die-python 0.4.0__cp313-abi3-win_amd64.whl

die/db/db/shell-script

@@ -0,0 +1,24 @@
+// Retrieve the interpreter from a #! script.
+
+var sInterpreter;
+if (typeof sInterpreter === "undefined") {
+    sInterpreter = "";
+    var sLine = Binary.getString(0);
+    // Make the expression a little easier to deal with by translating
+    // something like "/usr/bin/env perl" to just "/usr/bin/perl".
+    sLine = sLine.replace(/\/env\s+/, "/");
+    var aMatch = sLine.match(/#!.*\/(.+?)(?:\.exe)?\s/);
+    if (aMatch) {
+        sInterpreter = aMatch[1];
+    }
+}
+
+// Check for a particular interpreter.
+function isInterpreter(sString) {
+    if (sInterpreter == sString) {
+        // Found it, so blank it out to stop "script.2" picking it up again.
+        sInterpreter = "";
+        return 1;
+    }
+    return 0;
+}

die/db/db/wxWidgets

@@ -0,0 +1,12 @@
+// wxWidgets is tested twice - as a library and as a compiler (to distinguish C
+// from C++).  Detect it once here.
+
+var aWx;
+if (typeof aWx === "undefined") {
+    aWx = PE.isLibraryPresentExp(/^wx.*?(univ)?(\d+)(u)?(d)?/i);
+    if (!aWx) {
+        if (PE.isResourceNamePresent("WXWINDOWMENU")) {
+            aWx = 1;
+        }
+    }
+}

die/db/db/zip-file

@@ -0,0 +1,87 @@
+// Detect a zip archive.
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+includeScript("archive-file");
+sName = "Zip";
+
+function detect_Zip(bFile) {
+    var nOffset = 0;
+    if (bFile) {
+        // Don't know what this is, but I happened to have a file that started
+        // with it.
+        if (File.compare("'PK00'")) {
+            nOffset = 4;
+        }
+        if (Binary.compare("'PK'0708", nOffset)) {
+            sOptions = "extended";
+            bDetected = true;
+            return;
+        }
+    } else {
+        if (File.compareOverlay("'PK'0304")) {
+            nOffset = File.getOverlayOffset();
+        } else {
+            var nSize = File.getSize();
+            if (nSize < 64) {
+                return;
+            }
+            nSize -= 11;
+            nOffset = nSize;
+            if (!File.compare("'PK'0506'", nOffset)) {
+                if (nSize < 4096) {
+                    nOffset = 0;
+                } else {
+                    nOffset -= 4096;
+                    nSize = 4096;
+                }
+                nOffset = File.findSignature(nOffset, nSize, "'PK'0506");
+                if (nOffset == -1) {
+                    return;
+                }
+                var nBase = File.readDword(nOffset + 16);
+                nOffset -= File.readDword(nOffset + 12);
+                if (!File.compare("'PK'0102", nOffset)) {
+                    return;
+                }
+                nOffset += File.readDword(nOffset + 0x2a) - nBase;
+            }
+        }
+    }
+
+    if (File.compare("'PK'0304", nOffset)) {
+        bDetected = true;
+
+        if (File.findString(nOffset, 0x40, "META-INF/MANIFEST.MF") != -1) {
+            sOptions = sOptions.append("JAR"); // Java archive
+        }
+
+        if (File.findString(nOffset, 0x40, "classes.dex") != -1) {
+            sOptions = sOptions.append("APK"); // Android application package file
+        }
+
+        var nVer = 0;
+
+        var bEncrypted = 0;
+        do {
+            var v = File.readByte(nOffset + 4);
+            if (v > nVer) {
+                nVer = v;
+            }
+            if (!bEncrypted && (File.readByte(nOffset + 6) & 1)) {
+                bEncrypted = 1;
+            }
+            var nPacked = File.readDword(nOffset + 0x12);
+            var nName = File.readWord(nOffset + 0x1A);
+            Archive.add(File.readDword(nOffset + 0x16), nPacked,
+                nPacked == 0 && File.readByte(nOffset + 0x1E + nName - 1) == 0x2F);
+            nOffset += 0x1E + nName + File.readWord(nOffset + 0x1C) + nPacked;
+        } while (File.compare("'PK'0304", nOffset));
+
+        if (bEncrypted) {
+            sOptions = "encrypted";
+        }
+        sOptions = sOptions.append(Archive.contents());
+
+        sVersion = (nVer / 10).toFixed(1);
+    }
+}

