Feat/comparison

bazaar/core/services/search.py

@@ -87,9 +87,87 @@ def similarity_search(search_hash, algorithm, ignore_sha=''):
                 )
             case 'func_hash':
                 results = get_matching_items_by_ssdeep_func(
-                    search_hash, 25, settings.ELASTICSEARCH_APK_INDEX, ignore_sha
+                    search_hash, 25, settings.ELASTICSEARCH_APK_INDEX
                 )
     except Exception as e:
         logging.error(e)
 
     return results
+
+
+def compare_search(left_sha, right_sha):
+    shas = []
+    shas.append(left_sha)
+    shas.append(right_sha)
+
+    results = []
+    for sha in shas:
+        query = {
+            "query": {
+                "query_string": {
+                    "default_field": "sha256",
+                    "query": sha,
+                }
+            },
+            "highlight": {
+                "fields": {
+                    "*": {"pre_tags": ["<mark>"], "post_tags": ["</mark>"]}
+                }
+            },
+            "aggs": {
+                "permissions": {
+                    "terms": {"field": "permissions.keyword"}
+                },
+                "domains": {
+                    "terms": {"field": "domains_analysis._name.keyword"}
+                },
+                "android_features": {
+                    "terms": {"field": "features.keyword"}
+                }
+            },
+            "sort": {"analysis_date": "desc"},
+            "_source": [
+                "uaid",
+                "signatures",
+                "is_signed",
+                "is_signed_v1",
+                "is_signed_v2",
+                "is_signed_v3",
+                "certificates",
+                "dexofuzzy",
+                "apkid",
+                "manifest_analysis",
+                "browsable_activities",
+                "niap_analysis",
+                "code_analysis",
+                "detailed_permissions",
+                "trackers",
+                "quark.crimes",
+                "android_api_analysis",
+                "ssdeep",
+                "version_name",
+                "apk_hash",
+                "app_name",
+                "dexofuzzy.apk",
+                "features"
+                "frosting_data.is_frosted",
+                "handle",
+                "is_signed",
+                "md5",
+                "quark.threat_level",
+                "sha1",
+                "sha256",
+                "size",
+                "uploaded_at",
+                "version_code",
+            ],
+            "size": 1,
+        }
+        es = Elasticsearch(settings.ELASTICSEARCH_HOSTS)
+        try:
+            raw_results = es.search(index=settings.ELASTICSEARCH_APK_INDEX, body=query)
+            results.append(transform_hl_results(raw_results))
+        except Exception:
+            return []
+
+    return results

bazaar/core/utils.py

@@ -306,7 +306,7 @@ def get_matching_items_by_ssdeep(ssdeep_value, threshold_grade, index, sha256):
     return sha256_list_to_return
 
 
-def get_matching_items_by_ssdeep_func(ssdeep_value, threshold_grade, index, sha256):
+def get_matching_items_by_ssdeep_func(ssdeep_value, threshold_grade, index):
     chunksize, chunk, double_chunk = ssdeep_value.split(':')
     chunksize = int(chunksize)
     es = Elasticsearch(

bazaar/front/forms.py

@@ -63,3 +63,14 @@ class Meta:
                 "rows": 5,
             }),
         }
+
+
+class CompareSearchForm(forms.Form):
+    left_sha = forms.CharField(required=False)
+    right_sha = forms.CharField(required=False)
+
+    def do_search(self):
+        return SearchService.compare_search(
+            self.cleaned_data['left_sha'],
+            self.cleaned_data['right_sha']
+        )

bazaar/front/urls.py

@@ -5,7 +5,7 @@
     download_sample_view, my_rule_edit_view, my_rule_create_view, my_rule_delete_view, og_card_view, \
     my_retrohunt_view, get_andgrocfg_code, get_genom, basic_url_download_view, report_status_view, instance_status, \
     remove_bookmark_sample_view, add_bookmark_sample_view, workspace_view, add_comment_view, delete_comment_view, \
-    notifications_view, notification_delete_view, dl_hidden
+    notifications_view, notification_delete_view, dl_hidden, compare_analysis_view
 
