Spaces:
Running
Running
| import streamlit as st | |
| import os | |
| import zipfile | |
| import tempfile | |
| import pefile | |
| import subprocess | |
| import binascii | |
| import re | |
| import json | |
| from pathlib import Path | |
| st.set_page_config(page_title="Binary Decompiler", page_icon="🔍", layout="wide") | |
| st.title("Executable Decompiler Tool") | |
| st.markdown(""" | |
| This tool decompiles executables to source code: | |
| - Extracts assembly instructions from any .exe or .dll | |
| - Converts assembly to Python-like or C++-like code | |
| - Extracts embedded strings and resources | |
| - Works with any executable regardless of original language | |
| """) | |
| # Install necessary packages at startup | |
| try: | |
| with st.spinner("Setting up decompilation environment..."): | |
| # Install key analysis libraries | |
| subprocess.run(["pip", "install", "pyinstaller-extractor"], capture_output=True) | |
| subprocess.run(["pip", "install", "uncompyle6"], capture_output=True) | |
| subprocess.run(["pip", "install", "capstone"], capture_output=True) | |
| subprocess.run(["pip", "install", "r2pipe"], capture_output=True) | |
| # Import after installation | |
| import r2pipe | |
| from capstone import Cs, CS_ARCH_X86, CS_MODE_32, CS_MODE_64 | |
| st.success("Environment ready") | |
| except Exception as e: | |
| st.error(f"Setup error: {str(e)}") | |
| def extract_strings(file_path, min_length=4): | |
| """Extract ASCII and Unicode strings from binary file""" | |
| try: | |
| with open(file_path, 'rb') as f: | |
| content = f.read() | |
| # Extract ASCII strings | |
| ascii_pattern = b'[\\x20-\\x7E]{' + str(min_length).encode() + b',}' | |
| ascii_strings = re.findall(ascii_pattern, content) | |
| ascii_strings = [s.decode('ascii') for s in ascii_strings] | |
| # Extract Unicode strings (basic approach) | |
| unicode_pattern = b'(?:[\x20-\x7E]\x00){' + str(min_length).encode() + b',}' | |
| unicode_strings = re.findall(unicode_pattern, content) | |
| unicode_strings = [s.decode('utf-16-le', errors='ignore').rstrip('\x00') for s in unicode_strings] | |
| return sorted(set(ascii_strings + unicode_strings)) | |
| except Exception as e: | |
| return [f"Error extracting strings: {str(e)}"] | |
| def assembly_to_python(assembly_lines): | |
| """Convert assembly code to Python-like code""" | |
| python_code = [] | |
| python_code.append("# Python code decompiled from assembly") | |
| python_code.append("# This is an approximation of the original code") | |
| python_code.append("") | |
| # Track variables and functions | |
| variables = set() | |
| functions = set() | |
| current_function = None | |
| indentation = 0 | |
| in_loop = False | |
| in_condition = False | |
| i = 0 | |
| while i < len(assembly_lines): | |
| line = assembly_lines[i] | |
| # Parse assembly line | |
| if ": " in line: | |
| parts = line.split(": ", 1) | |
| if len(parts) > 1: | |
| addr, instruction = parts | |
| # Function start detection | |
| if "push ebp" in instruction and "mov ebp, esp" in assembly_lines[i+1] if i+1 < len(assembly_lines) else "": | |
| current_function = f"function_{addr}" | |
| functions.add(current_function) | |
| python_code.append(f"\ndef {current_function}():") | |
| indentation = 1 | |
| i += 2 # Skip the function prologue | |
| continue | |
| # Function return detection | |
| if "ret" in instruction and indentation > 0: | |
| python_code.append(f"{' ' * 4 * indentation}return") | |
| indentation = 0 | |
| current_function = None | |
| # Call instruction - function call | |
| if "call" in instruction: | |
| target = instruction.split("call")[1].strip() | |
| if target.startswith("0x"): | |
| called_func = f"function_{target}" | |
| functions.add(called_func) | |
| python_code.append(f"{' ' * 4 * indentation}{called_func}()") | |
| else: | |
| python_code.append(f"{' ' * 4 * indentation}# Call to external function: {target}") | |
| # Variable assignment (mov) | |
| elif "mov" in instruction: | |
| dest, source = instruction.split("mov")[1].split(",", 1) | |