die/db/db/zlib

@@ -0,0 +1,23 @@
+// Detect a ZLIB.
+// Author: LinXP
+
+function detect_zlib(bFile, nOffset) {
+    var sInfo = "ZLIB compression";
+    if (bFile.compare("7801", nOffset)) {
+        if (bFile.isVerbose()) { sInfo += " fastest" }
+        sOptions = sOptions.append(sInfo);
+        return true;
+    } else if (bFile.compare("785E", nOffset)) {
+        if (bFile.isVerbose()) { sInfo += " fast" }
+        sOptions = sOptions.append(sInfo);
+        return true;
+    } else if (bFile.compare("789C", nOffset)) {
+        if (bFile.isVerbose()) { sInfo += " normal" }
+        sOptions = sOptions.append(sInfo);
+        return true;
+    } else if (bFile.compare("78DA", nOffset)) {
+        if (bFile.isVerbose()) { sInfo += " best" }
+        sOptions = sOptions.append(sInfo);
+        return true;
+    }
+}

die/db/db_custom/PE/example.sg

@@ -0,0 +1,18 @@
+// DIE's signature file
+
+init("DETECTION_TYPE", "DETECTION_NAME");
+
+function detect() {
+
+    if (false) {
+
+        bDetected = true; // IS_DETECTED_BOOLEAN
+
+        sVersion = "DETECTION_VERSION_INFO_TEXT";
+
+        sOptions = "DETECTION_OPTIONS_INFO_TEXT";
+
+    }
+
+    return result();
+}

die/db/db_custom/where-is-structure-example.txt

@@ -0,0 +1 @@
+See example at 'PE\example.sg'