 app_name = "front"
 urlpatterns = [
@@ -36,5 +36,7 @@
     path("comment/<str:sha256>/add", view=add_comment_view, name="add_comment"),
     path("comment/<uuid:comment_id>/delete", view=delete_comment_view, name="delete_comment"),
     path("notifications", view=notifications_view, name="notifications_url"),
-    path("notifications/<uuid:notif_id>/delete", view=notification_delete_view, name="notifications_url")
+    path("notifications/<uuid:notif_id>/delete", view=notification_delete_view, name="notifications_url"),
+    path("compare/", view=compare_analysis_view, name="compare_analysis"),
+    path("compare/<str:left_sha>/to/<str:right_sha>", view=compare_analysis_view, name="compare_analysis")
 ]

bazaar/front/view.py

@@ -34,7 +34,8 @@
 from bazaar.core.models import Yara, Bookmark, Comment, Notification
 from bazaar.core.modules.pithus import retrohunt
 from bazaar.core.utils import get_matching_items_by_dexofuzzy
-from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, BasicUrlDownloadForm, CommentForm
+from bazaar.front.forms import SearchForm, BasicUploadForm, SimilaritySearchForm, \
+    BasicUrlDownloadForm, CommentForm, CompareSearchForm
 from bazaar.front.og import generate_og_card
 from bazaar.front.utils import get_similarity_matrix, generate_world_map, \
     get_sample_timeline, get_andro_cfg_storage_path
@@ -853,3 +854,44 @@ def get_genom(request):
 
 def instance_status(request):
     return render(request, 'front/instance_status.html')
+
+
+def compare_analysis_view(request, *args, **kwargs):
+
+    if request.method == 'GET':
+        left_sha = kwargs.get('left_sha') or request.GET.get('left_sha', '')
+        right_sha = kwargs.get('right_sha') or request.GET.get('right_sha', '')
+
+        f = CompareSearchForm(initial={
+            'left_sha': left_sha,
+            'right_sha': right_sha,
+        })
+
+        res = []
+        left_res = None
+        right_res = None
+
+        if left_sha and right_sha:
+            f = CompareSearchForm({
+                'left_sha': left_sha,
+                'right_sha': right_sha,
+            })
+
+        if f.is_valid():
+            res = f.do_search()
+            if res:
+                left_res = res[0][0]['source']
+                right_res = res[1][0]['source']
+            else:
+                return render(request, 'front/compare_analysis.html')
+
+        print(res)
+        return render(
+            request,
+            'front/compare_analysis.html',
+            context={
+                'form': f,
+                'left_analysis': left_res,
+                'right_analysis': right_res
+            }
+        )

bazaar/static/css/project.css

@@ -7330,3 +7330,27 @@ samp {
   background-color: #dc3545;
   border-radius: 50%;
   border: 2px solid #fff; }
+
+.comparison-table {
+  width: 100%;
+  overflow: hidden; }
+
+.comparison-table-inner {
+  width: 100%;
+  table-layout: fixed; }
+
+.comparison-table-inner th:first-child,
+.comparison-table-inner td:first-child {
+  width: 120px; }
+
+.comparison-table-inner th:nth-child(2),
+.comparison-table-inner th:nth-child(3),
+.comparison-table-inner td:nth-child(2),
+.comparison-table-inner td:nth-child(3) {
+  width: auto;
+  overflow-wrap: break-word; }
+
+.comparison-cell {
+  width: 100%;
+  overflow-x: auto;
+  white-space: nowrap; }

bazaar/static/sass/project.scss

@@ -84,7 +84,6 @@ samp {
   color: $gray-600;
 }
 
-
 .notification-bell {
     position: relative;
     display: inline-block;
@@ -100,3 +99,32 @@ samp {
     border-radius: 50%;
     border: 2px solid #fff;
 }
+
+.comparison-table {
+    width: 100%;
+    overflow: hidden;
+}
+
+.comparison-table-inner {
+    width: 100%;
+    table-layout: fixed;
+}
+
+.comparison-table-inner th:first-child,
+.comparison-table-inner td:first-child {
+    width: 120px;
+}
+
+.comparison-table-inner th:nth-child(2),
+.comparison-table-inner th:nth-child(3),
+.comparison-table-inner td:nth-child(2),
+.comparison-table-inner td:nth-child(3) {
+    width: auto;
+    overflow-wrap: break-word;
+}
+
+.comparison-cell {
+    width: 100%;
+    overflow-x: auto;
+    white-space: nowrap;
+}