| dest = dest.strip() | |
| source = source.strip() | |
| if dest not in variables: | |
| variables.add(dest) | |
| python_code.append(f"{' ' * 4 * indentation}{dest} = {source}") | |
| # Comparison and jumps (if statements) | |
| elif "cmp" in instruction: | |
| parts = instruction.split("cmp")[1].split(",", 1) | |
| if len(parts) > 1: | |
| a, b = parts | |
| a = a.strip() | |
| b = b.strip() | |
| # Look ahead for jump instruction | |
| next_line = assembly_lines[i+1] if i+1 < len(assembly_lines) else "" | |
| if "j" in next_line: # Any jump instruction | |
| jump_type = next_line.split(": ")[1].split()[0] if ": " in next_line else "" | |
| if jump_type == "je" or jump_type == "jz": | |
| python_code.append(f"{' ' * 4 * indentation}if {a} == {b}:") | |
| elif jump_type == "jne" or jump_type == "jnz": | |
| python_code.append(f"{' ' * 4 * indentation}if {a} != {b}:") | |
| elif jump_type == "jg" or jump_type == "jnle": | |
| python_code.append(f"{' ' * 4 * indentation}if {a} > {b}:") | |
| elif jump_type == "jge" or jump_type == "jnl": | |
| python_code.append(f"{' ' * 4 * indentation}if {a} >= {b}:") | |
| elif jump_type == "jl" or jump_type == "jnge": | |
| python_code.append(f"{' ' * 4 * indentation}if {a} < {b}:") | |
| elif jump_type == "jle" or jump_type == "jng": | |
| python_code.append(f"{' ' * 4 * indentation}if {a} <= {b}:") | |
| else: | |
| python_code.append(f"{' ' * 4 * indentation}# Comparison: {a} ? {b}") | |
| indentation += 1 | |
| in_condition = True | |
| i += 1 # Skip the jump instruction | |
| continue | |
| # Loop detection (simplified) | |
| elif "loop" in instruction or "jmp" in instruction: | |
| if not in_loop: | |
| python_code.append(f"{' ' * 4 * indentation}while True: # Loop at {addr}") | |
| indentation += 1 | |
| in_loop = True | |
| else: | |
| python_code.append(f"{' ' * 4 * indentation}# Jump or loop at {addr}") | |
| # Add/sub operations | |
| elif "add" in instruction: | |
| parts = instruction.split("add")[1].split(",", 1) | |
| if len(parts) > 1: | |
| dest, value = parts | |
| dest = dest.strip() | |
| value = value.strip() | |
| python_code.append(f"{' ' * 4 * indentation}{dest} += {value}") | |
| elif "sub" in instruction: | |
| parts = instruction.split("sub")[1].split(",", 1) | |
| if len(parts) > 1: | |
| dest, value = parts | |
| dest = dest.strip() | |
| value = value.strip() | |
| python_code.append(f"{' ' * 4 * indentation}{dest} -= {value}") | |
| # Other arithmetic | |
| elif "mul" in instruction: | |
| operand = instruction.split("mul")[1].strip() | |
| python_code.append(f"{' ' * 4 * indentation}# Multiply by {operand}") | |
| elif "div" in instruction: | |
| operand = instruction.split("div")[1].strip() | |
| python_code.append(f"{' ' * 4 * indentation}# Divide by {operand}") | |
| # Default case - just comment the assembly | |
| else: | |
| python_code.append(f"{' ' * 4 * indentation}# {instruction}") | |
| i += 1 | |
| # Add main execution | |
| python_code.append("\nif __name__ == '__main__':") | |
| if functions: | |
| first_function = next(iter(functions)) | |
| python_code.append(f" {first_function}()") | |
| else: | |
| python_code.append(" pass # No clear entry point found") | |
| return "\n".join(python_code) | |
| def assembly_to_cpp(assembly_lines): | |
| """Convert assembly code to C++-like code""" | |
| cpp_code = [] | |
| cpp_code.append("// C++ code decompiled from assembly") | |
| cpp_code.append("// This is an approximation of the original code") | |
| cpp_code.append("") | |
| cpp_code.append("#include <iostream>") | |
| cpp_code.append("#include <vector>") | |
| cpp_code.append("#include <string>") | |
| cpp_code.append("") | |
| # Track variables and functions | |
| variables = set() | |
| functions = set() | |
| current_function = None | |
| indentation = 0 | |
| in_loop = False | |
| in_condition = False | |
| # Add forward declarations | |
| cpp_code.append("// Forward declarations") | |
| i = 0 | |
| # First pass to identify functions | |
| while i < len(assembly_lines): | |
| line = assembly_lines[i] | |