die_python-0.4.0.dist-info/METADATA

@@ -0,0 +1,335 @@
+Metadata-Version: 2.1
+Name: die-python
+Version: 0.4.0
+Summary: Python bindings for Detect It Easy (DIE).
+Author: @calladoum-elastic
+License:                                  Apache License
+                                    Version 2.0, January 2004
+                                 http://www.apache.org/licenses/
+         
+            TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+         
+            1. Definitions.
+         
+               "License" shall mean the terms and conditions for use, reproduction,
+               and distribution as defined by Sections 1 through 9 of this document.
+         
+               "Licensor" shall mean the copyright owner or entity authorized by
+               the copyright owner that is granting the License.
+         
+               "Legal Entity" shall mean the union of the acting entity and all
+               other entities that control, are controlled by, or are under common
+               control with that entity. For the purposes of this definition,
+               "control" means (i) the power, direct or indirect, to cause the
+               direction or management of such entity, whether by contract or
+               otherwise, or (ii) ownership of fifty percent (50%) or more of the
+               outstanding shares, or (iii) beneficial ownership of such entity.
+         
+               "You" (or "Your") shall mean an individual or Legal Entity
+               exercising permissions granted by this License.
+         
+               "Source" form shall mean the preferred form for making modifications,
+               including but not limited to software source code, documentation
+               source, and configuration files.
+         
+               "Object" form shall mean any form resulting from mechanical
+               transformation or translation of a Source form, including but
+               not limited to compiled object code, generated documentation,
+               and conversions to other media types.
+         
+               "Work" shall mean the work of authorship, whether in Source or
+               Object form, made available under the License, as indicated by a
+               copyright notice that is included in or attached to the work
+               (an example is provided in the Appendix below).
+         
+               "Derivative Works" shall mean any work, whether in Source or Object
+               form, that is based on (or derived from) the Work and for which the
+               editorial revisions, annotations, elaborations, or other modifications
+               represent, as a whole, an original work of authorship. For the purposes
+               of this License, Derivative Works shall not include works that remain
+               separable from, or merely link (or bind by name) to the interfaces of,
+               the Work and Derivative Works thereof.
+         
+               "Contribution" shall mean any work of authorship, including
+               the original version of the Work and any modifications or additions
+               to that Work or Derivative Works thereof, that is intentionally
+               submitted to Licensor for inclusion in the Work by the copyright owner
+               or by an individual or Legal Entity authorized to submit on behalf of
+               the copyright owner. For the purposes of this definition, "submitted"
+               means any form of electronic, verbal, or written communication sent
+               to the Licensor or its representatives, including but not limited to
+               communication on electronic mailing lists, source code control systems,
+               and issue tracking systems that are managed by, or on behalf of, the
+               Licensor for the purpose of discussing and improving the Work, but
+               excluding communication that is conspicuously marked or otherwise
+               designated in writing by the copyright owner as "Not a Contribution."
+         
+               "Contributor" shall mean Licensor and any individual or Legal Entity
+               on behalf of whom a Contribution has been received by Licensor and
+               subsequently incorporated within the Work.
+         
+            2. Grant of Copyright License. Subject to the terms and conditions of
+               this License, each Contributor hereby grants to You a perpetual,
+               worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+               copyright license to reproduce, prepare Derivative Works of,
+               publicly display, publicly perform, sublicense, and distribute the
+               Work and such Derivative Works in Source or Object form.
+         
+            3. Grant of Patent License. Subject to the terms and conditions of
+               this License, each Contributor hereby grants to You a perpetual,
+               worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+               (except as stated in this section) patent license to make, have made,
+               use, offer to sell, sell, import, and otherwise transfer the Work,
+               where such license applies only to those patent claims licensable
+               by such Contributor that are necessarily infringed by their
+               Contribution(s) alone or by combination of their Contribution(s)
+               with the Work to which such Contribution(s) was submitted. If You
+               institute patent litigation against any entity (including a
+               cross-claim or counterclaim in a lawsuit) alleging that the Work
+               or a Contribution incorporated within the Work constitutes direct
+               or contributory patent infringement, then any patent licenses
+               granted to You under this License for that Work shall terminate
+               as of the date such litigation is filed.
+         
