jame 1.0.dev0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- jame/__init__.py +109 -0
- jame/__main__.py +6 -0
- jame/cli/__init__.py +1 -0
- jame/cli/jame_cli.py +151 -0
- jame/core/__init__.py +5 -0
- jame/core/filetype.py +69 -0
- jame/core/jame.py +372 -0
- jame/core/patterns.py +72 -0
- jame/core/utils.py +74 -0
- jame/modules/__init__.py +53 -0
- jame/modules/archive.py +63 -0
- jame/modules/binary.py +60 -0
- jame/modules/crypto.py +169 -0
- jame/modules/forensics.py +69 -0
- jame/modules/stego.py +65 -0
- jame/results/__init__.py +18 -0
- jame/results/binary_result.py +51 -0
- jame/results/crypto_result.py +26 -0
- jame/results/forensics_result.py +26 -0
- jame/results/scan_result.py +26 -0
- jame/results/solve_result.py +26 -0
- jame/results/stego_result.py +26 -0
- jame-1.0.dev0.dist-info/METADATA +169 -0
- jame-1.0.dev0.dist-info/RECORD +28 -0
- jame-1.0.dev0.dist-info/WHEEL +5 -0
- jame-1.0.dev0.dist-info/entry_points.txt +2 -0
- jame-1.0.dev0.dist-info/licenses/LICENSE +21 -0
- jame-1.0.dev0.dist-info/top_level.txt +1 -0
jame/__init__.py
ADDED
|
@@ -0,0 +1,109 @@
|
|
|
1
|
+
'''JAMe package.'''
|
|
2
|
+
|
|
3
|
+
from jame.core.jame import Jame, create_jame
|
|
4
|
+
from jame.results.binary_result import BinaryResult, BinwalkResult
|
|
5
|
+
from jame.results.crypto_result import CryptoResult
|
|
6
|
+
from jame.results.forensics_result import ForensicsResult
|
|
7
|
+
from jame.results.scan_result import ScanResult
|
|
8
|
+
from jame.results.solve_result import SolveResult
|
|
9
|
+
from jame.results.stego_result import StegoResult
|
|
10
|
+
|
|
11
|
+
__version__ = '0.1.0'
|
|
12
|
+
_engine = Jame()
|
|
13
|
+
|
|
14
|
+
|
|
15
|
+
def scanFile(path: str) -> ScanResult:
|
|
16
|
+
'''Scan a file using the shared JAMe engine.'''
|
|
17
|
+
return _engine.scanFile(path)
|
|
18
|
+
|
|
19
|
+
|
|
20
|
+
def findFlag(path: str, format: str) -> str | None:
|
|
21
|
+
'''Find a matching flag using the shared JAMe engine.'''
|
|
22
|
+
return _engine.findFlag(path, format)
|
|
23
|
+
|
|
24
|
+
|
|
25
|
+
def autoSolve(path: str, **ctx: object) -> SolveResult:
|
|
26
|
+
'''Run the solve workflow using the shared JAMe engine.'''
|
|
27
|
+
return _engine.autoSolve(path, **ctx)
|
|
28
|
+
|
|
29
|
+
|
|
30
|
+
def cryptoAnalyze(path: str) -> CryptoResult:
|
|
31
|
+
'''Analyze file crypto indicators using the shared JAMe engine.'''
|
|
32
|
+
return _engine.cryptoAnalyze(path)
|
|
33
|
+
|
|
34
|
+
|
|
35
|
+
def binaryAnalyze(path: str) -> BinaryResult:
|
|
36
|
+
'''Analyze binary indicators using the shared JAMe engine.'''
|
|
37
|
+
return _engine.binaryAnalyze(path)
|
|
38
|
+
|
|
39
|
+
|
|
40
|
+
def stegoAnalyze(path: str) -> StegoResult:
|
|
41
|
+
'''Analyze steganography indicators using the shared JAMe engine.'''