| # Parse assembly line | |
| if ": " in line: | |
| parts = line.split(": ", 1) | |
| if len(parts) > 1: | |
| addr, instruction = parts | |
| # Function start detection | |
| if "push ebp" in instruction and "mov ebp, esp" in assembly_lines[i+1] if i+1 < len(assembly_lines) else "": | |
| func_name = f"function_{addr.replace('0x', '')}" | |
| functions.add(func_name) | |
| cpp_code.append(f"void {func_name}();") | |
| i += 1 | |
| cpp_code.append("") | |
| cpp_code.append("// Variable declarations") | |
| cpp_code.append("int eax, ebx, ecx, edx, esi, edi, ebp, esp;") | |
| cpp_code.append("") | |
| # Second pass to generate function code | |
| i = 0 | |
| while i < len(assembly_lines): | |
| line = assembly_lines[i] | |
| # Parse assembly line | |
| if ": " in line: | |
| parts = line.split(": ", 1) | |
| if len(parts) > 1: | |
| addr, instruction = parts | |
| # Function start detection | |
| if "push ebp" in instruction and "mov ebp, esp" in assembly_lines[i+1] if i+1 < len(assembly_lines) else "": | |
| current_function = f"function_{addr.replace('0x', '')}" | |
| cpp_code.append(f"\nvoid {current_function}() {{") | |
| indentation = 1 | |
| i += 2 # Skip the function prologue | |
| continue | |
| # Function return detection | |
| if "ret" in instruction and indentation > 0: | |
| cpp_code.append(f"{' ' * 4 * indentation}return;") | |
| cpp_code.append("}") | |
| indentation = 0 | |
| current_function = None | |
| # Call instruction - function call | |
| if "call" in instruction: | |
| target = instruction.split("call")[1].strip() | |
| if target.startswith("0x"): | |
| called_func = f"function_{target.replace('0x', '')}" | |
| cpp_code.append(f"{' ' * 4 * indentation}{called_func}();") | |
| else: | |
| cpp_code.append(f"{' ' * 4 * indentation}// Call to external function: {target}") | |
| # Variable assignment (mov) | |
| elif "mov" in instruction: | |
| dest, source = instruction.split("mov")[1].split(",", 1) | |
| dest = dest.strip() | |
| source = source.strip() | |
| # Check if memory access | |
| if "[" in dest: | |
| cpp_code.append(f"{' ' * 4 * indentation}// Memory write to {dest}") | |
| elif "[" in source: | |
| cpp_code.append(f"{' ' * 4 * indentation}// Memory read from {source}") | |
| else: | |
| cpp_code.append(f"{' ' * 4 * indentation}{dest} = {source};") | |
| # Comparison and jumps (if statements) | |
| elif "cmp" in instruction: | |
| parts = instruction.split("cmp")[1].split(",", 1) | |
| if len(parts) > 1: | |
| a, b = parts | |
| a = a.strip() | |
| b = b.strip() | |
| # Look ahead for jump instruction | |
| next_line = assembly_lines[i+1] if i+1 < len(assembly_lines) else "" | |
| if "j" in next_line: # Any jump instruction | |
| jump_type = next_line.split(": ")[1].split()[0] if ": " in next_line else "" | |
| if jump_type == "je" or jump_type == "jz": | |
| cpp_code.append(f"{' ' * 4 * indentation}if ({a} == {b}) {{") | |
| elif jump_type == "jne" or jump_type == "jnz": | |
| cpp_code.append(f"{' ' * 4 * indentation}if ({a} != {b}) {{") | |
| elif jump_type == "jg" or jump_type == "jnle": | |
| cpp_code.append(f"{' ' * 4 * indentation}if ({a} > {b}) {{") | |
| elif jump_type == "jge" or jump_type == "jnl": | |
| cpp_code.append(f"{' ' * 4 * indentation}if ({a} >= {b}) {{") | |
| elif jump_type == "jl" or jump_type == "jnge": | |
| cpp_code.append(f"{' ' * 4 * indentation}if ({a} < {b}) {{") | |
| elif jump_type == "jle" or jump_type == "jng": | |
| cpp_code.append(f"{' ' * 4 * indentation}if ({a} <= {b}) {{") | |
| else: | |
| cpp_code.append(f"{' ' * 4 * indentation}// Comparison: {a} ? {b}") | |
| indentation += 1 | |
| in_condition = True | |
| i += 1 # Skip the jump instruction | |
| continue | |
| # Loop detection (simplified) | |
| elif "loop" in instruction or "jmp" in instruction: | |
| if not in_loop: | |
| cpp_code.append(f"{' ' * 4 * indentation}while (true) {{ // Loop at {addr}") | |
| indentation += 1 | |
| in_loop = True | |
| else: | |
| cpp_code.append(f"{' ' * 4 * indentation}// Jump or loop at {addr}") | |
| # Add/sub operations | |
