Skip to content

Commit 80df279

Browse files
SluderSluder
committed
Arguements
1 parent e00edaa commit 80df279

File tree

2 files changed

+52
-46
lines changed

2 files changed

+52
-46
lines changed

‎ClusterBins.py

+32-26
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
import pandas
88
import operator
99
import hashlib
10+
import argparse
1011
from collections import OrderedDict, Counter
1112
from sklearn.cluster import AgglomerativeClustering
1213
from itertools import count
@@ -51,33 +52,23 @@ def get_opcodes(self, should_hash=True):
5152
return hashlib.md5(opcodes.encode()).hexdigest()
5253
return opcodes
5354

54-
def n_grams(self, stop_addr=None, get_first_ops=True, n_grams=2):
55+
def n_grams(self, stop_addr=None):
56+
"""
57+
Creates list of opcodes for this blocks instructions
58+
:param stop_addr: Address to stop grabbing opcodes
59+
"""
5560
opcodes = []
5661

57-
if stop_addr is None:
58-
for instruction in self.instructions.values():
59-
opcodes.append(instruction.opcode)
60-
else:
61-
if get_first_ops:
62-
for address, instruction in self.instructions.items():
63-
if address == stop_addr:
64-
break
65-
opcodes.append(instruction.opcode)
66-
else:
67-
skip = False
68-
69-
for address, instruction in self.instructions.items():
70-
if address == stop_addr:
71-
skip = True
72-
elif skip:
73-
opcodes.append(instruction.opcode)
62+
for address, instruction in self.instructions.items():
63+
if stop_addr is not None and address == stop_addr:
64+
break
65+
opcodes.append(instruction.opcode)
7466

7567
return opcodes
7668

7769
def gen_features(self, inst, depth=1):
7870
"""
7971
:param inst: Instruction instance to get features for
80-
:param sensor_addr: Str of sensor address to find
8172
:param depth: Number of blocks to get features from before/after inst
8273
"""
8374
features = {"pre":[], 'post':[]}
@@ -124,7 +115,7 @@ def _gen_following_grams(self, instruction_addr, depth=1):
124115
:param depth: Number of blocks to get features from before/after inst
125116
"""
126117
ret = []
127-
ret.extend(self.n_grams(instruction_addr, False))
118+
ret.extend(self.n_grams(instruction_addr))
128119

129120
if self.fail is not None:
130121
ret.extend(self.fail.n_grams())
@@ -384,7 +375,9 @@ def get_rvector_calls(self, r2):
384375

385376
# Get 1000 instructions due to radare2 stopping too early with analysis
386377
# Fix was to use command 'afu' to resize function after finding main loop
387-
instructions = json.loads(str(r2.cmd('pdj 1000'), 'ISO-8859-1'), strict=False, object_pairs_hook=OrderedDict)
378+
instructions = json.loads(
379+
str(r2.cmd('pdj 1000'), 'ISO-8859-1'), strict=False, object_pairs_hook=OrderedDict
380+
)
388381
calls = []
389382
stores = 0
390383
watch = False
@@ -494,6 +487,7 @@ def match_functions(self, bins):
494487
control_bin = bins[self.control.filename]
495488
sensor_fcn.sensor = sensor
496489

490+
# Get hashes of CFG if the functions file didnt have it
497491
if sensor_fcn.base_addr in control_bin.functions.keys():
498492
control_hashes = control_bin.functions[sensor_fcn.base_addr].hashes
499493
else:
@@ -508,6 +502,7 @@ def match_functions(self, bins):
508502
highest_jaccard = 0
509503
chosen_fcn = None
510504

505+
# Test all functions against the control function
511506
for test_fcn in bin.functions.values():
512507
value = jaccard_index(control_hashes, test_fcn.hashes)
513508

@@ -522,9 +517,10 @@ def match_functions(self, bins):
522517

523518
return matches
524519

525-
def match_sensors(self):
520+
def match_sensors(self, should_simplify):
526521
"""
527-
Find corrosponding sensor addresses using the matched functions
522+
Find corresponding sensor addresses using the matched functions
523+
:param should_simplify: Whether results should only show found sensors
528524
"""
529525
matches = {}
530526

