scout

More finishing touches. I have added:

• Install script
• Install section in README
• A PKGBUILD file (am planning on publishing to AUR)

No real issues this time around, everything mostly worked first (or second) try.

Unfortunately there are no new features, but, i have managed to remove all memory leaks and (almost all) segfaults, as well as (tried to) prevent command injection.
some things ive done are:

• Removed command injection through filename
  Even though it would technically still be possible, i have blocked it heavily and i can not provide any examples of it, as i have not managed to exploit it.
• No more errors, warnings or memory leaks! Valgrind doesn’t complain anymore.
• Using the --help flag no longer messes everything up
• No segfault if there isn’t a second argument

This wasnt a super smooth process, as you can se in the screenshot i managed to make it even worse while trying to fix it, but i eventually figured it out.

Scout now has a readme and a security policy(SECURITY.md). Along with that scout now also has these additional features:

• (Shannon)Entropy calculation
• Automatic extraction of high and low entropy strings
• The --report flag automatically generates a comprehensive malware analysis report and prints it to the terminal.
• There is now a --help flag, but it is very unstable at the moment, and the help message is, not very helpful

Scout is now gcc only. Compiling with other compilers will not work due to certain GNU extensions used in the code.

The new tokenize function has a memory leak for every token it generates, but fixing that would mean having to figure out where to put the free() calls.

The program also segfaults if the second argument is blank.

Some of the things ive done since the last devlog are:

• refactoring the code
• moved some functions to separate module mathyy
• read json files and use for pattern matching(no more hard-coded patterns)
• Taylor series to approximate e and the natural logarithm
• simpler math implementations like factorials and powers
• New lnsha feature, calculates the natural log of the sha256 hash of the prorgam(completely useless)

The taylor series were quite problematic, as the more iterations i had, the higher the values in the factorial and power functions got, so sometimes they would overflow to infinity based on the start value, so i had to find a middle ground where the risc of overflowing was low, but it still had resonable precision. Especially for the natural log, which for higher numbers basically just returns a constant of about 10.48.

Ive also discovered some memmory leaks through valgrind, but as i discovered, fixing them breaks everything else, and i dont have the energy to fix it, so i left a comment and moved on

Scout can now read and parse json files(with the library cjson) and it also now contains a function that returns other functions!

Why cJSON?
It was easily availible with my package manager, and it looked the simplest out of all the json libraries.

how does higher-order functions benefit this project?
It dosent, the code is definitely less readable aand its completely unnecessary, but its fun!

While implementing this, i have started beef with gcc, as you can see in the attached screenshot, i have absolutely no idea what its talking about or what i did wrong and im pretty certain the compiler had a stroke, but i switched to clang for a while and when i switched back it was working again. As far as ive checked, the code is valid C, it compiled perfectly with clang, so i have no idea what happend, maybe gcc uses another C standard, or thers some weird macro in cjson that fucks things up.

The json reading will be used for pattern matching in the file with the patterns in the json file (similar to YARA, but simpler).

Scout is a CTF tool written in C that does quick analysis on files, mainly for reverse engineering and forensics CTF:s. It’s designed to be the first thing you run on a file, and it gives basic information like any potential flags and any interesting strings in the file. So far the program is able to run strings on a file, and extract potential flags and interesting strings. In the attached screenshot you can see it being run on a file called “chall”, and then underneath the contents of that file are printed out.