| elif "add" in instruction: | |
| parts = instruction.split("add")[1].split(",", 1) | |
| if len(parts) > 1: | |
| dest, value = parts | |
| dest = dest.strip() | |
| value = value.strip() | |
| cpp_code.append(f"{' ' * 4 * indentation}{dest} += {value};") | |
| elif "sub" in instruction: | |
| parts = instruction.split("sub")[1].split(",", 1) | |
| if len(parts) > 1: | |
| dest, value = parts | |
| dest = dest.strip() | |
| value = value.strip() | |
| cpp_code.append(f"{' ' * 4 * indentation}{dest} -= {value};") | |
| # Other arithmetic | |
| elif "mul" in instruction: | |
| operand = instruction.split("mul")[1].strip() | |
| cpp_code.append(f"{' ' * 4 * indentation}// Multiply by {operand}") | |
| elif "div" in instruction: | |
| operand = instruction.split("div")[1].strip() | |
| cpp_code.append(f"{' ' * 4 * indentation}// Divide by {operand}") | |
| # Default case - just comment the assembly | |
| else: | |
| cpp_code.append(f"{' ' * 4 * indentation}// {instruction}") | |
| i += 1 | |
| # Add main function | |
| cpp_code.append("\nint main() {") | |
| if functions: | |
| first_function = next(iter(functions)) | |
| cpp_code.append(f" {first_function}();") | |
| else: | |
| cpp_code.append(" // No clear entry point found") | |
| cpp_code.append(" return 0;") | |
| cpp_code.append("}") | |
| return "\n".join(cpp_code) | |
| def try_pyinstaller_extraction(file_path, output_dir): | |
| """Attempt to extract Python scripts from PyInstaller executables""" | |
| try: | |
| # Run pyinstaller-extractor on the file | |
| # Try both potential command names | |
| try: | |
| result = subprocess.run(["python", "-m", "pyinstxtractor", file_path], | |
| cwd=output_dir, capture_output=True, text=True) | |
| except: | |
| try: | |
| result = subprocess.run(["python", "-m", "pyinstaller_extractor", file_path], | |
| cwd=output_dir, capture_output=True, text=True) | |
| except: | |
| # Direct command attempt | |
| result = subprocess.run(["pyinstxtractor", file_path], | |
| cwd=output_dir, capture_output=True, text=True) | |
| extracted_dir = os.path.join(output_dir, os.path.basename(file_path) + "_extracted") | |
| if not os.path.exists(extracted_dir): | |
| # Try with different naming convention | |
| potential_dirs = [d for d in os.listdir(output_dir) if os.path.isdir(os.path.join(output_dir, d)) and "_extracted" in d] | |
| if potential_dirs: | |
| extracted_dir = os.path.join(output_dir, potential_dirs[0]) | |
| if os.path.exists(extracted_dir): | |
| # Try to decompile the Python bytecode files | |
| python_files = {} | |
| for root, _, files in os.walk(extracted_dir): | |
| for file in files: | |
| if file.endswith('.pyc') or file.endswith('.pyo'): | |
| pyc_path = os.path.join(root, file) | |
| py_path = pyc_path + ".py" | |
| try: | |
| # Try decompiling with uncompyle6 | |
| subprocess.run(["uncompyle6", pyc_path, "-o", py_path], capture_output=True) | |
| if os.path.exists(py_path): | |
| with open(py_path, 'r', encoding='utf-8', errors='ignore') as f: | |
| rel_path = os.path.relpath(pyc_path, extracted_dir) | |
| python_files[rel_path] = f.read() | |
| except: | |
| pass | |
| # Check if we found the PYZ archive (PyInstaller specific) | |
| pyz_files = [] | |
| for root, _, files in os.walk(extracted_dir): | |
| for file in files: | |
| if file.endswith('.pyz'): | |
| pyz_path = os.path.join(root, file) | |
| # Extract PYZ contents | |
| pyz_extract_dir = pyz_path + "_extracted" | |
| os.makedirs(pyz_extract_dir, exist_ok=True) | |
| try: | |
| # Try different extraction methods for the PYZ | |
| try: | |
| subprocess.run(["python", "-m", "pyinstxtractor", pyz_path], | |
| cwd=output_dir, capture_output=True) | |
| except: | |
| try: | |
| subprocess.run(["python", "-m", "pyinstaller_extractor", pyz_path], | |
| cwd=output_dir, capture_output=True) | |
| except: | |
| # Direct command attempt | |
| subprocess.run(["pyinstxtractor", pyz_path], | |
| cwd=output_dir, capture_output=True) | |
| # Look for extracted PYZ content | |
| if os.path.exists(pyz_extract_dir): | |
