v2_signature_blocks|length > 0 %} -
    - Blocks found within V2 signature: -
      - {% for elt in d.frosting_data.v2_signature_blocks %} -
    • {{ elt.value }}: {{ elt.comment }}
      • - {% endfor %} -
    - {% endif %} -
    -

    Main activity

    -     		-

    {{left_analysis.main_activity}}

    -     		-

    {{right_analysis.main_activity}}

    -
    -

    Activities

    -     		-
      - {% for activity in left_analysis.activities %} -
    • - 
      {{activity}}
      -
      • - {% endfor %} -
    -     		-
      - {% for activity in right_analysis.activities %} -
    • - 
      {{activity}}
      -
      • - {% endfor %} -
    -
    Receivers - 
    {% for s in left_analysis.receivers %}{{ s }}
    {% endfor %}
    -     		- 
    {% for s in right_analysis.receivers %}{{ s }}
    {% endfor %}
    -
    Services - 
    {% for s in left_analysis.services %}{{ s }}
    {% endfor %}
    -     		- 
    {% for s in right_analysis.services %}{{ s }}
    {% endfor %}
    -
    APKiD{{ p.filename }} - {% for k, v in p.matches.items %} - {{ k }} -
      - {% for c in v %} -
    • {{ c }}
      • - {% endfor %} -
    - {% endfor %} - {% endfor %} -     		{{ p.filename }} - {% for k, v in p.matches.items %} - {{ k }} -
      - {% for c in v %} -
    • {{ c }}
      • - {% endfor %} -
    - {% endfor %} - {% endfor %} -
    Certificate - {% for c in left_analysis.certificates %} -
      -
    • {{ c.fingerprint_md5 }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_md5 %} - - - -
      • -
    • {{ c.fingerprint_sha1 }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_sha1 %} - - - -
      • -
    • {{ c.fingerprint_sha256 }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_sha256 %} - - - -
      • -
    • {{ c.issuer }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.issuer %}
      • -
    • {{ c.not_before }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.not_before %} -
      • -
    • {{ c.not_after }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.not_after %} -
      • - {% endfor %} -
    -     		- {% for c in right_analysis.certificates %} -
      -
    • {{ c.fingerprint_md5 }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_md5 %} - - - -
      • -
    • {{ c.fingerprint_sha1 }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_sha1 %} - - - -
      • -
    • {{ c.fingerprint_sha256 }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.fingerprint_sha256 %} - - - -
      • -
    • {{ c.issuer }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.issuer %}
      • -
    • {{ c.not_before }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.not_before %} -
      • -
    • {{ c.not_after }} - {% include "front/report/m_copy_to_clipboard.html" with data=c.not_after %} -
      • - {% endfor %} -
    -
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - + + + + + + + + + + + + + + + - -
    Left APK (report)Right APK (report)
    +

    File sums

    +     		+ {% include "front/report/m_file.html" with d=left_analysis %} + + {% include "front/report/m_file.html" with d=right_analysis %} +
    +

    APKiD

    +

    Information computed with APKiD. +

    +     		+ {% include "front/report/m_apkid.html" with d=left_analysis %} + + {% include "front/report/m_apkid.html" with d=right_analysis %} +
    +

    APK details

    +

    Information computed with AndroGuard + and Pithus. +

    +     		+ {% include "front/report/m_apk.html" with d=left_analysis %} + + {% include "front/report/m_apk.html" with d=right_analysis %} +
    +

    Certificate

    +

    Information computed with AndroGuard. +

    +     		+ {% include "front/report/m_certificate.html" with d=left_analysis %} + + {% include "front/report/m_certificate.html" with d=left_analysis %} +
    +

    Browsable activities

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_browsable_activities.html" with d=left_analysis %} + + {% include "front/report/m_browsable_activities.html" with d=right_analysis %} +
    +

    Manifest

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_manifest.html" with d=left_analysis %} + + {% include "front/report/m_manifest.html" with d=right_analysis %} +
    -

    Permissions

    -     		-
      - {% for permission in left_analysis.permissions %} -
    • {{permission}}
      • - {% endfor %} -
    -     		-
      - {% for permission in right_analysis.permissions %} -
    • {{permission}}
      • - {% endfor %} -
    -
    +

    NIAP analysis

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_niap.html" with d=left_analysis %} + + {% include "front/report/m_niap.html" with d=right_analysis %} +
    +

    Code analysis

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_code.html" with d=left_analysis %} + + {% include "front/report/m_code.html" with d=right_analysis %} +
    +

    Permissions analysis

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_permissions.html" with d=left_analysis %} + + {% include "front/report/m_permissions.html" with d=right_analysis %} +
    -{{left_analysis}} + + +

    Tracking analysis

    +

    Information computed with Exodus-core. +

    + + + {% include "front/report/m_trackers.html" with d=left_analysis %} + + + {% include "front/report/m_trackers.html" with d=right_analysis %} + + + + +

    Threat analysis

    +

    Information computed with Quark-Engine. +

    + + + {% include "front/report/m_quark.html" with d=left_analysis %} + + + {% include "front/report/m_quark.html" with d=right_analysis %} + + + + +

