HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
strings_util.cpp
Go to the documentation of this file.
1#include "strings_util.h"
2
3#include <algorithm>
4#include <cstring>
5
6std::string hhunter::util::to_lowercase(std::string str)
7{
8 std::transform(str.begin(), str.end(), str.begin(), tolower);
9 return str;
10}
11
12bool hhunter::util::is_cstr_equal(char const *a, char const *b, const size_t max_len)
13{
14 for (size_t i = 0; i < max_len; ++i) {
15 if (tolower(a[i]) != tolower(b[i])) {
16 return false;
17 }
18 if (tolower(a[i]) == '\0') break;
19 }
20 return true;
21}
22
23#define MIN(x,y) ((x) < (y) ? (x) : (y))
24
25size_t hhunter::util::levenshtein_distance(const char s1[], const char s2[])
26{
27 const size_t MAX_LEN = 100;
28 const size_t len1 = strlen(s1);
29 const size_t len2 = strlen(s2);
30
31 if (len1 >= MAX_LEN || len2 >= MAX_LEN) return(-1);
32
33 //init the distance matrix
34 int dist[MAX_LEN][MAX_LEN] = { 0 };
35 for (int i = 0;i <= len1;i++) {
36 dist[0][i] = i;
37 }
38 for (int j = 0;j <= len2; j++) {
39 dist[j][0] = j;
40 }
41 // calculate
42 for (int j = 1;j <= len1; j++) {
43 for (int i = 1;i <= len2; i++) {
44 int track = 1;
45 if (s1[i - 1] == s2[j - 1]) {
46 track = 0;
47 }
48 int t = MIN((dist[i - 1][j] + 1), (dist[i][j - 1] + 1));
49 dist[i][j] = MIN(t, (dist[i - 1][j - 1] + track));
50 }
51 }
52 return dist[len2][len1];
53}
54
55size_t hhunter::util::str_hist_diffrence(const char s1[], const char s2[])
56{
57 const size_t MAX_LEN = 255;
58 size_t hist1[MAX_LEN] = { 0 };
59 size_t hist2[MAX_LEN] = { 0 };
60
61 const size_t len1 = strlen(s1);
62 const size_t len2 = strlen(s2);
63
64 for (size_t i = 0; i < strlen(s1); i++) {
65 char c = tolower(s1[i]);
66 hist1[c]++;
67 }
68
69 for (size_t i = 0; i < strlen(s2); i++) {
70 char c = tolower(s2[i]);
71 hist2[c]++;
72 }
73
74 size_t diffs = 0;
75 for (size_t i = 0; i < MAX_LEN; i++) {
76 if (hist2[i] == hist1[i]) continue;
77 diffs++;
78 }
79 return diffs;
80}
81
82hhunter::util::stringsim_type hhunter::util::is_string_similar(const std::string &param, const std::string &filter)
83{
84 bool sim_found = (param.find(filter) != std::string::npos) || (filter.find(param) != std::string::npos);
85 if (sim_found) return SIM_SUBSTR;
86
87 size_t dist = util::levenshtein_distance(filter.c_str(), param.c_str());
88 if (dist <= (param.length() / 2)) {
89 sim_found = true;
90 }
91 if (dist >= param.length() || dist >= filter.length()) {
92 sim_found = false;
93 }
94 if (sim_found) return SIM_LAV_DIST;
95
96 size_t diff = util::str_hist_diffrence(filter.c_str(), param.c_str());
97 if (diff <= (param.length() / 2) || diff <= (filter.length() / 2)) {
98 sim_found = true;
99 }
100 if (diff >= param.length() || diff >= filter.length()) {
101 sim_found = false;
102 }
103 if (sim_found) return SIM_HIST;
104 return SIM_NONE;
105}
size_t str_hist_diffrence(const char s1[], const char s2[])
size_t levenshtein_distance(const char s1[], const char s2[])
bool is_cstr_equal(char const *a, char const *b, const size_t max_len)
stringsim_type is_string_similar(const std::string &param, const std::string &filter)
std::string to_lowercase(std::string)
#define MIN(x, y)