| for pyz_root, _, pyz_files in os.walk(pyz_extract_dir): | |
| for pyz_file in pyz_files: | |
| if pyz_file.endswith('.pyc') or pyz_file.endswith('.pyo'): | |
| pyc_path = os.path.join(pyz_root, pyz_file) | |
| py_path = pyc_path + ".py" | |
| try: | |
| subprocess.run(["uncompyle6", pyc_path, "-o", py_path], capture_output=True) | |
| if os.path.exists(py_path): | |
| with open(py_path, 'r', encoding='utf-8', errors='ignore') as f: | |
| rel_path = os.path.join("PYZ_ARCHIVE", os.path.relpath(pyc_path, pyz_extract_dir)) | |
| python_files[rel_path] = f.read() | |
| except: | |
| pass | |
| except: | |
| pass | |
| return { | |
| "success": True, | |
| "message": "Successfully extracted Python code", | |
| "files": python_files | |
| } | |
| return { | |
| "success": False, | |
| "message": "Not a PyInstaller executable or extraction failed" | |
| } | |
| except Exception as e: | |
| return { | |
| "success": False, | |
| "message": f"PyInstaller extraction error: {str(e)}" | |
| } | |
| def disassemble_binary(file_path, is_dll=False): | |
| """Disassemble a binary file to get assembly code""" | |
| try: | |
| # Try with radare2 first | |
| try: | |
| import r2pipe | |
| r2 = r2pipe.open(file_path) | |
| r2.cmd("aaa") # Analyze all | |
| # Get main or entry point disassembly | |
| main_disasm = r2.cmd("s main; pdf") | |
| if not main_disasm or "Cannot find function" in main_disasm: | |
| main_disasm = r2.cmd("s entry0; pdf") # Try entry point instead | |
| # Get list of functions | |
| functions = r2.cmd("afl") | |
| # Get all functions disassembly for more complete code | |
| all_functions_disasm = [] | |
| function_addresses = re.findall(r'0x[0-9a-fA-F]+', functions) | |
| for addr in function_addresses[:10]: # Limit to first 10 functions to avoid huge output | |
| func_disasm = r2.cmd(f"s {addr}; pdf") | |
| all_functions_disasm.append(func_disasm) | |
| r2.quit() | |
| # Extract assembly instructions | |
| assembly_lines = [] | |
| for disasm in [main_disasm] + all_functions_disasm: | |
| for line in disasm.splitlines(): | |
| if "│" in line: # radare2 format contains this separator | |
| parts = line.split("│") | |
| if len(parts) > 1: | |
| addr_part = parts[0].strip() | |
| instr_part = parts[-1].strip() | |
| if addr_part and instr_part and "0x" in addr_part: | |
| address = addr_part.strip() | |
| instruction = instr_part.strip() | |
| assembly_lines.append(f"{address}: {instruction}") | |
| return assembly_lines | |
| except: | |
| # Fallback to pefile + capstone if radare2 fails | |
| pe = pefile.PE(file_path) | |
| # Determine if 32-bit or 64-bit | |
| is_64bit = pe.OPTIONAL_HEADER.Magic == 0x20b | |
| mode = CS_MODE_64 if is_64bit else CS_MODE_32 | |
| # Initialize disassembler | |
| md = Cs(CS_ARCH_X86, mode) | |
| md.detail = True | |
| assembly_lines = [] | |
| # Find and disassemble code sections | |
| for section in pe.sections: | |
| if section.Characteristics & 0x20000000: # IMAGE_SCN_CNT_CODE | |
| section_data = pe.get_data(section.VirtualAddress, section.SizeOfRawData) | |
| section_addr = pe.OPTIONAL_HEADER.ImageBase + section.VirtualAddress | |
| # Disassemble section code | |
| for i, (address, size, mnemonic, op_str) in enumerate(md.disasm_lite(section_data, section_addr)): | |
| if i >= 500: # Limit to 500 instructions per section | |
| break | |
| assembly_lines.append(f"0x{address:08x}: {mnemonic} {op_str}") | |
| return assembly_lines | |
| except Exception as e: | |
| return [f"Disassembly error: {str(e)}"] | |
| def analyze_binary(file_path, is_dll=False): | |
| """Comprehensive analysis and decompilation of a binary file""" | |
| try: | |
| results = {} | |
| # Basic PE information using pefile | |
| pe = pefile.PE(file_path) | |
| # General info | |
| results["basic_info"] = { | |
| "Machine": hex(pe.FILE_HEADER.Machine), | |
| "TimeDateStamp": pe.FILE_HEADER.TimeDateStamp, | |
| "NumberOfSections": pe.FILE_HEADER.NumberOfSections, | |
| "SizeOfImage": pe.OPTIONAL_HEADER.SizeOfImage, | |
| "EntryPoint": hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint), | |
