DragonX/dragonx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Add Mach-O 64-bit detection to security-check.py

Browse Source 
Fixes sec-hard test on MacOS CI worker. At some point we can extend this with
actual security hardening checks.
This commit is contained in:
Jack Grigg
2018-06-06 00:02:16 +12:00
parent c7e64754dc
commit 5e38c24c1d
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
contrib/devtools/security-check.py
View File

@@ -6,6 +6,7 @@ Otherwise the exit status will be 1 and it will log which executables failed whi
Needs `readelf` (for ELF) and `objdump` (for PE). Needs `readelf` (for ELF) and `objdump` (for PE).
''' '''
from __future__ import division,print_function,unicode_literals from __future__ import division,print_function,unicode_literals
import struct
import subprocess import subprocess
import sys import sys
import os import os
@@ -171,6 +172,8 @@ CHECKS = {
('DYNAMIC_BASE', check_PE_DYNAMIC_BASE), ('DYNAMIC_BASE', check_PE_DYNAMIC_BASE),
('HIGH_ENTROPY_VA', check_PE_HIGH_ENTROPY_VA), ('HIGH_ENTROPY_VA', check_PE_HIGH_ENTROPY_VA),
('NX', check_PE_NX) ('NX', check_PE_NX)
],
'MachO64': [
] ]
} }
@@ -181,6 +184,8 @@ def identify_executable(executable):
return 'PE' return 'PE'
elif magic.startswith(b'\x7fELF'): elif magic.startswith(b'\x7fELF'):
return 'ELF' return 'ELF'
elif struct.unpack('I', magic)[0] == 0xFEEDFACF:
return 'MachO64'
return None return None
if __name__ == '__main__': if __name__ == '__main__':