    Behavior analysis

    +

    Information computed with MobSF. +

    + + + {% include "front/report/m_api.html" with d=left_analysis %} + + + {% include "front/report/m_api.html" with d=right_analysis %} + + + + + + {% endif %} +
    {% endblock whole_content %} \ No newline at end of file From d1b7b3a578b37476e680d4033c5841a6099ba88d Mon Sep 17 00:00:00 2001 From: evilcel3ri Date: Mon, 3 Apr 2023 17:45:52 +0200 Subject: [PATCH 06/13] save --- bazaar/front/forms.py | 77 ++++++++++---------- bazaar/front/urls.py | 3 - bazaar/front/view.py | 25 +++---- bazaar/templates/front/compare_analysis.html | 4 +- 4 files changed, 51 insertions(+), 58 deletions(-) diff --git a/bazaar/front/forms.py b/bazaar/front/forms.py index 77f51e4..35da4a2 100644 --- a/bazaar/front/forms.py +++ b/bazaar/front/forms.py @@ -66,47 +66,48 @@ class Meta: class CompareSearchForm(forms.Form): - left_hash = forms.CharField() - right_hash = forms.CharField() + left_sha = forms.CharField() + right_sha = forms.CharField() def do_search(self): - print(self.cleaned_data['left_hash']) - left_hash = self.cleaned_data['left_hash'] - - results = None - query = { - "query": { - "query_string": { - "default_field": "sha256", - "query": left_hash, - } - }, - "highlight": { - "fields": { - "*": {"pre_tags": [""], "post_tags": [""]} - } - }, - "aggs": { - "permissions": { - "terms": {"field": "permissions.keyword"} + shas = [] + shas.append(self['left_sha'].value()) + shas.append(self['right_sha'].value()) + + results = [] + for sha in shas: + query = { + "query": { + "query_string": { + "default_field": "sha256", + "query": sha, + } }, - "domains": { - "terms": {"field": "domains_analysis._name.keyword"} + "highlight": { + "fields": { + "*": {"pre_tags": [""], "post_tags": [""]} + } }, - "android_features": { - "terms": {"field": "features.keyword"} - } - }, - "sort": {"analysis_date": "desc"}, - "_source": ["apk_hash", "sha256", "uploaded_at", "icon_base64", "handle", "app_name", - "version_code", "size", "dexofuzzy.apk", "quark.threat_level", "vt", "is_signed", "frosting_data.is_frosted", "features"], - "size": 50, - } - es = Elasticsearch(settings.ELASTICSEARCH_HOSTS) - try: - raw_results = es.search(index=settings.ELASTICSEARCH_APK_INDEX, body=query) - results = transform_hl_results(raw_results) - except Exception as e: - return [], [], None + "aggs": { + "permissions": { + "terms": {"field": "permissions.keyword"} + }, + "domains": { + "terms": {"field": "domains_analysis._name.keyword"} + }, + "android_features": { + "terms": {"field": "features.keyword"} + } + }, + "sort": {"analysis_date": "desc"}, + "_source": ["apk_hash", "sha256", "uploaded_at", "icon_base64", "handle", "app_name", "version_code", "size", "dexofuzzy.apk", "quark.threat_level", "is_signed", "frosting_data.is_frosted", "features"], + "size": 50, + } + es = Elasticsearch(settings.ELASTICSEARCH_HOSTS) + try: + raw_results = es.search(index=settings.ELASTICSEARCH_APK_INDEX, body=query) + results.append(transform_hl_results(raw_results)) + except Exception as e: + return [] return results diff --git a/bazaar/front/urls.py b/bazaar/front/urls.py index 104bd10..9671d4d 100644 --- a/bazaar/front/urls.py +++ b/bazaar/front/urls.py @@ -30,7 +30,6 @@ path("similar/", view=similarity_search_view, name="similarity_search"), path("androcfg//", view=get_andgrocfg_code, name="get_andgrocfg_code"), path("androcfg/all", view=get_genom, name="get_genom"), -<<<<<<< HEAD path("status", view=instance_status, name="instance_status"), path("url/", view=basic_url_download_view, name="basic_url_download"), path("workspace/", view=workspace_view, name="workspace"), @@ -38,8 +37,6 @@ path("comment//delete", view=delete_comment_view, name="delete_comment"), path("notifications", view=notifications_view, name="notifications_url"), path("notifications//delete", view=notification_delete_view, name="notifications_url"), -======= path("compare/", view=compare_analysis_view, name="compare_analysis"), ->>>>>>> 3ca8256 (save) path("compare//to/", view=compare_analysis_view, name="compare_analysis") ] diff --git a/bazaar/front/view.py b/bazaar/front/view.py index 4b87fa3..e31bc4d 100644 --- a/bazaar/front/view.py +++ b/bazaar/front/view.py @@ -31,17 +31,10 @@ from bazaar.core.services import GenomService from bazaar.core.services import NotificationsService -<<<<<<< HEAD from bazaar.core.models import Yara, Bookmark, Comment, Notification from bazaar.core.modules.pithus import retrohunt from bazaar.core.utils import get_matching_items_by_dexofuzzy -from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, BasicUrlDownloadForm, CommentForm -======= -from bazaar.core.models import Yara -from bazaar.core.tasks import analyze, retrohunt -from bazaar.core.utils import get_sha256_of_file, get_matching_items_by_dexofuzzy -from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, BasicUrlDownloadForm, CompareSearchForm ->>>>>>> 3ca8256 (save) +from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, BasicUrlDownloadForm, CommentForm, CompareSearchForm from bazaar.front.og import generate_og_card from bazaar.front.utils import get_similarity_matrix, generate_world_map, \ get_sample_timeline, get_andro_cfg_storage_path @@ -864,11 +857,13 @@ def instance_status(request): def compare_analysis_view(request, *args, **kwargs): if request.method == 'GET': - # print(request.__dict__) - f = CompareSearchForm(request.GET) - print(f) - - left_result = "" - right_result = "" - return render(request, 'front/compare_analysis.html', context={'left_analysis': left_result, 'right_analysis': right_result}) + res = [] + left_res, right_res = None + if f.is_valid: + print("valid form") + res = f.do_search() + left_res = res[0][0] + right_res = res[0][1] + + return render(request, 'front/compare_analysis.html', context={'left_analysis': left_res, 'right_analysis': right_res}) diff --git a/bazaar/templates/front/compare_analysis.html b/bazaar/templates/front/compare_analysis.html index 31bea07..df5295f 100644 --- a/bazaar/templates/front/compare_analysis.html +++ b/bazaar/templates/front/compare_analysis.html @@ -17,13 +17,13 @@

