Harden entitlement extraction and refactor format parsers

.github/workflows/test.yml

@@ -0,0 +1,32 @@
+name: Unit Tests
+
+on:
+  pull_request:
+    paths:
+      - '**.py'
+      - '**.yar'
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      with:
+        python-version: '3.11.4'
+
+    - name: Install Requirements
+      run: |
+        pip install -r requirements.txt pytest
+        pip install .
+
+    - name: Run Unit Tests
+      run: |
+        pytest

permhash/detect.yar

@@ -1,34 +1,37 @@
 rule M_Hunting_IPA_1
-{	
-        meta:		
-            author = "jaredswilson"        
-            description = "Help identify IPA files."        
-            md5 = "ddbac462c5a5c21c0c4811597d292679"        
-            date_created = "2024-03-04"	
-        strings:		
-            $header = { 50 4B 03 04 }		
-            $app = ".app/"		
-            $pl = "Payload/"		
-            $plist = "Info.plist"		
-            $re = /Payload\/[^\/]+\.app/	
-        condition:		
+{
+        meta:
+            author = "jaredswilson"
+            description = "Help identify IPA files."
+            md5 = "ddbac462c5a5c21c0c4811597d292679"
+            date_created = "2024-03-04"
+        strings:
+            $header = { 50 4B 03 04 }
+            $app = ".app/"
+            $pl = "Payload/"
+            $plist = "Info.plist"
+            $re = /Payload\/[^\/]+\.app/
+        condition:
             $header at 0 and all of them
 }
 
 rule M_Hunting_MachO_Entitlements_1
-{    
-        meta:    	
-            author = "jaredswilson"        
-            description = "Help identify Mach-O files with entitlements."        
-            md5 = "4ef9738b7c319c9b65f245cbbf340627"        
-            date_created = "2024-03-04"    
-        strings:        
-            $entitlement_magic = {fa de 71 71}        
-            $plist = "<plist"        
-            $dict = "<dict"    
-        condition:        
-            ((uint32(0) == 0xcafebabe) or (uint32(0) == 0xfeedface) or (uint32(0) == 0xfeedfacf) or 
-            (uint32(0) == 0xbebafeca) or (uint32(0) == 0xcefaedfe) or (uint32(0) == 0xcffaedfe)) and 
-            (all of them) and         
-            for any i in (1..#plist) : ((@plist[i] > @entitlement_magic) and (@plist[i] < @entitlement_magic + 300))
+{
+        meta:
+            author = "jaredswilson"
+            description = "Help identify Mach-O files with entitlements."
+            md5 = "4ef9738b7c319c9b65f245cbbf340627"
+            date_created = "2024-03-04"
+        strings:
+            $entitlement_magic = {fa de 71 71}
+            $plist = "<plist"
+            $dict = "<dict"
+        condition:
+            ((uint32(0) == 0xcafebabe) or (uint32(0) == 0xfeedface) or (uint32(0) == 0xfeedfacf) or
+            (uint32(0) == 0xbebafeca) or (uint32(0) == 0xcefaedfe) or (uint32(0) == 0xcffaedfe) or
+            (uint32(0) == 0xcafebabf) or (uint32(0) == 0xbfbafeca)) and
+            (all of them) and
+            for any j in (1..#entitlement_magic) : (
+                for any i in (1..#plist) : ((@plist[i] > @entitlement_magic[j]) and (@plist[i] < @entitlement_magic[j] + 300))
+            )
 }

permhash/functions.py

@@ -14,17 +14,25 @@
 limitations under the License.
 """
 
-import logging
 from permhash.helpers import (
-    check_type,
     calc_permhash,
-    create_crx_permlist,
-    create_crx_manifest_permlist,
+    check_type,
     create_apk_manifest_permlist,
     create_apk_permlist,
+    create_crx_manifest_permlist,
+    create_crx_permlist,
     create_ipa_permlist,
-    create_macho_permlist,)
-from permhash.mimetypes import *
+    create_macho_permlist,
+)
+from permhash.mimetypes import (
+    APK_MANIFEST_MIMETYPES,
+    APK_MIMETYPES,
+    CRX_MANIFEST_MIMETYPES,
+    CRX_MIMETYPES,
+    IPA_MIMETYPES,
+    MACHO_MIMETYPES,
+)
+
 
 def permhash_crx(path):
     """
@@ -35,14 +43,7 @@ def permhash_crx(path):
     :param path: The targeted file
     :type path: string
     """
-    if check_type(path, CRX_MIMETYPES):
-        return calc_permhash(create_crx_permlist(path), path)
-    logging.warning(
-        "This file is not a type that is currently handled \
-            (CRX, APK, CRX Manifest, or APK Manifest): (%s)",
-        path,
-    )
-    return False
+    return calc_permhash(create_crx_permlist(path), path)
 
 
 def permhash_crx_manifest(path):
@@ -54,77 +55,44 @@ def permhash_crx_manifest(path):
     :param path: The targeted file
     :type path: string
     """
-    if check_type(path, CRX_MANIFEST_MIMETYPES):
-        return calc_permhash(create_crx_manifest_permlist(path), path)
-    logging.warning(
-        "This file is not a type that is currently handled \
-(CRX, APK, CRX Manifest, or APK Manifest): (%s)",
-        path,
-    )
-    return False
+    return calc_permhash(create_crx_manifest_permlist(path), path)
 
 
 def permhash_apk_manifest(path):
     """
-    Returns the permhash of a file at the designated path
+    Returns the permhash of a file at the designated path.
 
     :param path: The targeted file
     :type path: string
     """
-    if check_type(path, APK_MANIFEST_MIMETYPES):
-        return calc_permhash(create_apk_manifest_permlist(path), path)
-    logging.warning(
-        "This file is not a type that is currently handled \
-(CRX, APK, CRX Manifest, or APK Manifest): (%s)",
-        path,
-    )
-    return False
+    return calc_permhash(create_apk_manifest_permlist(path), path)
 
 
 def permhash_apk(path):
     """
-    Returns the permhash of a file at the designated path
+    Returns the permhash of a file at the designated path.
 
     :param path: The targeted file
     :type path: string
     """
-    if check_type(path, APK_MIMETYPES):
-        return calc_permhash(create_apk_permlist(path), path)
-    logging.warning(
-        "This file is not a type that is currently handled \
-(CRX, APK, CRX Manifest, or APK Manifest): (%s)",
-        path,
-    )
-    return False
+    return calc_permhash(create_apk_permlist(path), path)
+
 
 def permhash_ipa(path):
     """
-    Returns the permhash of a file at the designated path
+    Returns the permhash of a file at the designated path.
 
     :param path: The targeted file
     :type path: string
     """
-    if check_type(path, IPA_MIMETYPES):
-        return calc_permhash(create_ipa_permlist(path), path)
-    logging.warning(
-        "This file is not a type that is currently handled \
-(CRX, APK, CRX Manifest, APK Manifest, IPA, or Mach-O): (%s)",
-        path,
-    )
-    return False
+    return calc_permhash(create_ipa_permlist(path), path)
+
 
 def permhash_macho(path):
     """
-    Returns the permhash of a file at the designated path
+    Returns the permhash of a file at the designated path.
 
     :param path: The targeted file
     :type path: string
     """
-    if check_type(path, MACHO_MIMETYPES):
-        return calc_permhash(create_macho_permlist(path), path)
-    logging.warning(
-        "This file is not a type that is currently handled \
-(CRX, APK, CRX Manifest, APK Manifest, IPA, or Mach-O): (%s)",
-        path,
-    )
-    return False
+    return calc_permhash(create_macho_permlist(path), path)