{"id":16255274,"url":"https://github.com/rpgeeganage/restful4up","last_synced_at":"2025-03-19T21:30:38.283Z","repository":{"id":45704973,"uuid":"343569635","full_name":"rpgeeganage/restful4up","owner":"rpgeeganage","description":"RESTful API for Unipacker (https://github.com/unipacker/unipacker)","archived":false,"fork":false,"pushed_at":"2021-03-12T10:33:02.000Z","size":179,"stargazers_count":15,"open_issues_count":0,"forks_count":1,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-02-28T23:21:15.906Z","etag":null,"topics":["malware","malware-analysis","malware-research","malware-unpacker"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rpgeeganage.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-03-01T22:03:08.000Z","updated_at":"2024-10-11T01:12:57.000Z","dependencies_parsed_at":"2022-09-18T20:21:27.251Z","dependency_job_id":null,"html_url":"https://github.com/rpgeeganage/restful4up","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rpgeeganage%2Frestful4up","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rpgeeganage%2Frestful4up/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rpgeeganage%2Frestful4up/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rpgeeganage%2Frestful4up/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rpgeeganage","download_url":"https://codeload.github.com/rpgeeganage/restful4up/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244056406,"owners_count":20390719,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["malware","malware-analysis","malware-research","malware-unpacker"],"created_at":"2024-10-10T15:29:14.104Z","updated_at":"2025-03-19T21:30:37.907Z","avatar_url":"https://github.com/rpgeeganage.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RESTful API for [Unipacker](https://github.com/unipacker/unipacker)\n\n### Table of content\n+ [Features](#features)\n+ [Software Requirements](#software-requirements)\n+ [How to use](#how-to-use)\n+ [APIs](#apis)\n+ [SDKs](#sdks)\n    - [Python](sdk/README.md#python-sdk)   \n+ [About the Partial YARA rule](#about-the-partial-yara-rule)\n\n## Features\n- Unpack the given executable using [Unipacker](https://github.com/unipacker/unipacker)\n- Extract the output when Unipacker run the unpacking\n- Generate partial [YARA](https://yara.readthedocs.io/) rule.\n- Apply given YARA rules to given executable.\n## Software Requirements\n* Docker\n\n## How to use\n1. Clone this repo\n\n```sh\ngit clone https://github.com/rpgeeganage/restful4up.git\n```\n2. use the `Makefile` to execute the `build`\n\n```sh\nmake build\n```\n3. use the `Makefile` to execute the `run`\n\n```sh\nmake run\n```\n4. The application is available at the following path\n```\nhttp://localhost:7887/spec\n```\n\n## APIs\n### `/v1/unpack`\n\nUpload the file to unpack and get the unpacked file.\n\nHTTP method: \n```\nPOST\n```\nRequest:\n```\n{\n    file: \u003cBinary string\u003e\n}\n```\n\n### `/v1/emulation-output`\n\nUpload the file to unpack and get the emulation output of the Unipacker.\n\nHTTP method: \n```\nPOST\n```\nRequest:\n```\n{\n    file: \u003cBinary string\u003e\n}\n```\n\n### `/v1/clean`\n\nCleanup the uploaded executables\nHTTP method: \n```\nHEAD\n```\nRequest:\n```\nnone\n```\n\n### `/generate-partial-yara-rules`\nGenerates partial YARA rules\nHTTP method: \n```\nPOST\n```\nRequest:\n\n```javascript\n{\n   \"is_unpacking_required\":\"true\", // flag to indicate unpacking required or not\n   \"minimum_string_length\":\"10\", // Minimum length of the strings to extract\n   \"strings_to_ignore\": [\n      \"SING error\",\n      \"!This program cannot be run in DOS mode.\"\n   ], // Strings to ignore from \"strings\" section in YARA rule\n   \"file\": \u003cBinary string\u003e // File content\n}\n```\nReponse: [About the Partial YARA rule](#about-the-partial-yara-rule)\n\u003cbr/\u003e\n\u003cbr/\u003e\n### `/apply-yara-rules`\nApply YARA rules to give executable\nHTTP method: \n```\nPOST\n```\nRequest:\n\n```javascript\n{\n   \"is_unpacking_required\":\"true\", // flag to indicate unpacking required or not\n   \"rules\": [\n      \"\u003cBASE64 encoded string\u003e\"\n   ], // Base 64 encoded string of YARA files\n   \"file\": \u003cBinary string\u003e // File content\n}\n```\nReponse: [Results after applying the given YARA rule](#results-after-applying-the-given-yara-rule)\n\u003cbr/\u003e\n\u003cbr/\u003e\n## SDKs\n### Python SDK is available in `sdk/restful4up.py`\n### [Read Me](sdk/)\n```python\n#!/usr/bin/python3\nimport os\nimport base64\n\nfrom restful4up import restful4up\n\npath = '/home/user/projects/unipacker/Sample/UPX/Lab18-01.exe'\n\napp = restful4up('http://localhost:7887')\n\n# Unpack file\nunpackedFileStream = app.unpack(path)\n\nwith open('/home/user/projects/test.exe', 'wb') as f:\n    f.write(unpackedFileStream)\n\n# Get emulation output\nemulationOutput = app.emulationOutput(path)\n\nprint(emulationOutput)\n\n# Clean\napp.clean()\n\n# Partial YARA rule generator\npartialYaraRule = app.generatePartialYaraRule(path, True, 10, ['SING error', '!This program cannot be run in DOS mode.'])