    Compare two analysis

    -
    -
    From 9ca396f6c96f3ad0454312baca80e8db6b3662ba Mon Sep 17 00:00:00 2001 From: Christopher Talib Date: Tue, 11 Apr 2023 15:18:38 +0200 Subject: [PATCH 07/13] Working POC with button on similarities --- bazaar/front/forms.py | 38 ++++++++++++- bazaar/front/view.py | 14 +++-- bazaar/templates/front/compare_analysis.html | 58 +++++++++++++++++--- bazaar/templates/front/m_similarities.html | 5 ++ bazaar/templates/front/report/m_file.html | 2 +- 5 files changed, 102 insertions(+), 15 deletions(-) diff --git a/bazaar/front/forms.py b/bazaar/front/forms.py index 35da4a2..c7c59d8 100644 --- a/bazaar/front/forms.py +++ b/bazaar/front/forms.py @@ -100,8 +100,42 @@ def do_search(self): } }, "sort": {"analysis_date": "desc"}, - "_source": ["apk_hash", "sha256", "uploaded_at", "icon_base64", "handle", "app_name", "version_code", "size", "dexofuzzy.apk", "quark.threat_level", "is_signed", "frosting_data.is_frosted", "features"], - "size": 50, + "_source": [ + "uaid", + "signatures", + "is_signed", + "is_signed_v1", + "is_signed_v2", + "is_signed_v3", + "certificates", + "dexofuzzy", + "apkid", + "manifest_analysis", + "browsable_activities", + "niap_analysis", + "code_analysis", + "detailed_permissions", + "trackers", + "quark.crimes", + "android_api_analysis", + "ssdeep", + "version_name", + "apk_hash", + "app_name", + "dexofuzzy.apk", + "features" + "frosting_data.is_frosted", + "handle", + "is_signed", + "md5", + "quark.threat_level", + "sha1", + "sha256", + "size", + "uploaded_at", + "version_code", + ], + "size": 1, } es = Elasticsearch(settings.ELASTICSEARCH_HOSTS) try: diff --git a/bazaar/front/view.py b/bazaar/front/view.py index e31bc4d..266f01a 100644 --- a/bazaar/front/view.py +++ b/bazaar/front/view.py @@ -858,12 +858,18 @@ def instance_status(request): def compare_analysis_view(request, *args, **kwargs): if request.method == 'GET': f = CompareSearchForm(request.GET) + res = [] - left_res, right_res = None + left_res = None + right_res = None if f.is_valid: - print("valid form") res = f.do_search() - left_res = res[0][0] - right_res = res[0][1] + if res: + left_res = res[0][0]['source'] + right_res = res[1][0]['source'] + else: + return render(request, 'front/compare_analysis.html') + print(res) return render(request, 'front/compare_analysis.html', context={'left_analysis': left_res, 'right_analysis': right_res}) + diff --git a/bazaar/templates/front/compare_analysis.html b/bazaar/templates/front/compare_analysis.html index df5295f..eac2b63 100644 --- a/bazaar/templates/front/compare_analysis.html +++ b/bazaar/templates/front/compare_analysis.html @@ -41,8 +41,8 @@

    Compare two analysis

    - Left APK (report) - Right APK (report) + {{left_analysis.sha256}} + {{right_analysis.sha256}} @@ -71,6 +71,31 @@

    Compare two analysis

    {% include "front/report/m_apkid.html" with d=right_analysis %} + + +

    SSdeep

    +

    Information computed with ssdeep. +

    + + + {% include "front/report/m_ssdeep.html" with d=left_analysis %} + + + {% include "front/report/m_ssdeep.html" with d=right_analysis %} + + + + +

    Dexofuzzy

    + + + {% include "front/report/m_dexofuzzy.html" with d=left_analysis %} + + + {% include "front/report/m_dexofuzzy.html" with d=right_analysis %} + +

    APK details

    @@ -101,36 +126,42 @@

    Compare two analysis

    + {% if left_analysis.manifest_analysis or right_analysis.manifest_analysis %} -

    Browsable activities

    +

    Manifest

    Information computed with MobSF.

    - {% include "front/report/m_browsable_activities.html" with d=left_analysis %} + {% include "front/report/m_manifest.html" with d=left_analysis %} - {% include "front/report/m_browsable_activities.html" with d=right_analysis %} + {% include "front/report/m_manifest.html" with d=right_analysis %} + {% endif %} + {% if left_analysis.browsable_activities and right_analysis.browsable_activities %} -

    Manifest

    +

    Browsable activities

    Information computed with MobSF.

    - {% include "front/report/m_manifest.html" with d=left_analysis %} + {% include "front/report/m_browsable_activities.html" with d=left_analysis %} - {% include "front/report/m_manifest.html" with d=right_analysis %} + {% include "front/report/m_browsable_activities.html" with d=right_analysis %} + {% endif %} + + {% if left_analysis.niap_analysis and right_analysis.niap_analysis %}

    NIAP analysis

    @@ -145,7 +176,9 @@

    Compare two analysis

    {% include "front/report/m_niap.html" with d=right_analysis %} + {% endif %} + {% if left_analysis.code_analysis and right_analysis.code_analysis %}

    Code analysis

    @@ -160,7 +193,9 @@

    Compare two analysis

    {% include "front/report/m_code.html" with d=right_analysis %} + {% endif %} + {% if left_analysis.detailed_permissions and right_analysis.detailed_permissions %}

    Permissions analysis

    @@ -175,7 +210,9 @@

    Compare two analysis

    {% include "front/report/m_permissions.html" with d=right_analysis %} + {% endif %} + {% if left_analysis.trackers and right_analysis.trackers %}

    Tracking analysis

    @@ -190,7 +227,9 @@

    Compare two analysis

    {% include "front/report/m_trackers.html" with d=right_analysis %} + {% endif %} + {% if left_analysis.quark.crimes and right_analysis.quark.crimes %}

    Threat analysis

    @@ -205,7 +244,9 @@

    Compare two analysis

    {% include "front/report/m_quark.html" with d=right_analysis %} + {% endif %} + {% if left_analysis.android_api_analysis and right_analysis.android_api_analysis %}