|
|
42
|
+
return _engine.stegoAnalyze(path)
|
|
43
|
+
|
|
44
|
+
|
|
45
|
+
def forensicsAnalyze(path: str) -> ForensicsResult:
|
|
46
|
+
'''Analyze forensic indicators using the shared JAMe engine.'''
|
|
47
|
+
return _engine.forensicsAnalyze(path)
|
|
48
|
+
|
|
49
|
+
|
|
50
|
+
def archiveExtract(path: str) -> list[str]:
|
|
51
|
+
'''Extract supported archives using the shared JAMe engine.'''
|
|
52
|
+
return _engine.archiveExtract(path)
|
|
53
|
+
|
|
54
|
+
|
|
55
|
+
def getFileType(path: str) -> str:
|
|
56
|
+
'''Return the file type using the shared JAMe engine.'''
|
|
57
|
+
return _engine.getFileType(path)
|
|
58
|
+
|
|
59
|
+
|
|
60
|
+
def decodeCaesar(text: str, shift: int | str = 'brute') -> dict:
|
|
61
|
+
'''Decode Caesar text using the shared JAMe engine.'''
|
|
62
|
+
return _engine.decodeCaesar(text, shift)
|
|
63
|
+
|
|
64
|
+
|
|
65
|
+
def setFlagPatterns(patterns: list[str]) -> None:
|
|
66
|
+
'''Set flag patterns on the shared JAMe engine.'''
|
|
67
|
+
_engine.setFlagPatterns(patterns)
|
|
68
|
+
|
|
69
|
+
|
|
70
|
+
def setMaxDepth(depth: int) -> None:
|
|
71
|
+
'''Set archive extraction depth on the shared JAMe engine.'''
|
|
72
|
+
_engine.setMaxDepth(depth)
|
|
73
|
+
|
|
74
|
+
|
|
75
|
+
def setVerbose(enabled: bool) -> None:
|
|
76
|
+
'''Set verbose mode on the shared JAMe engine.'''
|
|
77
|
+
_engine.setVerbose(enabled)
|
|
78
|
+
|
|
79
|
+
|
|
80
|
+
def runStrings(path: str) -> list[str]:
|
|
81
|
+
'''Extract printable strings using the shared JAMe engine.'''
|
|
82
|
+
return _engine.runStrings(path)
|
|
83
|
+
|
|
84
|
+
|
|
85
|
+
def runBinwalk(path: str) -> BinwalkResult:
|
|
86
|
+
'''Run binwalk using the shared JAMe engine.'''
|
|
87
|
+
return _engine.runBinwalk(path)
|
|
88
|
+
|
|
89
|
+
|
|
90
|
+
__all__ = [
|
|
91
|
+
'Jame',
|
|
92
|
+
'__version__',
|
|
93
|
+
'archiveExtract',
|
|
94
|
+
'autoSolve',
|
|
95
|
+
'binaryAnalyze',
|
|
96
|
+
'create_jame',
|
|
97
|
+
'cryptoAnalyze',
|
|
98
|
+
'decodeCaesar',
|
|
99
|
+
'findFlag',
|
|
100
|
+
'forensicsAnalyze',
|
|
101
|
+
'getFileType',
|
|
102
|
+
'runBinwalk',
|
|
103
|
+
'runStrings',
|
|
104
|
+
'scanFile',
|
|
105
|
+
'setFlagPatterns',
|
|
106
|
+
'setMaxDepth',
|
|
107
|
+
'setVerbose',
|
|
108
|
+
'stegoAnalyze',
|
|
109
|
+
]
|
jame/__main__.py
ADDED
jame/cli/__init__.py
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
'''Command-line entry points for JAMe.'''
|
jame/cli/jame_cli.py
ADDED
|
@@ -0,0 +1,151 @@
|
|
|
1
|
+
'''Command-line entry point for JAMe.'''