+            4. Redistribution. You may reproduce and distribute copies of the
+               Work or Derivative Works thereof in any medium, with or without
+               modifications, and in Source or Object form, provided that You
+               meet the following conditions:
+         
+               (a) You must give any other recipients of the Work or
+                   Derivative Works a copy of this License; and
+         
+               (b) You must cause any modified files to carry prominent notices
+                   stating that You changed the files; and
+         
+               (c) You must retain, in the Source form of any Derivative Works
+                   that You distribute, all copyright, patent, trademark, and
+                   attribution notices from the Source form of the Work,
+                   excluding those notices that do not pertain to any part of
+                   the Derivative Works; and
+         
+               (d) If the Work includes a "NOTICE" text file as part of its
+                   distribution, then any Derivative Works that You distribute must
+                   include a readable copy of the attribution notices contained
+                   within such NOTICE file, excluding those notices that do not
+                   pertain to any part of the Derivative Works, in at least one
+                   of the following places: within a NOTICE text file distributed
+                   as part of the Derivative Works; within the Source form or
+                   documentation, if provided along with the Derivative Works; or,
+                   within a display generated by the Derivative Works, if and
+                   wherever such third-party notices normally appear. The contents
+                   of the NOTICE file are for informational purposes only and
+                   do not modify the License. You may add Your own attribution
+                   notices within Derivative Works that You distribute, alongside
+                   or as an addendum to the NOTICE text from the Work, provided
+                   that such additional attribution notices cannot be construed
+                   as modifying the License.
+         
+               You may add Your own copyright statement to Your modifications and
+               may provide additional or different license terms and conditions
+               for use, reproduction, or distribution of Your modifications, or
+               for any such Derivative Works as a whole, provided Your use,
+               reproduction, and distribution of the Work otherwise complies with
+               the conditions stated in this License.
+         
+            5. Submission of Contributions. Unless You explicitly state otherwise,
+               any Contribution intentionally submitted for inclusion in the Work
+               by You to the Licensor shall be under the terms and conditions of
+               this License, without any additional terms or conditions.
+               Notwithstanding the above, nothing herein shall supersede or modify
+               the terms of any separate license agreement you may have executed
+               with Licensor regarding such Contributions.
+         
+            6. Trademarks. This License does not grant permission to use the trade
+               names, trademarks, service marks, or product names of the Licensor,
+               except as required for reasonable and customary use in describing the
+               origin of the Work and reproducing the content of the NOTICE file.
+         
+            7. Disclaimer of Warranty. Unless required by applicable law or
+               agreed to in writing, Licensor provides the Work (and each
+               Contributor provides its Contributions) on an "AS IS" BASIS,
+               WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+               implied, including, without limitation, any warranties or conditions
+               of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+               PARTICULAR PURPOSE. You are solely responsible for determining the
+               appropriateness of using or redistributing the Work and assume any
+               risks associated with Your exercise of permissions under this License.
+         
+            8. Limitation of Liability. In no event and under no legal theory,
+               whether in tort (including negligence), contract, or otherwise,
+               unless required by applicable law (such as deliberate and grossly
+               negligent acts) or agreed to in writing, shall any Contributor be
+               liable to You for damages, including any direct, indirect, special,
+               incidental, or consequential damages of any character arising as a
+               result of this License or out of the use or inability to use the
+               Work (including but not limited to damages for loss of goodwill,
+               work stoppage, computer failure or malfunction, or any and all
+               other commercial damages or losses), even if such Contributor
+               has been advised of the possibility of such damages.
+         
+            9. Accepting Warranty or Additional Liability. While redistributing
+               the Work or Derivative Works thereof, You may choose to offer,
+               and charge a fee for, acceptance of support, warranty, indemnity,
+               or other liability obligations and/or rights consistent with this
+               License. However, in accepting such obligations, You may act only
+               on Your own behalf and on Your sole responsibility, not on behalf
+               of any other Contributor, and only if You agree to indemnify,
+               defend, and hold each Contributor harmless for any liability
+               incurred by, or claims asserted against, such Contributor by reason
+               of your accepting any such warranty or additional liability.
+         