    Behavior analysis

    @@ -220,6 +261,7 @@

    Compare two analysis

    {% include "front/report/m_api.html" with d=right_analysis %} + {% endif %} diff --git a/bazaar/templates/front/m_similarities.html b/bazaar/templates/front/m_similarities.html index 25dc9c3..41aad5b 100644 --- a/bazaar/templates/front/m_similarities.html +++ b/bazaar/templates/front/m_similarities.html @@ -39,6 +39,11 @@
    + +
    + Compare +
    + {% endif %} {% endfor %} diff --git a/bazaar/templates/front/report/m_file.html b/bazaar/templates/front/report/m_file.html index 25be16d..bc58e7d 100644 --- a/bazaar/templates/front/report/m_file.html +++ b/bazaar/templates/front/report/m_file.html @@ -32,4 +32,4 @@ {% endif %} - + \ No newline at end of file From c2788be6c07c17bf58e98ade8d0f80513247fe62 Mon Sep 17 00:00:00 2001 From: evilcel3ri Date: Tue, 25 Apr 2023 13:25:09 +0200 Subject: [PATCH 08/13] Adding possibility of responsiveness --- bazaar/templates/front/compare_analysis.html | 441 ++++++++++--------- 1 file changed, 222 insertions(+), 219 deletions(-) diff --git a/bazaar/templates/front/compare_analysis.html b/bazaar/templates/front/compare_analysis.html index eac2b63..a042d17 100644 --- a/bazaar/templates/front/compare_analysis.html +++ b/bazaar/templates/front/compare_analysis.html @@ -37,234 +37,237 @@

    Compare two analysis

    {% if left_analysis and right_analysis %} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
    +
    {{left_analysis.sha256}}{{right_analysis.sha256}}
    -

    File sums

    -     		- {% include "front/report/m_file.html" with d=left_analysis %} - - {% include "front/report/m_file.html" with d=right_analysis %} -
    -

    APKiD

    -

    Information computed with APKiD. -

    -     		- {% include "front/report/m_apkid.html" with d=left_analysis %} - - {% include "front/report/m_apkid.html" with d=right_analysis %} -
    -

    SSdeep

    -

    Information computed with ssdeep. -

    -     		- {% include "front/report/m_ssdeep.html" with d=left_analysis %} - - {% include "front/report/m_ssdeep.html" with d=right_analysis %} -
    -

    Dexofuzzy

    -     		- {% include "front/report/m_dexofuzzy.html" with d=left_analysis %} - - {% include "front/report/m_dexofuzzy.html" with d=right_analysis %} -
    -

    APK details

    -

    Information computed with AndroGuard - and Pithus. -

    -     		- {% include "front/report/m_apk.html" with d=left_analysis %} - - {% include "front/report/m_apk.html" with d=right_analysis %} -
    -

    Certificate

    -

    Information computed with AndroGuard. -

    -     		- {% include "front/report/m_certificate.html" with d=left_analysis %} - - {% include "front/report/m_certificate.html" with d=left_analysis %} -
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - {% if left_analysis.manifest_analysis or right_analysis.manifest_analysis %} - - - - - - {% endif %} + {% if left_analysis.manifest_analysis or right_analysis.manifest_analysis %} + + + + + + {% endif %} - {% if left_analysis.browsable_activities and right_analysis.browsable_activities %} - - - - - - {% endif %} + {% if left_analysis.browsable_activities and right_analysis.browsable_activities %} + + + + + + {% endif %} - {% if left_analysis.niap_analysis and right_analysis.niap_analysis %} - - - - - - {% endif %} + {% if left_analysis.niap_analysis and right_analysis.niap_analysis %} + + + + + + {% endif %} - {% if left_analysis.code_analysis and right_analysis.code_analysis %} - - - - - - {% endif %} + {% if left_analysis.code_analysis and right_analysis.code_analysis %} + + + + + + {% endif %} - {% if left_analysis.detailed_permissions and right_analysis.detailed_permissions %} - - - - - - {% endif %} + {% if left_analysis.detailed_permissions and right_analysis.detailed_permissions %} + + + + + + {% endif %} - {% if left_analysis.trackers and right_analysis.trackers %} - - - - - - {% endif %} + {% if left_analysis.trackers and right_analysis.trackers %} + + + + + + {% endif %} - {% if left_analysis.quark.crimes and right_analysis.quark.crimes %} - - - - - - {% endif %} + {% if left_analysis.quark.crimes and right_analysis.quark.crimes %} + + + + + + {% endif %} - {% if left_analysis.android_api_analysis and right_analysis.android_api_analysis %} - - - - - - {% endif %} + {% if left_analysis.android_api_analysis and right_analysis.android_api_analysis %} + + + + + + {% endif %} - -
    {{left_analysis.sha256}}{{right_analysis.sha256}} +
    +

    File sums

    +     		+ {% include "front/report/m_file.html" with d=left_analysis %} + + {% include "front/report/m_file.html" with d=right_analysis %} +
    +

    APKiD

    +

    Information computed with APKiD. +

    +     		+ {% include "front/report/m_apkid.html" with d=left_analysis %} + + {% include "front/report/m_apkid.html" with d=right_analysis %} +
    +

    SSdeep

    +

    Information computed with ssdeep. +

    +     		+ {% include "front/report/m_ssdeep.html" with d=left_analysis %} + + {% include "front/report/m_ssdeep.html" with d=right_analysis %} +
    +

    Dexofuzzy

    +     		+ {% include "front/report/m_dexofuzzy.html" with d=left_analysis %} + + {% include "front/report/m_dexofuzzy.html" with d=right_analysis %} +
    +

    APK details

    +

    Information computed with AndroGuard + and Pithus. +

    +     		+ {% include "front/report/m_apk.html" with d=left_analysis %} + + {% include "front/report/m_apk.html" with d=right_analysis %} +
    +

    Certificate

    +

    Information computed with AndroGuard. +

    +     		+ {% include "front/report/m_certificate.html" with d=left_analysis %} + + {% include "front/report/m_certificate.html" with d=left_analysis %} +
    -