|
|
2
|
+
|
|
3
|
+
import argparse
|
|
4
|
+
import json
|
|
5
|
+
import sys
|
|
6
|
+
|
|
7
|
+
from jame import Jame
|
|
8
|
+
|
|
9
|
+
|
|
10
|
+
_COMMANDS = {
|
|
11
|
+
'archive',
|
|
12
|
+
'binary',
|
|
13
|
+
'binwalk',
|
|
14
|
+
'caesar',
|
|
15
|
+
'crypto',
|
|
16
|
+
'file-type',
|
|
17
|
+
'find-flag',
|
|
18
|
+
'forensics',
|
|
19
|
+
'scan',
|
|
20
|
+
'solve',
|
|
21
|
+
'stego',
|
|
22
|
+
'strings',
|
|
23
|
+
}
|
|
24
|
+
|
|
25
|
+
|
|
26
|
+
def _add_path_arguments(command: argparse.ArgumentParser) -> None:
|
|
27
|
+
command.add_argument('path', help='Path to the file to analyze')
|
|
28
|
+
command.add_argument('--verbose', action='store_true', help='Print structured result details')
|
|
29
|
+
|
|
30
|
+
|
|
31
|
+
def _build_parser() -> argparse.ArgumentParser:
|
|
32
|
+
parser = argparse.ArgumentParser(
|
|
33
|
+
prog='jame',
|
|
34
|
+
description='Just Another Method of Exploitation',
|
|
35
|
+
)
|
|
36
|
+
subparsers = parser.add_subparsers(dest='command', required=True)
|
|
37
|
+
|
|
38
|
+
solve = subparsers.add_parser('solve', help='Find a flag and extract supported archives')
|
|
39
|
+
_add_path_arguments(solve)
|
|
40
|
+
solve.add_argument(
|
|
41
|
+
'--format',
|
|
42
|
+
default='flag{*}',
|
|
43
|
+
help="Flag pattern; '*' matches any length and '*N' matches exactly N characters",
|
|
44
|
+
)
|
|
45
|
+
solve.add_argument('--max-depth', type=int, default=3, help='Archive extraction depth')
|
|
46
|
+
|
|
47
|
+
find_flag = subparsers.add_parser('find-flag', help='Find a flag matching a pattern')
|
|
48
|
+
_add_path_arguments(find_flag)
|
|
49
|
+
find_flag.add_argument(
|
|
50
|
+
'--format',
|
|
51
|
+
default='flag{*}',
|
|
52
|
+
help="Flag pattern; '*' matches any length and '*N' matches exactly N characters",
|
|
53
|
+
)
|
|
54
|
+
|
|
55
|
+
for name, description in (
|
|
56
|
+
('scan', 'Run all available analyzers'),
|
|
57
|
+
('crypto', 'Analyze crypto indicators'),
|
|
58
|
+
('binary', 'Analyze binary indicators'),
|
|
59
|
+
('stego', 'Check for steganography indicators'),
|
|
60
|
+
('forensics', 'Run forensic checks'),
|
|
61
|
+
('file-type', 'Detect the file type'),
|
|
62
|
+
('strings', 'Extract printable strings'),
|
|
63
|
+
('binwalk', 'Run binwalk when installed'),
|
|
64
|
+
):
|
|
65
|
+
command = subparsers.add_parser(name, help=description)
|
|
66
|
+
_add_path_arguments(command)
|
|
67
|
+
|
|
68
|
+
archive = subparsers.add_parser('archive', help='Extract supported archives')
|
|
69
|
+
_add_path_arguments(archive)
|
|
70
|
+
archive.add_argument('--max-depth', type=int, default=3, help='Archive extraction depth')
|
|
71
|
+
|
|
72
|
+
caesar = subparsers.add_parser('caesar', help='Decode Caesar-shifted text')
|
|
73
|
+
caesar.add_argument('text', help='Text to decode')
|
|
74
|
+
caesar.add_argument('--shift', default='brute', help="Integer shift or 'brute'")
|
|
75
|
+
caesar.add_argument('--verbose', action='store_true', help='Print structured result details')
|
|
76
|
+
|
|
77
|
+
return parser
|
|
78
|
+
|
|
79
|
+
|
|
80
|
+
def _print_result(result: object, verbose: bool) -> None:
|
|
81
|
+
if verbose:
|
|
82
|
+
to_dict = getattr(result, 'to_dict', None)
|
|
83
|
+
output = to_dict() if callable(to_dict) else result
|
|
84
|
+
print(json.dumps(output, indent=2, default=str))
|
|
85
|
+
elif hasattr(result, 'summary'):
|
|
86
|
+
print(result.summary)
|
|
87
|
+
elif result is None:
|
|
88
|
+
print('No flag found.')