| "ImageBase": hex(pe.OPTIONAL_HEADER.ImageBase), | |
| "Subsystem": pe.OPTIONAL_HEADER.Subsystem | |
| } | |
| # Section information | |
| results["sections"] = [] | |
| for section in pe.sections: | |
| section_name = section.Name.decode('utf-8', errors='ignore').strip('\x00') | |
| results["sections"].append({ | |
| "Name": section_name, | |
| "VirtualAddress": hex(section.VirtualAddress), | |
| "VirtualSize": section.Misc_VirtualSize, | |
| "SizeOfRawData": section.SizeOfRawData, | |
| "Entropy": section.get_entropy(), | |
| "Characteristics": hex(section.Characteristics) | |
| }) | |
| # Import information | |
| results["imports"] = [] | |
| if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'): | |
| for entry in pe.DIRECTORY_ENTRY_IMPORT: | |
| dll_name = entry.dll.decode('utf-8', errors='ignore') | |
| imports = [] | |
| for imp in entry.imports: | |
| if imp.name: | |
| imports.append(imp.name.decode('utf-8', errors='ignore')) | |
| results["imports"].append({ | |
| "DLL": dll_name, | |
| "Functions": imports | |
| }) | |
| # Export information (for DLLs) | |
| results["exports"] = [] | |
| if is_dll and hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'): | |
| for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols: | |
| if exp.name: | |
| results["exports"].append({ | |
| "Name": exp.name.decode('utf-8', errors='ignore'), | |
| "Address": hex(pe.OPTIONAL_HEADER.ImageBase + exp.address), | |
| "Ordinal": exp.ordinal | |
| }) | |
| # Extract strings | |
| results["strings"] = extract_strings(file_path) | |
| # Disassemble to get assembly | |
| assembly_lines = disassemble_binary(file_path, is_dll) | |
| results["assembly_lines"] = assembly_lines | |
| # Convert assembly to Python | |
| results["python_code"] = assembly_to_python(assembly_lines) | |
| # Convert assembly to C++ | |
| results["cpp_code"] = assembly_to_cpp(assembly_lines) | |
| return results | |
| except Exception as e: | |
| return {"Error": str(e)} | |
| def process_zip_file(file_path, temp_dir): | |
| """Process a ZIP file and extract its contents""" | |
| try: | |
| with zipfile.ZipFile(file_path, 'r') as zip_ref: | |
| # Get file list before extraction | |
| file_list = zip_ref.namelist() | |
| # Extract to temp directory | |
| zip_ref.extractall(temp_dir) | |
| # Check for nested executables | |
| nested_files = {} | |
| for root, _, files in os.walk(temp_dir): | |
| for file in files: | |
| full_path = os.path.join(root, file) | |
| rel_path = os.path.relpath(full_path, temp_dir) | |
| if file.endswith('.exe'): | |
| exe_output_dir = os.path.join(temp_dir, f"{file}_unpacked") | |
| os.makedirs(exe_output_dir, exist_ok=True) | |
| nested_files[rel_path] = { | |
| 'type': 'exe', | |
| 'analysis': analyze_binary(full_path), | |
| 'python_extraction': try_pyinstaller_extraction(full_path, exe_output_dir) | |
| } | |
| elif file.endswith('.dll'): | |
| nested_files[rel_path] = { | |
| 'type': 'dll', | |
| 'analysis': analyze_binary(full_path, is_dll=True) | |
| } | |
| return { | |
| 'file_list': file_list, | |
| 'nested_files': nested_files | |
| } | |
| except Exception as e: | |
| return {'error': str(e)} | |
| # Main app logic | |
| uploaded_file = st.file_uploader("Upload a file (.zip, .exe, or .dll)", type=["zip", "exe", "dll"]) | |
| if uploaded_file is not None: | |
| with tempfile.TemporaryDirectory() as temp_dir: | |
| # Save the uploaded file to the temporary directory | |
| file_path = os.path.join(temp_dir, uploaded_file.name) | |
| with open(file_path, "wb") as f: | |
| f.write(uploaded_file.getbuffer()) | |
| st.success(f"File uploaded: {uploaded_file.name}") | |
| # Display file size | |
| file_size = os.path.getsize(file_path) | |
| st.info(f"File size: {file_size/1024:.2f} KB") | |
| # Process based on file type | |
| if uploaded_file.name.lower().endswith('.zip'): | |
| st.subheader("ZIP File Contents") | |
| with st.spinner("Analyzing ZIP contents..."): | |
| output_dir = os.path.join(temp_dir, "extracted") | |
| os.makedirs(output_dir, exist_ok=True) | |