    Manifest

    -

    Information computed with MobSF. -

    -     		- {% include "front/report/m_manifest.html" with d=left_analysis %} - - {% include "front/report/m_manifest.html" with d=right_analysis %} -
    +

    Manifest

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_manifest.html" with d=left_analysis %} + + {% include "front/report/m_manifest.html" with d=right_analysis %} +
    -

    Browsable activities

    -

    Information computed with MobSF. -

    -     		- {% include "front/report/m_browsable_activities.html" with d=left_analysis %} - - {% include "front/report/m_browsable_activities.html" with d=right_analysis %} -
    +

    Browsable activities

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_browsable_activities.html" with d=left_analysis %} + + {% include "front/report/m_browsable_activities.html" with d=right_analysis %} +
    -

    NIAP analysis

    -

    Information computed with MobSF. -

    -     		- {% include "front/report/m_niap.html" with d=left_analysis %} - - {% include "front/report/m_niap.html" with d=right_analysis %} -
    +

    NIAP analysis

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_niap.html" with d=left_analysis %} + + {% include "front/report/m_niap.html" with d=right_analysis %} +
    -

    Code analysis

    -

    Information computed with MobSF. -

    -     		- {% include "front/report/m_code.html" with d=left_analysis %} - - {% include "front/report/m_code.html" with d=right_analysis %} -
    +

    Code analysis

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_code.html" with d=left_analysis %} + + {% include "front/report/m_code.html" with d=right_analysis %} +
    -

    Permissions analysis

    -

    Information computed with MobSF. -

    -     		- {% include "front/report/m_permissions.html" with d=left_analysis %} - - {% include "front/report/m_permissions.html" with d=right_analysis %} -
    +

    Permissions analysis

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_permissions.html" with d=left_analysis %} + + {% include "front/report/m_permissions.html" with d=right_analysis %} +
    -

    Tracking analysis

    -

    Information computed with Exodus-core. -

    -     		- {% include "front/report/m_trackers.html" with d=left_analysis %} - - {% include "front/report/m_trackers.html" with d=right_analysis %} -
    +

    Tracking analysis

    +

    Information computed with Exodus-core. +

    +     		+ {% include "front/report/m_trackers.html" with d=left_analysis %} + + {% include "front/report/m_trackers.html" with d=right_analysis %} +
    -

    Threat analysis

    -

    Information computed with Quark-Engine. -

    -     		- {% include "front/report/m_quark.html" with d=left_analysis %} - - {% include "front/report/m_quark.html" with d=right_analysis %} -
    +

    Threat analysis

    +

    Information computed with Quark-Engine. +

    +     		+ {% include "front/report/m_quark.html" with d=left_analysis %} + + {% include "front/report/m_quark.html" with d=right_analysis %} +
    -

    Behavior analysis

    -

    Information computed with MobSF. -

    -     		- {% include "front/report/m_api.html" with d=left_analysis %} - - {% include "front/report/m_api.html" with d=right_analysis %} -
    +