@@ -564,11 +560,13 @@ def match_sensors(self):
564560

565561
matches[filename][control_fcn.sensor][addr] = round(average, 2)
566562
self.sensor_matches = matches
567-
self.cleanup_sensor_matches()
563+
564+
if should_simplify:
565+
self.cleanup_sensor_matches()
568566

569567
def cleanup_sensor_matches(self):
570568
"""
571-
Helper to simplify sensor matches json
569+
Helper to simplify sensor matches JSON
572570
"""
573571
for filename, sensor_matches in self.sensor_matches.items():
574572
for sensor, matches in sensor_matches.items():
@@ -662,6 +660,9 @@ def setup_r2(file_path):
662660
return r2
663661

664662
def analyze_bins():
663+
"""
664+
Create EcuFile instances for bins in the directory
665+
"""
665666
bins = {}
666667

667668
for filename in os.listdir(BIN_DIR):
@@ -673,6 +674,7 @@ def analyze_bins():
673674
def build_clusters(bins):
674675
"""
675676
Builds Cluster instances from grouped binaries
677+
:param bins: List of EcuFile instances
676678
"""
677679
clusters = []
678680

@@ -757,6 +759,10 @@ def write_clusters(clusters):
757759
print("Write results to cluster_matches.json")
758760

759761
if __name__ == '__main__':
762+
parser = argparse.ArgumentParser(description='Cluster M7700 binaries & find sensor addresses')
763+
parser.add_argument('-s', action='store_true', help='simplify sensor findings output')
764+
args = parser.parse_args()
765+
760766
bins = analyze_bins()
761767

762768
clusters = build_clusters(bins)
@@ -765,6 +771,6 @@ def write_clusters(clusters):
765771

766772
for cluster in clusters:
767773
cluster.match_functions(bins)
768-
cluster.match_sensors()
774+
cluster.match_sensors(args.s)
769775

770776
write_clusters(clusters)