| result = process_zip_file(file_path, output_dir) | |
| if 'error' in result: | |
| st.error(f"Error processing ZIP file: {result['error']}") | |
| else: | |
| with st.expander("ZIP Contents", expanded=True): | |
| st.write(f"Total files: {len(result['file_list'])}") | |
| st.code("\n".join(result['file_list'])) | |
| if result['nested_files']: | |
| st.subheader("Detected Executable Files") | |
| for file_path, file_info in result['nested_files'].items(): | |
| with st.expander(f"{file_path} ({file_info['type'].upper()})"): | |
| if file_info['type'] == 'exe': | |
| analysis = file_info['analysis'] | |
| python_extraction = file_info['python_extraction'] | |
| tabs = st.tabs(["Python Code", "C++ Code", "Assembly", "Imports", "Strings"]) | |
| with tabs[0]: | |
| if "Error" in analysis: | |
| st.error(analysis["Error"]) | |
| else: | |
| # Check if we have extracted Python code | |
| if python_extraction.get("success", False): | |
| st.success("Original Python code extracted successfully!") | |
| for filename, content in python_extraction.get("files", {}).items(): | |
| with st.expander(f"Python File: {filename}"): | |
| st.code(content, language="python") | |
| else: | |
| # Show decompiled Python from assembly | |
| st.warning("Converting assembly to Python code (not original source)") | |
| st.code(analysis.get("python_code", "# Failed to generate Python code"), language="python") | |
| with tabs[1]: | |
| st.subheader("Decompiled C++ Code") | |
| st.code(analysis.get("cpp_code", "// Failed to generate C++ code"), language="cpp") | |
| with tabs[2]: | |
| st.subheader("Assembly Code") | |
| assembly = "\n".join(analysis.get("assembly_lines", [])) | |
| st.code(assembly, language="asm") | |
| with tabs[3]: | |
| st.subheader("Imported Functions") | |
| for imp in analysis.get("imports", []): | |
| with st.expander(f"DLL: {imp['DLL']}"): | |
| st.code("\n".join(imp["Functions"])) | |
| with tabs[4]: | |
| st.subheader("Strings Found") | |
| all_strings = analysis.get("strings", []) | |
| interesting_strings = [s for s in all_strings if len(s) > 8] # Filter out very short strings | |
| st.code("\n".join(interesting_strings[:500])) # Limit to 500 strings | |
| else: # DLL | |
| analysis = file_info['analysis'] | |
| tabs = st.tabs(["Python Code", "C++ Code", "Assembly", "Exports", "Imports", "Strings"]) | |
| with tabs[0]: | |
| if "Error" in analysis: | |
| st.error(analysis["Error"]) | |
| else: | |
| st.subheader("Decompiled Python Code") | |
| st.code(analysis.get("python_code", "# Failed to generate Python code"), language="python") | |
| with tabs[1]: | |
| st.subheader("Decompiled C++ Code") | |
| st.code(analysis.get("cpp_code", "// Failed to generate C++ code"), language="cpp") | |
| with tabs[2]: | |
| st.subheader("Assembly Code") | |
| assembly = "\n".join(analysis.get("assembly_lines", [])) | |
| st.code(assembly, language="asm") | |
| with tabs[3]: | |
| st.subheader("Exported Functions") | |
| st.json(analysis.get("exports", [])) | |
| with tabs[4]: | |
| st.subheader("Imported Functions") | |
| for imp in analysis.get("imports", []): | |
| with st.expander(f"DLL: {imp['DLL']}"): | |
| st.code("\n".join(imp["Functions"])) | |
| with tabs[5]: | |
| st.subheader("Strings Found") | |
| all_strings = analysis.get("strings", []) | |
| interesting_strings = [s for s in all_strings if len(s) > 8] # Filter out very short strings | |
| st.code("\n".join(interesting_strings[:500])) # Limit to 500 strings | |
| elif uploaded_file.name.lower().endswith('.exe'): | |
| st.subheader("EXE File Analysis") | |
| with st.spinner("Decompiling executable..."): | |
| output_dir = os.path.join(temp_dir, "exe_unpacked") | |
| os.makedirs(output_dir, exist_ok=True) | |
| # Perform comprehensive analysis | |
| analysis = analyze_binary(file_path) | |
| # Try Python extraction | |
| python_extraction = try_pyinstaller_extraction(file_path, output_dir) | |
| tabs = st.tabs(["Python Code", "C++ Code", "Assembly", "Summary", "Imports", "Strings"]) | |
| with tabs[0]: | |