    Behavior analysis

    +

    Information computed with MobSF. +

    +     		+ {% include "front/report/m_api.html" with d=left_analysis %} + + {% include "front/report/m_api.html" with d=right_analysis %} +
    - {% endif %} + + + {% endif %} + {% endblock whole_content %} \ No newline at end of file From 7eaf1c18505eb33d5b36f27d6b58e5cacfdfb434 Mon Sep 17 00:00:00 2001 From: trpyn Date: Wed, 4 Nov 2026 12:56:16 +0100 Subject: [PATCH 09/13] refactor comparison to use Services + nicer display --- bazaar/core/services/search.py | 78 ++++++++++++ bazaar/front/forms.py | 79 +----------- bazaar/static/css/project.css | 24 ++++ bazaar/static/sass/project.scss | 30 ++++- bazaar/templates/front/compare_analysis.html | 119 ++++++++++++++----- 5 files changed, 222 insertions(+), 108 deletions(-) diff --git a/bazaar/core/services/search.py b/bazaar/core/services/search.py index 91f78c9..698398f 100644 --- a/bazaar/core/services/search.py +++ b/bazaar/core/services/search.py @@ -93,3 +93,81 @@ def similarity_search(search_hash, algorithm, ignore_sha=''): logging.error(e) return results + + +def compare_search(left_sha, right_sha): + shas = [] + shas.append(left_sha) + shas.append(right_sha) + + results = [] + for sha in shas: + query = { + "query": { + "query_string": { + "default_field": "sha256", + "query": sha, + } + }, + "highlight": { + "fields": { + "*": {"pre_tags": [""], "post_tags": [""]} + } + }, + "aggs": { + "permissions": { + "terms": {"field": "permissions.keyword"} + }, + "domains": { + "terms": {"field": "domains_analysis._name.keyword"} + }, + "android_features": { + "terms": {"field": "features.keyword"} + } + }, + "sort": {"analysis_date": "desc"}, + "_source": [ + "uaid", + "signatures", + "is_signed", + "is_signed_v1", + "is_signed_v2", + "is_signed_v3", + "certificates", + "dexofuzzy", + "apkid", + "manifest_analysis", + "browsable_activities", + "niap_analysis", + "code_analysis", + "detailed_permissions", + "trackers", + "quark.crimes", + "android_api_analysis", + "ssdeep", + "version_name", + "apk_hash", + "app_name", + "dexofuzzy.apk", + "features" + "frosting_data.is_frosted", + "handle", + "is_signed", + "md5", + "quark.threat_level", + "sha1", + "sha256", + "size", + "uploaded_at", + "version_code", + ], + "size": 1, + } + es = Elasticsearch(settings.ELASTICSEARCH_HOSTS) + try: + raw_results = es.search(index=settings.ELASTICSEARCH_APK_INDEX, body=query) + results.append(transform_hl_results(raw_results)) + except Exception as e: + return [] + + return results \ No newline at end of file diff --git a/bazaar/front/forms.py b/bazaar/front/forms.py index c7c59d8..ecf500a 100644 --- a/bazaar/front/forms.py +++ b/bazaar/front/forms.py @@ -70,78 +70,7 @@ class CompareSearchForm(forms.Form): right_sha = forms.CharField() def do_search(self): - shas = [] - shas.append(self['left_sha'].value()) - shas.append(self['right_sha'].value()) - - results = [] - for sha in shas: - query = { - "query": { - "query_string": { - "default_field": "sha256", - "query": sha, - } - }, - "highlight": { - "fields": { - "*": {"pre_tags": [""], "post_tags": [""]} - } - }, - "aggs": { - "permissions": { - "terms": {"field": "permissions.keyword"} - }, - "domains": { - "terms": {"field": "domains_analysis._name.keyword"} - }, - "android_features": { - "terms": {"field": "features.keyword"} - } - }, - "sort": {"analysis_date": "desc"}, - "_source": [ - "uaid", - "signatures", - "is_signed", - "is_signed_v1", - "is_signed_v2", - "is_signed_v3", - "certificates", - "dexofuzzy", - "apkid", - "manifest_analysis", - "browsable_activities", - "niap_analysis", - "code_analysis", - "detailed_permissions", - "trackers", - "quark.crimes", - "android_api_analysis", - "ssdeep", - "version_name", - "apk_hash", - "app_name", - "dexofuzzy.apk", - "features" - "frosting_data.is_frosted", - "handle", - "is_signed", - "md5", - "quark.threat_level", - "sha1", - "sha256", - "size", - "uploaded_at", - "version_code", - ], - "size": 1, - } - es = Elasticsearch(settings.ELASTICSEARCH_HOSTS) - try: - raw_results = es.search(index=settings.ELASTICSEARCH_APK_INDEX, body=query) - results.append(transform_hl_results(raw_results)) - except Exception as e: - return [] - - return results + return SearchService.compare_search( + self['left_sha'].value(), + self['right_sha'].value() + ) diff --git a/bazaar/static/css/project.css b/bazaar/static/css/project.css index 235a931..4d7394c 100644 --- a/bazaar/static/css/project.css +++ b/bazaar/static/css/project.css @@ -7330,3 +7330,27 @@ samp { background-color: #dc3545; border-radius: 50%; border: 2px solid #fff; } + +.comparison-table { + width: 100%; + overflow: hidden; } + +.comparison-table-inner { + width: 100%; + table-layout: fixed; } + +.comparison-table-inner th:first-child, +.comparison-table-inner td:first-child { + width: 120px; } + +.comparison-table-inner th:nth-child(2), +.comparison-table-inner th:nth-child(3), +.comparison-table-inner td:nth-child(2), +.comparison-table-inner td:nth-child(3) { + width: auto; + overflow-wrap: break-word; } + +.comparison-cell { + width: 100%; + overflow-x: auto; + white-space: nowrap; } diff --git a/bazaar/static/sass/project.scss b/bazaar/static/sass/project.scss index 97a7de9..5263e5f 100644 --- a/bazaar/static/sass/project.scss +++ b/bazaar/static/sass/project.scss @@ -84,7 +84,6 @@ samp { color: $gray-600; } - .notification-bell { position: relative; display: inline-block; @@ -100,3 +99,32 @@ samp { border-radius: 50%; border: 2px solid #fff; } + +.comparison-table { + width: 100%; + overflow: hidden; +} + +.comparison-table-inner { + width: 100%; + table-layout: fixed; +} + +.comparison-table-inner th:first-child, +.comparison-table-inner td:first-child { + width: 120px; +} + +.comparison-table-inner th:nth-child(2), +.comparison-table-inner th:nth-child(3), +.comparison-table-inner td:nth-child(2), +.comparison-table-inner td:nth-child(3) { + width: auto; + overflow-wrap: break-word; +} + +.comparison-cell { + width: 100%; + overflow-x: auto; + white-space: nowrap; +} \ No newline at end of file diff --git a/bazaar/templates/front/compare_analysis.html b/bazaar/templates/front/compare_analysis.html index a042d17..dd94e0d 100644 --- a/bazaar/templates/front/compare_analysis.html +++ b/bazaar/templates/front/compare_analysis.html @@ -37,11 +37,11 @@

    Compare two analysis

    {% if left_analysis and right_analysis %} -
    - +
    +
    - + @@ -53,10 +53,14 @@

    Compare two analysis

    File sums

    @@ -67,10 +71,14 @@

    Compare two analysis

    @@ -81,10 +89,14 @@

    Compare two analysis

    @@ -92,10 +104,14 @@

    Compare two analysis

    Dexofuzzy

    @@ -107,9 +123,13 @@

    Compare two analysis

    @@ -121,10 +141,14 @@

    Compare two analysis

    @@ -137,10 +161,14 @@

    Compare two analysis

    {% endif %} @@ -154,15 +182,18 @@

    Compare two analysis

    {% endif %} - {% if left_analysis.niap_analysis and right_analysis.niap_analysis %} {% endif %} @@ -189,10 +224,14 @@