|
|
89
|
+
elif isinstance(result, list):
|
|
90
|
+
print('\n'.join(str(item) for item in result) if result else 'No results.')
|
|
91
|
+
elif isinstance(result, (dict, tuple)):
|
|
92
|
+
print(json.dumps(result, indent=2, default=str))
|
|
93
|
+
else:
|
|
94
|
+
print(result)
|
|
95
|
+
|
|
96
|
+
|
|
97
|
+
def main() -> None:
|
|
98
|
+
'''Parse command-line options and run the requested JAMe method.'''
|
|
99
|
+
argv = sys.argv[1:]
|
|
100
|
+
if argv and argv[0] not in _COMMANDS and argv[0] not in {'-h', '--help'}:
|
|
101
|
+
argv.insert(0, 'solve')
|
|
102
|
+
|
|
103
|
+
parser = _build_parser()
|
|
104
|
+
args = parser.parse_args(argv)
|
|
105
|
+
max_depth = getattr(args, 'max_depth', 3)
|
|
106
|
+
engine = Jame(
|
|
107
|
+
flag_patterns=[getattr(args, 'format', 'flag{*}')],
|
|
108
|
+
max_depth=max_depth,
|
|
109
|
+
verbose=args.verbose,
|
|
110
|
+
)
|
|
111
|
+
|
|
112
|
+
if args.command == 'solve':
|
|
113
|
+
result = engine.autoSolve(
|
|
114
|
+
args.path,
|
|
115
|
+
format=args.format,
|
|
116
|
+
maxDepth=args.max_depth,
|
|
117
|
+
verbose=args.verbose,
|
|
118
|
+
)
|
|
119
|
+
elif args.command == 'find-flag':
|
|
120
|
+
result = engine.findFlag(args.path, args.format)
|
|
121
|
+
elif args.command == 'scan':
|
|
122
|
+
result = engine.scanFile(args.path)
|
|
123
|
+
elif args.command == 'crypto':
|
|
124
|
+
result = engine.cryptoAnalyze(args.path)
|
|
125
|
+
elif args.command == 'binary':
|
|
126
|
+
result = engine.binaryAnalyze(args.path)
|
|
127
|
+
elif args.command == 'stego':
|
|
128
|
+
result = engine.stegoAnalyze(args.path)
|
|
129
|
+
elif args.command == 'forensics':
|
|
130
|
+
result = engine.forensicsAnalyze(args.path)
|
|
131
|
+
elif args.command == 'archive':
|
|
132
|
+
engine.setMaxDepth(args.max_depth)
|
|
133
|
+
result = engine.archiveExtract(args.path)
|
|
134
|
+
elif args.command == 'file-type':
|
|
135
|
+
result = engine.getFileType(args.path)
|
|
136
|
+
elif args.command == 'strings':
|
|
137
|
+
result = engine.runStrings(args.path)
|
|
138
|
+
elif args.command == 'binwalk':
|
|
139
|
+
result = engine.runBinwalk(args.path)
|
|
140
|
+
else:
|
|
141
|
+
try:
|
|
142
|
+
shift = 'brute' if args.shift == 'brute' else int(args.shift)
|
|
143
|
+
except ValueError:
|
|
144
|
+
parser.error("--shift must be an integer or 'brute'")
|
|
145
|
+
result = engine.decodeCaesar(args.text, shift)
|
|
146
|
+
|
|
147
|
+
_print_result(result, args.verbose)
|
|
148
|
+
|
|
149
|
+
|
|
150
|
+
if __name__ == '__main__':
|
|
151
|
+
main()
|
jame/core/__init__.py
ADDED
jame/core/filetype.py
ADDED
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
'''File type helpers for JAMe.'''