| if "Error" in analysis: | |
| st.error(analysis["Error"]) | |
| else: | |
| # Check if we have extracted Python code | |
| if python_extraction.get("success", False): | |
| st.success("Original Python code extracted successfully!") | |
| for filename, content in python_extraction.get("files", {}).items(): | |
| with st.expander(f"Python File: {filename}"): | |
| st.code(content, language="python") | |
| else: | |
| # Show decompiled Python from assembly | |
| st.warning("Converting assembly to Python code (not original source)") | |
| st.code(analysis.get("python_code", "# Failed to generate Python code"), language="python") | |
| with tabs[1]: | |
| st.subheader("Decompiled C++ Code") | |
| st.code(analysis.get("cpp_code", "// Failed to generate C++ code"), language="cpp") | |
| with tabs[2]: | |
| st.subheader("Assembly Code") | |
| assembly = "\n".join(analysis.get("assembly_lines", [])) | |
| st.code(assembly, language="asm") | |
| with tabs[3]: | |
| st.subheader("Basic Information") | |
| st.json(analysis.get("basic_info", {})) | |
| st.subheader("Sections") | |
| sections_df = { | |
| "Name": [], | |
| "VirtualSize": [], | |
| "SizeOfRawData": [], | |
| "Entropy": [] | |
| } | |
| for section in analysis.get("sections", []): | |
| sections_df["Name"].append(section["Name"]) | |
| sections_df["VirtualSize"].append(section["VirtualSize"]) | |
| sections_df["SizeOfRawData"].append(section["SizeOfRawData"]) | |
| sections_df["Entropy"].append(section["Entropy"]) | |
| st.dataframe(sections_df) | |
| with tabs[4]: | |
| st.subheader("Imported Functions") | |
| for imp in analysis.get("imports", []): | |
| with st.expander(f"DLL: {imp['DLL']}"): | |
| st.code("\n".join(imp["Functions"])) | |
| with tabs[5]: | |
| st.subheader("Strings Found") | |
| all_strings = analysis.get("strings", []) | |
| interesting_strings = [s for s in all_strings if len(s) > 8] # Filter out very short strings | |
| st.code("\n".join(interesting_strings[:500])) # Limit to 500 strings | |
| elif uploaded_file.name.lower().endswith('.dll'): | |
| st.subheader("DLL File Analysis") | |
| with st.spinner("Decompiling DLL..."): | |
| # Perform comprehensive analysis (with is_dll=True) | |
| analysis = analyze_binary(file_path, is_dll=True) | |
| tabs = st.tabs(["Python Code", "C++ Code", "Assembly", "Summary", "Exports", "Imports", "Strings"]) | |
| with tabs[0]: | |
| if "Error" in analysis: | |
| st.error(analysis["Error"]) | |
| else: | |
| st.subheader("Decompiled Python Code") | |
| st.code(analysis.get("python_code", "# Failed to generate Python code"), language="python") | |
| with tabs[1]: | |
| st.subheader("Decompiled C++ Code") | |
| st.code(analysis.get("cpp_code", "// Failed to generate C++ code"), language="cpp") | |
| with tabs[2]: | |
| st.subheader("Assembly Code") | |
| assembly = "\n".join(analysis.get("assembly_lines", [])) | |
| st.code(assembly, language="asm") | |
| with tabs[3]: | |
| st.subheader("Basic Information") | |
| st.json(analysis.get("basic_info", {})) | |
| st.subheader("Sections") | |
| sections_df = { | |
| "Name": [], | |
| "VirtualSize": [], | |
| "SizeOfRawData": [], | |
| "Entropy": [] | |
| } | |
| for section in analysis.get("sections", []): | |
| sections_df["Name"].append(section["Name"]) | |
| sections_df["VirtualSize"].append(section["VirtualSize"]) | |
| sections_df["SizeOfRawData"].append(section["SizeOfRawData"]) | |
| sections_df["Entropy"].append(section["Entropy"]) | |
| st.dataframe(sections_df) | |
| with tabs[4]: | |
| st.subheader("Exported Functions") | |
| st.json(analysis.get("exports", [])) | |
| with tabs[5]: | |
| st.subheader("Imported Functions") | |
| for imp in analysis.get("imports", []): | |
| with st.expander(f"DLL: {imp['DLL']}"): | |
| st.code("\n".join(imp["Functions"])) | |
| with tabs[6]: | |
| st.subheader("Strings Found") | |
| all_strings = analysis.get("strings", []) | |
| interesting_strings = [s for s in all_strings if len(s) > 8] # Filter out very short strings | |
| st.code("\n".join(interesting_strings[:500])) # Limit to 500 strings |