venus/CTF-tool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement forensics signatures command and expand supported magic signatures dictionary

Browse Source
This commit is contained in:
venus
2026-07-17 01:27:31 -05:00
parent aebdf8f31b
commit 75ce6b3a1b
1 changed files with 42 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
src/ctf/forensics.py
View File

@@ -16,6 +16,24 @@ except ImportError:
pwd = None
grp = None
COMMON_SIGNATURES = {
b"\x89PNG\r\n\x1a\n": ("PNG Image", [".png"]),
b"\xff\xd8\xff": ("JPEG Image", [".jpg", ".jpeg"]),
b"%PDF": ("PDF Document", [".pdf"]),
b"PK\x03\x04": ("ZIP Archive", [".zip"]),
b"\x7fELF": ("ELF Executable", [".elf"]),
b"MZ": ("PE Executable", [".exe", ".dll"]),
b"GIF87a": ("GIF Image", [".gif"]),
b"GIF89a": ("GIF Image", [".gif"]),
b"7z\xbc\xaf\x27\x1c": ("7-Zip Archive", [".7z"]),
b"\x1f\x8b": ("GZIP Archive", [".gz"]),
b"Rar!\x1a\x07\x00": ("RAR Archive", [".rar"]),
b"Rar!\x1a\x07\x01\x00": ("RAR Archive", [".rar"]),
b"BZh": ("BZIP2 Archive", [".bz2"]),
b"BM": ("BMP Image", [".bmp"]),
b"ID3": ("MP3 Audio", [".mp3"]),
}
@click.group(name="forensics")
def forensics_group(): pass
@@ -65,7 +83,7 @@ def inspect(path):
# Magic bytes
try:
with open(p, 'rb') as f:
magic = f.read(4).hex().upper()
magic = f.read(8).hex().upper()
except Exception:
magic = ""
@@ -91,20 +109,20 @@ def inspect(path):
except KeyError:
pass
# Allocation Metrics
# Allocation Metrics
if hasattr(stat_info, "st_blocks"):
allocated_size = stat_info.st_blocks * 512
else:
allocated_size = size
# Hard Links
# Hard Links
hard_links = stat_info.st_nlink
# Task 5: Inode & Device Identifiers
# Inode & Device Identifiers
inode = stat_info.st_ino
device = stat_info.st_dev
# Task 6: Extended Attributes
# Extended Attributes
extended_attributes = {}
if hasattr(os, "listxattr") and hasattr(os, "getxattr"):
try:
@@ -163,3 +181,22 @@ def inspect(path):
console.print(table)
return meta
@forensics_group.command(name="signatures")
def list_signatures():
"""List all supported file magic signatures and expected extensions."""
from rich.console import Console
from rich.table import Table
console = Console()
table = Table(title="Supported Magic Signatures", show_header=True)
table.add_column("Magic Bytes (Hex)", style="bold cyan")
table.add_column("File Type", style="bold green")
table.add_column("Expected Exts")
for signature, (type_name, exts) in COMMON_SIGNATURES.items():
hex_str = signature.hex().upper()
exts_str = ", ".join(exts) if exts else "Any / None"
table.add_row(hex_str, type_name, exts_str)
console.print(table)