#!/usr/bin/python #SnortRand - FamousJS import os,sys def main(): if len(sys.argv) != 2: print "Please supply an argument" sys.exit(0) userSig = sys.argv[1] bytes = userSig.split(' ') results = parseBytes(bytes) printSig(results) def parseBytes(bytes): results = [] r = result() index = 0 r.index = index index += 1 results.append(r) wasRandom = False randBytes = 0 for byte in bytes: if byte != "??": r.current += byte wasRandom = False else: if wasRandom: r.randBytes += 1 continue r = result() r.index = index r.previous = results[index-1].current index += 1 results.append(r) r.randBytes += 1 wasRandom = True return results def printSig(results): sidNum = 1 signature = "" for res in results: current = res.current if res.previous != "": distance = res.randBytes within = (len(res.current)/2) + distance signature += "content: \"|%s|\"; distance: %d; within: %d; " % (current, distance, within) else: signature += "content: \"|%s|\"; " % current print signature class result(object): index = None current = "" previous = "" randBytes = 0 if __name__ == "__main__": main()