Peach::Analyzers::pptokenizer::PPTokenAnalyzer Class Reference

PPTokenAnalyzer(Analyzer). More...

Inherits Peach::analyzer::Analyzer.

List of all members.

Public Member Functions
def	__init__
	Constructor of Tokenizer.
def	resetTokenizer
	Reset tokenizer.
def	getNewName
	Get new name.
def	buildString
	Create Peach String.
def	buildToken
	Create Token.
def	buildNumber
	Create Peach Numerical String.
def	buildHexaNumber
	Create Peach Number.
def	buildBlob
	Create Peach Blob.
def	buildBlock
	Create Peach Block.
def	tokenizeElement
	Searchs for strings an requests tokenization.
def	deepTokenize
	Method can be requested to tokenize all strings in the Data Model.
def	containsValue
	Method moved to pprelations.py.
def	findRelatedElement
	Method moved to pprelations.py.
def	getRelatedElement
	Method moved to pprelations.py.
def	findRelInElement
	Method moved to pprelations.py.
def	findRelations
	Method moved to pprelations.py.
def	tokenizeString
	Tokenize string by defined separators.
Private Attributes
	_namingCounter
	initialize naming counter
	_nameBase
	specify prefix for names of new structures
	_tokens
	default set of tokens
	_pairs
	default set of brackets

---

Detailed Description

PPTokenAnalyzer(Analyzer).

HotFuzz string tokenizer class It contains methods for string tokenization and methods for creating Peach structures from structures translated from Wireshark. Term token is here used for separators. Tokenization works paralelly in two ways:

• Separation by brackets: works recursively and searchs for specific types of brackets in string
• Separation by single tokens: goes through the string, looks for specific characters and separates the string in places where these characters are found

---

Member Function Documentation

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::__init__	(		self,
			pairs = None,
			tokens = None
	)

Constructor of Tokenizer.

Specifies what names will be given to newly created structures. Specifies also set of separators used for tokenization

Parameters:

	pairs	Set of brackets used for tokenization
	tokens	Set of single tokens used for tokenization

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::buildBlob	(		self,
			blobName,
			blobParent,
			blobValue
	)

Create Peach Blob.

Creates and returns new Peach Blob. Blob can contain any value.

Parameters:

	blobName	Name of new Blob
	blobParent	Parent block of new Blob
	blobValue	Value of new Blob

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::buildBlock	(		self,
			blockName,
			blockParent,
			blockValue
	)

Create Peach Block.

Creates and returns new Peach Block. Block is a package containing other elements including other blocks. Block itself can also have a value, which is generally a concatenation of values of its children.

Parameters:

	blockName	Name of new Block
	blockParent	Parent block of new Block
	blockValue	Value of new Block

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::buildHexaNumber	(		self,
			numberName,
			numberParent,
			numberValue
	)

Create Peach Number.

Creates and returns new Peach Number. Peach Number represents a binary number. Value is stored as literal and when method getValue() is called, value is interpreted based on endian and size. Default endian is little endian.

Parameters:

	numberName	Name of new Number
	numberParent	Parent block of new Number
	numberValue	Value of new Number

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::buildNumber	(		self,
			numberName,
			numberParent,
			numberValue
	)

Create Peach Numerical String.

Creates and returns new Peach Numerical String. Numerical String represents string, whichs default value contains only digits.

Parameters:

	numberName	Name of new Numerical String
	numberParent	Parent block of new Numerical String
	numberValue	Value of new Numerical String

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::buildString	(		self,
			stringName,
			stringParent,
			stringValue
	)

Create Peach String.

Creates and returns new Peach String. String is the only element type that is used for tokenization. It can contain only value that can be encoded as unicode

Parameters:

	stringName	Name of new String
	stringParent	Parent block of new String
	stringValue	Value of new String

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::buildToken	(		self,
			tokenParent,
			tokenValue
	)

Create Token.

Token is basically a String that is marked as separator. When building a token we already know that it is not a number and that it can be encoded as unicode so we do not need to do these tests. Also we know for sure that token comes with no name, so we need to give it one.

Parameters:

	tokenParent	Parent block of new Token
	tokenValue	Value of new Token

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::containsValue	(		self,
			mystr,
			values
	)

Method moved to pprelations.py.

Will be removed from here in future refactorization.

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::deepTokenize	(		self,
			myDataModel
	)

Method can be requested to tokenize all strings in the Data Model.

Parameters:

myDataModel

Input Data Model

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::findRelatedElement	(		self,
			recElement,
			findSize
	)

Method moved to pprelations.py.

Will be removed from here in future refactorization.

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::findRelations	(		self,
			myDataModel
	)

Method moved to pprelations.py.

Will be removed from here in future refactorization.

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::findRelInElement	(		self,
			recElement
	)

Method moved to pprelations.py.

Will be removed from here in future refactorization.

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::getNewName

(

self

)

Get new name.

Returns unique name for newly generated structure

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::getRelatedElement	(		self,
			recElement
	)

Method moved to pprelations.py.

Will be removed from here in future refactorization.

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::resetTokenizer

(

self

)

Reset tokenizer.

Resets certain values in tokenizer at the beginning of iteration

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::tokenizeElement	(		self,
			recElement
	)

Searchs for strings an requests tokenization.

Parameters:

recElement

Input element

def Peach::Analyzers::pptokenizer::PPTokenAnalyzer::tokenizeString	(		self,
			name,
			parent,
			string
	)

Tokenize string by defined separators.

Method tokenizes string value based on defined brackets and tokens. It returns Peach String if the value can not be tokenized. Otherwise it returns Peach Block containing tokenized structure of the string

Parameters:

	name	Name for new element (Either String or Block)
	parent	Parent of new element
	string	String value for tokenization

---

Member Data Documentation

Peach::Analyzers::pptokenizer::PPTokenAnalyzer::_nameBase [private]

specify prefix for names of new structures

Peach::Analyzers::pptokenizer::PPTokenAnalyzer::_namingCounter [private]

initialize naming counter

reset naming counter

Peach::Analyzers::pptokenizer::PPTokenAnalyzer::_pairs [private]

default set of brackets

Peach::Analyzers::pptokenizer::PPTokenAnalyzer::_tokens [private]

default set of tokens

---

The documentation for this class was generated from the following file:

• Peach/Analyzers/pptokenizer.py