HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Toggle main menu visibility
Loading...
Searching...
No Matches
util
strings_util.cpp
Go to the documentation of this file.
1
#include "
strings_util.h
"
2
3
#include <algorithm>
4
#include <cstring>
5
6
std::string
hhunter::util::to_lowercase
(std::string str)
7
{
8
std::transform(str.begin(), str.end(), str.begin(), tolower);
9
return
str;
10
}
11
12
bool
hhunter::util::is_cstr_equal
(
char
const
*a,
char
const
*b,
const
size_t
max_len)
13
{
14
for
(
size_t
i = 0; i < max_len; ++i) {
15
if
(tolower(a[i]) != tolower(b[i])) {
16
return
false
;
17
}
18
if
(tolower(a[i]) ==
'\0'
)
break
;
19
}
20
return
true
;
21
}
22
23
#define MIN(x,y) ((x) < (y) ? (x) : (y))
24
25
size_t
hhunter::util::levenshtein_distance
(
const
char
s1[],
const
char
s2[])
26
{
27
const
size_t
MAX_LEN = 100;
28
const
size_t
len1 = strlen(s1);
29
const
size_t
len2 = strlen(s2);
30
31
if
(len1 >= MAX_LEN || len2 >= MAX_LEN)
return
(-1);
32
33
//init the distance matrix
34
int
dist[MAX_LEN][MAX_LEN] = { 0 };
35
for
(
int
i = 0;i <= len1;i++) {
36
dist[0][i] = i;
37
}
38
for
(
int
j = 0;j <= len2; j++) {
39
dist[j][0] = j;
40
}
41
// calculate
42
for
(
int
j = 1;j <= len1; j++) {
43
for
(
int
i = 1;i <= len2; i++) {
44
int
track = 1;
45
if
(s1[i - 1] == s2[j - 1]) {
46
track = 0;
47
}
48
int
t =
MIN
((dist[i - 1][j] + 1), (dist[i][j - 1] + 1));
49
dist[i][j] =
MIN
(t, (dist[i - 1][j - 1] + track));
50
}
51
}
52
return
dist[len2][len1];
53
}
54
55
size_t
hhunter::util::str_hist_diffrence
(
const
char
s1[],
const
char
s2[])
56
{
57
const
size_t
MAX_LEN = 255;
58
size_t
hist1[MAX_LEN] = { 0 };
59
size_t
hist2[MAX_LEN] = { 0 };
60
61
const
size_t
len1 = strlen(s1);
62
const
size_t
len2 = strlen(s2);
63
64
for
(
size_t
i = 0; i < len1; i++) {
65
char
c = tolower(s1[i]);
66
hist1[c]++;
67
}
68
69
for
(
size_t
i = 0; i < len2; i++) {
70
char
c = tolower(s2[i]);
71
hist2[c]++;
72
}
73
74
size_t
diffs = 0;
75
for
(
size_t
i = 0; i < MAX_LEN; i++) {
76
if
(hist2[i] == hist1[i])
continue
;
77
diffs++;
78
}
79
return
diffs;
80
}
81
82
hhunter::util::stringsim_type
hhunter::util::is_string_similar
(
const
std::string ¶m,
const
std::string &filter)
83
{
84
bool
sim_found = (param.find(filter) != std::string::npos) || (filter.find(param) != std::string::npos);
85
if
(sim_found)
return
SIM_SUBSTR
;
86
87
size_t
dist =
util::levenshtein_distance
(filter.c_str(), param.c_str());
88
if
(dist <= (param.length() / 2)) {
89
sim_found =
true
;
90
}
91
if
(dist >= param.length() || dist >= filter.length()) {
92
sim_found =
false
;
93
}
94
if
(sim_found)
return
SIM_LAV_DIST
;
95
96
size_t
diff =
util::str_hist_diffrence
(filter.c_str(), param.c_str());
97
if
(diff <= (param.length() / 2) || diff <= (filter.length() / 2)) {
98
sim_found =
true
;
99
}
100
if
(diff >= param.length() || diff >= filter.length()) {
101
sim_found =
false
;
102
}
103
if
(sim_found)
return
SIM_HIST
;
104
return
SIM_NONE
;
105
}
hhunter::util::str_hist_diffrence
size_t str_hist_diffrence(const char s1[], const char s2[])
Definition
strings_util.cpp:55
hhunter::util::levenshtein_distance
size_t levenshtein_distance(const char s1[], const char s2[])
Definition
strings_util.cpp:25
hhunter::util::is_cstr_equal
bool is_cstr_equal(char const *a, char const *b, const size_t max_len)
Definition
strings_util.cpp:12
hhunter::util::is_string_similar
stringsim_type is_string_similar(const std::string ¶m, const std::string &filter)
Definition
strings_util.cpp:82
hhunter::util::to_lowercase
std::string to_lowercase(std::string)
Definition
strings_util.cpp:6
hhunter::util::stringsim_type
stringsim_type
Definition
strings_util.h:9
hhunter::util::SIM_LAV_DIST
@ SIM_LAV_DIST
Definition
strings_util.h:12
hhunter::util::SIM_NONE
@ SIM_NONE
Definition
strings_util.h:10
hhunter::util::SIM_HIST
@ SIM_HIST
Definition
strings_util.h:13
hhunter::util::SIM_SUBSTR
@ SIM_SUBSTR
Definition
strings_util.h:11
MIN
#define MIN(x, y)
Definition
strings_util.cpp:23
strings_util.h
Generated by
1.17.0