    Compare two analysis

    {% endif %} @@ -206,10 +245,14 @@

    Compare two analysis

    {% endif %} @@ -223,10 +266,14 @@

    Compare two analysis

    {% endif %} @@ -240,10 +287,14 @@

    Compare two analysis

    {% endif %} @@ -257,10 +308,14 @@

    Compare two analysis

    {% endif %} From 747bdf1d7ba5cede7ba8e3cfdccb52d07cb04eae Mon Sep 17 00:00:00 2001 From: trpyn Date: Wed, 4 Nov 2026 13:02:58 +0100 Subject: [PATCH 10/13] flake8 --- bazaar/core/services/search.py | 6 +++--- bazaar/core/utils.py | 1 + bazaar/front/view.py | 10 +++++++--- bazaar/templates/front/report/m_file.html | 2 +- 4 files changed, 12 insertions(+), 7 deletions(-) diff --git a/bazaar/core/services/search.py b/bazaar/core/services/search.py index 698398f..54409f0 100644 --- a/bazaar/core/services/search.py +++ b/bazaar/core/services/search.py @@ -160,14 +160,14 @@ def compare_search(left_sha, right_sha): "size", "uploaded_at", "version_code", - ], + ], "size": 1, } es = Elasticsearch(settings.ELASTICSEARCH_HOSTS) try: raw_results = es.search(index=settings.ELASTICSEARCH_APK_INDEX, body=query) results.append(transform_hl_results(raw_results)) - except Exception as e: + except Exception: return [] - return results \ No newline at end of file + return results diff --git a/bazaar/core/utils.py b/bazaar/core/utils.py index 2bfa88a..3a58925 100644 --- a/bazaar/core/utils.py +++ b/bazaar/core/utils.py @@ -39,6 +39,7 @@ def compute_status(status): 'running': running } + def get_sha256_of_file_path(file_path): sha256_hash = hashlib.sha256() with open(file_path, "rb") as f: diff --git a/bazaar/front/view.py b/bazaar/front/view.py index 266f01a..9df319c 100644 --- a/bazaar/front/view.py +++ b/bazaar/front/view.py @@ -34,7 +34,8 @@ from bazaar.core.models import Yara, Bookmark, Comment, Notification from bazaar.core.modules.pithus import retrohunt from bazaar.core.utils import get_matching_items_by_dexofuzzy -from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, BasicUrlDownloadForm, CommentForm, CompareSearchForm +from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, \ + BasicUrlDownloadForm, CommentForm, CompareSearchForm from bazaar.front.og import generate_og_card from bazaar.front.utils import get_similarity_matrix, generate_world_map, \ get_sample_timeline, get_andro_cfg_storage_path @@ -871,5 +872,8 @@ def compare_analysis_view(request, *args, **kwargs): return render(request, 'front/compare_analysis.html') print(res) - return render(request, 'front/compare_analysis.html', context={'left_analysis': left_res, 'right_analysis': right_res}) - + return render( + request, + 'front/compare_analysis.html', + context={'left_analysis': left_res, 'right_analysis': right_res} + ) diff --git a/bazaar/templates/front/report/m_file.html b/bazaar/templates/front/report/m_file.html index bc58e7d..25be16d 100644 --- a/bazaar/templates/front/report/m_file.html +++ b/bazaar/templates/front/report/m_file.html @@ -32,4 +32,4 @@ {% endif %} -
    {{left_analysis.sha256}} {{right_analysis.sha256}} - {% include "front/report/m_file.html" with d=left_analysis %} +
    + {% include "front/report/m_file.html" with d=left_analysis %} +
    		- {% include "front/report/m_file.html" with d=right_analysis %} +
    + {% include "front/report/m_file.html" with d=rigt_analysis %} +
    - {% include "front/report/m_apkid.html" with d=left_analysis %} +
    + {% include "front/report/m_apkid.html" with d=left_analysis %} +
    		- {% include "front/report/m_apkid.html" with d=right_analysis %} +
    + {% include "front/report/m_apkid.html" with d=right_analysis %} +
    - {% include "front/report/m_ssdeep.html" with d=left_analysis %} +
    + {% include "front/report/m_ssdeep.html" with d=left_analysis %} +
    		- {% include "front/report/m_ssdeep.html" with d=right_analysis %} +
    + {% include "front/report/m_ssdeep.html" with d=right_analysis %} +
    - {% include "front/report/m_dexofuzzy.html" with d=left_analysis %} +
    + {% include "front/report/m_dexofuzzy.html" with d=left_analysis %} +
    		- {% include "front/report/m_dexofuzzy.html" with d=right_analysis %} +
    + {% include "front/report/m_dexofuzzy.html" with d=right_analysis %} +
    - {% include "front/report/m_apk.html" with d=left_analysis %} +
    + {% include "front/report/m_apk.html" with d=left_analysis %} +
    		- {% include "front/report/m_apk.html" with d=right_analysis %} +
    + {% include "front/report/m_apk.html" with d=right_analysis %} +
    - {% include "front/report/m_certificate.html" with d=left_analysis %} +
    + {% include "front/report/m_certificate.html" with d=left_analysis %} +
    		- {% include "front/report/m_certificate.html" with d=left_analysis %} +
    + {% include "front/report/m_certificate.html" with d=right_analysis %} +
    - {% include "front/report/m_manifest.html" with d=left_analysis %} +
    + {% include "front/report/m_manifest.html" with d=left_analysis %} +
    		- {% include "front/report/m_manifest.html" with d=right_analysis %} +
    + {% include "front/report/m_manifest.html" with d=right_analysis %} +
    - {% include "front/report/m_browsable_activities.html" with d=left_analysis %} +
    + {% include "front/report/m_browsable_activities.html" with d=left_analysis %} +
    		- {% include "front/report/m_browsable_activities.html" with d=right_analysis %} +
    + {% include "front/report/m_browsable_activities.html" with d=right_analysis %} +
    @@ -172,10 +203,14 @@