|
|
2
|
+
|
|
3
|
+
import os
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
def detect_file_type_from_bytes(data: bytes) -> str:
|
|
7
|
+
'''Return a best-effort file type label from the file header.'''
|
|
8
|
+
if len(data) >= 4 and data[:4] == b'\x7fELF':
|
|
9
|
+
return 'ELF binary'
|
|
10
|
+
if data.startswith(b'PK'):
|
|
11
|
+
return 'ZIP archive'
|
|
12
|
+
if data.startswith(b'\x1f\x8b'):
|
|
13
|
+
return 'GZIP compressed data'
|
|
14
|
+
if data.startswith(b'%PDF'):
|
|
15
|
+
return 'PDF document'
|
|
16
|
+
if data.startswith(b'\x89PNG'):
|
|
17
|
+
return 'PNG image'
|
|
18
|
+
if data.startswith(b'GIF8'):
|
|
19
|
+
return 'GIF image'
|
|
20
|
+
if data.startswith(b'RIFF') and data[8:12] == b'WAVE':
|
|
21
|
+
return 'WAV audio'
|
|
22
|
+
if data.startswith(b'\xff\xd8\xff'):
|
|
23
|
+
return 'JPEG image'
|
|
24
|
+
if data.startswith(b'#!'):
|
|
25
|
+
return 'script'
|
|
26
|
+
return 'unknown binary'
|
|
27
|
+
|
|
28
|
+
|
|
29
|
+
def get_file_type(path: str) -> str:
|
|
30
|
+
'''Return a string label for a file based on extension and file header.'''
|
|
31
|
+
if not os.path.exists(path):
|
|
32
|
+
return 'missing'
|
|
33
|
+
|
|
34
|
+
_, ext = os.path.splitext(path)
|
|
35
|
+
ext = ext.lower()
|
|
36
|
+
lookup = {
|
|
37
|
+
'.zip': 'ZIP archive',
|
|
38
|
+
'.jar': 'JAR archive',
|
|
39
|
+
'.tar': 'TAR archive',
|
|
40
|
+
'.gz': 'GZIP archive',
|
|
41
|
+
'.bz2': 'BZIP2 archive',
|
|
42
|
+
'.xz': 'XZ archive',
|
|
43
|
+
'.pdf': 'PDF document',
|
|
44
|
+
'.png': 'PNG image',
|
|
45
|
+
'.jpg': 'JPEG image',
|
|
46
|
+
'.jpeg': 'JPEG image',
|
|
47
|
+
'.gif': 'GIF image',
|
|
48
|
+
'.pcap': 'PCAP capture',
|
|
49
|
+
'.pcapng': 'PCAPNG capture',
|
|
50
|
+
'.exe': 'PE binary',
|
|
51
|
+
'.dll': 'DLL binary',
|
|
52
|
+
'.so': 'shared object',
|
|
53
|
+
'.bin': 'binary blob',
|
|
54
|
+
'.txt': 'text file',
|
|
55
|
+
'.csv': 'CSV file',
|
|
56
|
+
'.py': 'Python source',
|
|
57
|
+
'.html': 'HTML document',
|
|
58
|
+
'.json': 'JSON document',
|
|
59
|
+
'.xml': 'XML document',
|
|
60
|
+
}
|
|
61
|
+
if ext in lookup:
|
|
62
|
+
return lookup[ext]
|
|
63
|
+
|
|
64
|
+
try:
|
|
65
|
+
with open(path, 'rb') as handle:
|
|
66
|
+
data = handle.read(256)
|
|
67
|
+
except OSError:
|
|
68
|
+
return 'unknown'
|
|
69
|
+
return detect_file_type_from_bytes(data)
|