+            END OF TERMS AND CONDITIONS
+         
+            APPENDIX: How to apply the Apache License to your work.
+         
+               To apply the Apache License to your work, attach the following
+               boilerplate notice, with the fields enclosed by brackets "[]"
+               replaced with your own identifying information. (Don't include
+               the brackets!)  The text should be enclosed in the appropriate
+               comment syntax for the file format. We also recommend that a
+               file or class name and description of purpose be included on the
+               same "printed page" as the copyright notice for easier
+               identification within third-party archives.
+         
+            Copyright [yyyy] [name of copyright owner]
+         
+            Licensed under the Apache License, Version 2.0 (the "License");
+            you may not use this file except in compliance with the License.
+            You may obtain a copy of the License at
+         
+                http://www.apache.org/licenses/LICENSE-2.0
+         
+            Unless required by applicable law or agreed to in writing, software
+            distributed under the License is distributed on an "AS IS" BASIS,
+            WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+            See the License for the specific language governing permissions and
+            limitations under the License.
+         
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Natural Language :: English
+Project-URL: Homepage, https://github.com/elastic/die-python
+Requires-Python: >=3.9
+Requires-Dist: setuptools
+Requires-Dist: wheel
+Requires-Dist: nanobind
+Provides-Extra: tests
+Requires-Dist: pytest; extra == "tests"
+Requires-Dist: black; extra == "tests"
+Requires-Dist: beautifulsoup4; extra == "tests"
+Requires-Dist: lxml; extra == "tests"
+Description-Content-Type: text/markdown
+
+# DetectItEasy-Python
+
+[![Python 3.8+](https://img.shields.io/pypi/v/die-python.svg)](https://pypi.org/project/die-python/)
+[![Downloads](https://static.pepy.tech/badge/die-python)](https://pepy.tech/project/die-python)
+[![Code style: black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)
+[![Licence Apache2](https://img.shields.io/badge/License-Apache_2-blue)](https://github.com/elastic/die-python/blob/main/LICENSE)
+[![Build](https://github.com/elastic/die-python/actions/workflows/build.yml/badge.svg)](https://github.com/elastic/die-python/actions/workflows/build.yml)
+
+Native Python 3.8+ bindings for [@horsicq](https://github.com/horsicq/)'s [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy)
+
+
+## Install
+
+### From PIP
+
+The easiest and recommended installation is through `pip`.
+
+```console
+pip install die-python
+```
+
+### Using Git
+
+```console
+git clone https://github.com/elastic/die-python
+cd die-python
+```
+
+Install Qt into the `build`. It can be easily installed using [`aqt`](https://github.com/miurahr/aqtinstall) as follow (here with Qt version 6.7.3):
+
+```console
+python -m pip install aqtinstall --user -U
+python -m aqt install-qt -O ./build linux desktop 6.7.3 linux_gcc_64               # linux x64 only
+python -m aqt install-qt -O ./build linux_arm64 desktop 6.7.3 linux_gcc_arm64      # linux arm64 only
+python -m aqt install-qt -O ./build windows desktop 6.7.3 win64_msvc2019_64        # windows x64 only
+python -m aqt install-qt -O ./build mac desktop 6.7.3 clang_64                     # mac only
+```
+
+Then you can install the package
+
+```console
+python -m pip install . --user -U
+```
+
+
+## Quick start
+
+```python
+import die, pathlib
+
+print(die.scan_file("c:/windows/system32/ntdll.dll", die.ScanFlags.DEEP_SCAN))
+'PE64'
+
+print(die.scan_file("../upx.exe", die.ScanFlags.RESULT_AS_JSON, str(die.database_path/'db') ))
+{
+    "detects": [
+        {
+            "filetype": "PE64",
+            "parentfilepart": "Header",
+            "values": [
+                {
+                    "info": "Console64,console",
+                    "name": "GNU linker ld (GNU Binutils)",
+                    "string": "Linker: GNU linker ld (GNU Binutils)(2.28)[Console64,console]",
+                    "type": "Linker",
+                    "version": "2.28"
+                },
+                {
+                    "info": "",
+                    "name": "MinGW",
+                    "string": "Compiler: MinGW",
+                    "type": "Compiler",
+                    "version": ""
+                },
+                {
+                    "info": "NRV,brute",
+                    "name": "UPX",
+                    "string": "Packer: UPX(4.24)[NRV,brute]",
+                    "type": "Packer",
+                    "version": "4.24"
+                }
+            ]
+        }
+    ]
+}
+
+for db in die.databases():
+    print(db)
+C:\Users\User\AppData\Roaming\Python\Python312\site-packages\die\db\db\ACE
+C:\Users\User\AppData\Roaming\Python\Python312\site-packages\die\db\db\APK\PackageName.1.sg
+C:\Users\User\AppData\Roaming\Python\Python312\site-packages\die\db\db\APK\SingleJar.3.sg
+C:\Users\User\AppData\Roaming\Python\Python312\site-packages\die\db\db\APK\_APK.0.sg
+C:\Users\User\AppData\Roaming\Python\Python312\site-packages\die\db\db\APK\_init
+C:\Users\User\AppData\Roaming\Python\Python312\site-packages\die\db\db\Archive\_init
+C:\Users\User\AppData\Roaming\Python\Python312\site-packages\die\db\db\archive-file
+C:\Users\User\AppData\Roaming\Python\Python312\site-packages\die\db\db\arj
+C:\Users\User\AppData\Roaming\Python\Python312\site-packages\die\db\db\Binary\Amiga loadable.1.sg
+C:\Users\User\AppData\Roaming\Python\Python312\site-packages\die\db\db\Binary\archive.7z.1.sg
+[...]
+```
+
+## Licenses
+
+Released under Apache 2.0 License and integrates the following repositories:
+
+ - [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy): MIT license
+ - [die_library](https://github.com/horsicq/die_library): MIT license
+ - [qt](https://github.com/qt/qt): LGPL license