‎cluster_matches.json

+20-20
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,17 @@
77
"water_temp": "0x1185",
88
"ignition_timing": "0x10a2",
99
"airflow": "0x1283",
10-
"throttle_position": "0x128c",
11-
"knock_correction": "0x1051"
10+
"throttle_position": "0x1036",
11+
"knock_correction": "0x1089"
1212
},
1313
"742521-1994-USDM-SVX-EG33.bin": {
1414
"batt_voltage": "0x10b4",
1515
"vehicle_speed": "0x1071",
1616
"engine_speed": "0x106f",
1717
"water_temp": "0x1185",
18-
"ignition_timing": "0x11a7",
18+
"ignition_timing": "0x11ac",
1919
"airflow": "0x1283",
20-
"throttle_position": "0x128c",
20+
"throttle_position": "0x1036",
2121
"knock_correction": "0x1071"
2222
},
2323
"722527-1993-USDM-SVX-EG33.bin": {
@@ -27,7 +27,7 @@
2727
"water_temp": "0x1185",
2828
"ignition_timing": "0x10a2",
2929
"airflow": "0x1283",
30-
"throttle_position": "0x128c",
30+
"throttle_position": "0x1036",
3131
"knock_correction": "0x12a7"
3232
},
3333
"722515-1992-JDM-SVX-EG33.bin": {
@@ -37,8 +37,8 @@
3737
"water_temp": "0x1185",
3838
"ignition_timing": "0x10a2",
3939
"airflow": "0x103a",
40-
"throttle_position": "0x128c",
41-
"knock_correction": "0x1051"
40+
"throttle_position": "0x1036",
41+
"knock_correction": "0x1089"
4242
},
4343
"722531-1996-UK-SVX-EG33.bin": {
4444
"batt_voltage": "0x1186",
@@ -47,7 +47,7 @@
4747
"water_temp": "0x1185",
4848
"ignition_timing": "0x10a2",
4949
"airflow": "0x1283",
50-
"throttle_position": "0x128c",
50+
"throttle_position": "0x1036",
5151
"knock_correction": "0x1089"
5252
},
5353
"742541-1994-MidEast-SVX-EG33.bin": {
@@ -57,18 +57,18 @@
5757
"water_temp": "0x1185",
5858
"ignition_timing": "0x10a2",
5959
"airflow": "0x1283",
60-
"throttle_position": "0x128c",
60+
"throttle_position": "0x1036",
6161
"knock_correction": "0x1134"
6262
},
6363
"722521-1991-USDM-SVX-EG33.bin": {
6464
"batt_voltage": "0x10b4",
6565
"vehicle_speed": "0x1071",
6666
"engine_speed": "0x106f",
6767
"water_temp": "0x1185",
68-
"ignition_timing": "0x105b",
68+
"ignition_timing": "0x10a2",
6969
"airflow": "0x1283",
70-
"throttle_position": "0x128c",
71-
"knock_correction": "0x1256"
70+
"throttle_position": "0x1036",
71+
"knock_correction": "0x105a"
7272
},
7373
"722525-1992-USDM-SVX-EG33.bin": {
7474
"batt_voltage": "0x102f",
@@ -77,7 +77,7 @@
7777
"water_temp": "0x1185",
7878
"ignition_timing": "0x10a2",
7979
"airflow": "0x1283",
80-
"throttle_position": "0x128c",
80+
"throttle_position": "0x1036",
8181
"knock_correction": "0x1237"
8282
}
8383
},
@@ -89,7 +89,7 @@
8989
"water_temp": "0x11a2",
9090
"ignition_timing": "0x109e",
9191
"airflow": "0x1307",
92-
"throttle_position": "0x12c6",
92+
"throttle_position": "0x133b",
9393
"knock_correction": "0x1328"
9494
},
9595
"744014-1995-JDM-Wrx-EJ20T.bin": {
@@ -99,7 +99,7 @@
9999
"water_temp": "0x11a2",
100100
"ignition_timing": "0x109e",
101101
"airflow": "0x1307",
102-
"throttle_position": "0x12c6",
102+
"throttle_position": "0x133b",
103103
"knock_correction": "0x1328"
104104
},
105105
"74401A-1995-JDM-WrxRA-EJ20T.bin": {
@@ -109,7 +109,7 @@
109109
"water_temp": "0x11a2",
110110
"ignition_timing": "0x109e",
111111
"airflow": "0x1307",
112-
"throttle_position": "0x12c6",
112+
"throttle_position": "0x133b",
113113
"knock_correction": "0x1328"
114114
},
115115
"744011-1994-JDM-Wrx-EJ20T.bin": {
@@ -119,20 +119,20 @@
119119
"water_temp": "0x11a2",
120120
"ignition_timing": "0x109e",
121121
"airflow": "0x11fd",
122-
"throttle_position": "0x120a",
122+
"throttle_position": "0x1073",
123123
"knock_correction": "0x1328"
124124
}
125125
},
126126
"Cluster 3": {
127127
"733257-1993-Canada-Legacy-EJ22.bin": {
128-
"batt_voltage": "0x10b8",
128+
"batt_voltage": "0x1072",
129129
"vehicle_speed": "0x1075",
130130
"engine_speed": "0x1073",
131131
"water_temp": "0x11a9",
132132
"ignition_timing": "0x109e",
133133
"airflow": "0x1307",
134134
"throttle_position": "0x1031",
135-
"knock_correction": "0x1270"
135+
"knock_correction": "0x127c"
136136
},
137137
"7232A5-1992-UK-Legacy-EJ22.bin": {
138138
"batt_voltage": "0x1170",
@@ -155,7 +155,7 @@
155155
"knock_correction": "0x1132"
156156
},
157157
"7237A5-1992-EDM-Legacy-EJ20.bin": {
158-
"batt_voltage": "0x1170",
158+
"batt_voltage": "0x11ce",
159159
"vehicle_speed": "0x1075",
160160
"engine_speed": "0x1073",
161161
"water_temp": "0x11b0",

0 commit comments

Comments
 (0)