\nprint(partialYaraRule)\n\n# Apply YARA rule\nrules_folder = '/home/user/projects/restful4up/app/__test__/fixtures/yara_rules'\n\n# Base64 encoded rules\nrules = []\n\n# Building the Base64 encoded rules\nfor root, directories, files in os.walk(rules_folder, topdown=False):\n    for name in files:\n        data = open(os.path.join(root, name), 'rb').read()\n        encoded = base64.b64encode(data)\n        rules.append(encoded)\n\n# Call the API\nyaraRuleResult = app.applyYaraRules(path, rules, True)\n\nprint(yaraRuleResult)\n```\n\n## About the Partial YARA rule\nApp generates a YARA rule without the `condition` block from given executable.\n\neg:\n```json\n{\n    \"rule\": {\n        \"name\": \"rule_for_extracted_string\",\n        \"meta\": {\n            \"date\": \"Tue Mar 09 2021 16:20:46 GMT+0000 (Coordinated Universal Time)\",\n            \"md5sum\": \"2a3f2816a33ac55e1d78c8ce4b331273\",\n            \"sha256sum\": \"abffbf69a2a4830637f1e4f67de2a32cccc05a8ed6da6a1c16ac42e5b6dc457c\",\n            \"sha512sum\": \"afac8b8eef6eb97777a13945c5c4cc34b291653ad1f5fd3084d7794b3adf1b5446baedf7f8bf5e7e63bab9cb54c02d8581788093648015aeec0781099d840da5\"\n        },\n        \"strings\": [\n            [\n                \"text_0\",\n                \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"\n            ],\n            [\n                \"text_1\",\n                \"- unable to initialize heap\"\n            ],\n            [\n                \"text_2\",\n                \"- not enough space for lowio initialization\"\n            ],\n            [\n                \"text_3\",\n                \"- not enough space for stdio initialization\"\n            ],\n            [\n                \"text_4\",\n                \"- pure virtual function call\"\n            ],\n            [\n                \"text_5\",\n                \"- not enough space for _onexit/atexit table\"\n            ],\n            [\n                \"text_6\",\n                \"- unable to open console device\"\n            ],\n            [\n                \"text_7\",\n                \"- unexpected multithread lock error\"\n            ],\n            [\n                \"text_8\",\n                \"- not enough space for thread data\"\n            ],\n            [\n                \"text_9\",\n                \"abnormal program termination\"\n            ],\n            [\n                \"text_10\",\n                \"- not enough space for environment\"\n            ],\n            [\n                \"text_11\",\n                \"- not enough space for arguments\"\n            ],\n            [\n                \"text_12\",\n                \"- floating point not loaded\"\n            ],\n            [\n                \"text_13\",\n                \"Microsoft Visual C++ Runtime Library\"\n            ],\n            [\n                \"text_14\",\n                \"http://www.practicalmalwareanalysis.com/%s/%c.png\"\n            ],\n            [\n                \"text_15\",\n                \"%c%c:%c%c:%c%c:%c%c:%c%c:%c%c\"\n            ],\n            [\n                \"text_16\",\n                \"(((((                  H\"\n            ],\n            [\n                \"data_17\",\n                \"FGHIJKLMNOPQRST@XYZabcdefg\"\n            ],\n            [\n                \"data_18\",\n                \"hijklmnopqrstuvwxyz0123456789+/\"\n            ]\n        ]\n    }\n}\n```\n\n## Results after applying the given YARA rule\n\n```json\n{\n    \"output\": {\n    \"matched_yara_rules\": [\n        {\n            \"rule\": \"test_rule_1\",\n            \"string_information\": [\n                \"0x4e:39:$my_text_string: This program cannot be run in DOS mode.\"\n            ]\n        },\n        {\n            \"rule\": \"test_rule_3\",\n            \"string_information\": [\n                \"0x50e1:31:$my_text_string: hijklmnopqrstuvwxyz0123456789+/\",\n                \"0x9724:31:$my_text_string: hijklmnopqrstuvwxyz0123456789+/\"\n            ]\n        }\n    ],\n    \"yara_command\": \"yara --print-strings --print-string-length --fail-on-warnings /tmp/restful4up/1615496936444_yara_workspace/rules/c35143ae5515181b3b2b892cc9c2c5590029dd3668095bcf /tmp/restful4up/1615496936444_yara_workspace/rules/7e8070e40a5c06991f80e98aa648038ab2aa332e32069211 /tmp/restful4up/1615496936444_yara_workspace/rules/f9971bd6ee57c4b3dc1dbde4b0e6ca420c9bcfa7a103ef5d /tmp/restful4up/1615496936444_yara_workspace/app_yoAVQ3/1615496937530.invactive\",\n    \"is_success\": true\n    }\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frpgeeganage%2Frestful4up","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frpgeeganage%2Frestful4up","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frpgeeganage%2Frestful4up/lists"}