    Compare two analysis

    		 - {% include "front/report/m_niap.html" with d=left_analysis %} +
    + {% include "front/report/m_niap.html" with d=left_analysis %} +
    		- {% include "front/report/m_niap.html" with d=right_analysis %} +
    + {% include "front/report/m_niap.html" with d=right_analysis %} +
    - {% include "front/report/m_code.html" with d=left_analysis %} +
    + {% include "front/report/m_code.html" with d=left_analysis %} +
    		- {% include "front/report/m_code.html" with d=right_analysis %} +
    + {% include "front/report/m_code.html" with d=right_analysis %} +
    - {% include "front/report/m_permissions.html" with d=left_analysis %} +
    + {% include "front/report/m_permissions.html" with d=left_analysis %} +
    		- {% include "front/report/m_permissions.html" with d=right_analysis %} +
    + {% include "front/report/m_permissions.html" with d=right_analysis %} +
    - {% include "front/report/m_trackers.html" with d=left_analysis %} +
    + {% include "front/report/m_trackers.html" with d=left_analysis %} +
    		- {% include "front/report/m_trackers.html" with d=right_analysis %} +
    + {% include "front/report/m_trackers.html" with d=right_analysis %} +
    - {% include "front/report/m_quark.html" with d=left_analysis %} +
    + {% include "front/report/m_quark.html" with d=left_analysis %} +
    		- {% include "front/report/m_quark.html" with d=right_analysis %} +
    + {% include "front/report/m_quark.html" with d=right_analysis %} +
    - {% include "front/report/m_api.html" with d=left_analysis %} +
    + {% include "front/report/m_api.html" with d=left_analysis %} +
    		- {% include "front/report/m_api.html" with d=right_analysis %} +
    + {% include "front/report/m_api.html" with d=right_analysis %} +
    \ No newline at end of file + From 34a792a253b3abf3ce3f4968e6ed72759a79235f Mon Sep 17 00:00:00 2001 From: trpyn Date: Wed, 4 Nov 2026 14:32:57 +0100 Subject: [PATCH 11/13] fix failed rebase --- bazaar/templates/front/report/m_androcfg.html | 27 ------------------- 1 file changed, 27 deletions(-) diff --git a/bazaar/templates/front/report/m_androcfg.html b/bazaar/templates/front/report/m_androcfg.html index 7f5f46f..e0dc2d2 100644 --- a/bazaar/templates/front/report/m_androcfg.html +++ b/bazaar/templates/front/report/m_androcfg.html @@ -1,7 +1,6 @@ {% if andro_cfg %}

    Control flow graphs analysis

    -<<<<<<< HEAD

    Information computed by Pithus.

    @@ -21,32 +20,6 @@

    {{ r.rule.title }}

    {% endfor %} -======= - {% for r in andro_cfg.rules %} -
    -
    -

    {{ r.rule.title }}

    -
    -
    - -
    - {% if r.cfg_file %} -
    - - - ->>>>>>> 8f7c8db (Removing sha for dexo_func + adding |safe to dexofuzzy_hash)
    {% if r.cfg_file %}
    From c5119d1b061a75e34f056522e68f0bc539258154 Mon Sep 17 00:00:00 2001 From: trpyn Date: Wed, 4 Nov 2026 14:33:17 +0100 Subject: [PATCH 12/13] add comparison button --- bazaar/front/forms.py | 10 ++++---- bazaar/front/view.py | 24 +++++++++++++++++--- bazaar/templates/front/compare_analysis.html | 4 ++-- bazaar/templates/front/report.html | 8 +++++-- 4 files changed, 34 insertions(+), 12 deletions(-) diff --git a/bazaar/front/forms.py b/bazaar/front/forms.py index ecf500a..396c9cd 100644 --- a/bazaar/front/forms.py +++ b/bazaar/front/forms.py @@ -66,11 +66,11 @@ class Meta: class CompareSearchForm(forms.Form): - left_sha = forms.CharField() - right_sha = forms.CharField() + left_sha = forms.CharField(required=False) + right_sha = forms.CharField(required=False) def do_search(self): return SearchService.compare_search( - self['left_sha'].value(), - self['right_sha'].value() - ) + self.cleaned_data['left_sha'], + self.cleaned_data['right_sha'] + ) \ No newline at end of file diff --git a/bazaar/front/view.py b/bazaar/front/view.py index 9df319c..69bc8bf 100644 --- a/bazaar/front/view.py +++ b/bazaar/front/view.py @@ -857,13 +857,27 @@ def instance_status(request): def compare_analysis_view(request, *args, **kwargs): + if request.method == 'GET': - f = CompareSearchForm(request.GET) + left_sha = kwargs.get('left_sha') or request.GET.get('left_sha', '') + right_sha = kwargs.get('right_sha') or request.GET.get('right_sha', '') + + f = CompareSearchForm(initial={ + 'left_sha': left_sha, + 'right_sha': right_sha, + }) res = [] left_res = None right_res = None - if f.is_valid: + + if left_sha and right_sha: + f = CompareSearchForm({ + 'left_sha': left_sha, + 'right_sha': right_sha, + }) + + if f.is_valid(): res = f.do_search() if res: left_res = res[0][0]['source'] @@ -875,5 +889,9 @@ def compare_analysis_view(request, *args, **kwargs): return render( request, 'front/compare_analysis.html', - context={'left_analysis': left_res, 'right_analysis': right_res} + context={ + 'form': f, + 'left_analysis': left_res, + 'right_analysis': right_res + } ) diff --git a/bazaar/templates/front/compare_analysis.html b/bazaar/templates/front/compare_analysis.html index dd94e0d..d76a32f 100644 --- a/bazaar/templates/front/compare_analysis.html +++ b/bazaar/templates/front/compare_analysis.html @@ -18,13 +18,13 @@

    Compare two analysis

    + value="{{ form.left_sha.value|default:'' }}">
    + value="{{ form.right_sha.value|default:'' }}">
    diff --git a/bazaar/templates/front/report.html b/bazaar/templates/front/report.html index 18e4817..00d9afc 100644 --- a/bazaar/templates/front/report.html +++ b/bazaar/templates/front/report.html @@ -40,14 +40,18 @@ data-toggle="tooltip" data-placement="top" title="Export the report in JSON"> {% if is_bookmarked %} - {% else %} - {% endif %} + + +
    {% endif %}
    From 89fc103d72f43afd5f4f264d93cca088fd73619b Mon Sep 17 00:00:00 2001 From: trpyn Date: Wed, 4 Nov 2026 14:34:50 +0100 Subject: [PATCH 13/13] flake8 --- bazaar/front/forms.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bazaar/front/forms.py b/bazaar/front/forms.py index 396c9cd..5c8141b 100644 --- a/bazaar/front/forms.py +++ b/bazaar/front/forms.py @@ -73,4 +73,4 @@ def do_search(self): return SearchService.compare_search( self.cleaned_data['left_sha'], self.cleaned_data['right_sha'] - ) \ No newline at end of file + )