24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 76:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T428,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample a06e55a35e81… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a06e55a35e81…. Threat score 100/100. 0/27 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66"],"about":{"@type":"SoftwareApplication","name":"JrXdependence.exe","applicationCategory":["compressed","7zip"],"identifier":"a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6c0,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "System.dll") file/memory contains long string with (Indicator: "VirtualFree"; File: "System.dll") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002248.00000000.256927.99A8A000.00000002.mdmp, 00000000-00002248.00000001.258846.AF531000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002248.00000000.256927.99A8A000.00000002.mdmp, 00000000-00002248.00000001.258846.AF531000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002248.00000000.256927.99A8A000.00000002.mdmp, 00000000-00002248.00000001.258846.AF531000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002248.00000000.256927.99A8A000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002248.00000001.258846.99E7F000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002248.00000001.258846.99E7F000.00000002.mdmp") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp") Found reference to API "DsRoleFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp")26:Te11,"`_. :param name: The name of the parameter a string expected to be ASCII only. :param value: The value of the parameter provided as ``bytes`` or `str``. :ret: An RFC-2231-formatted unicode string. """ if isinstance(value, six.binary_type): value = value.decode("utf-8") if not any(ch in value for ch in '"\\\r\n'): result = u'%s="%s"' % (name, value) try: result.encode("ascii") except (UnicodeEncodeError, UnicodeDecodeError): pass else: return result if six.PY2: # Python 2: value = value.encode("utf-8") # encode_rfc2231 accepts an encoded string and returns an ascii-encoded # string in Python 2 but accepts and returns unicode strings in Python 3 value = email.utils.encode_rfc2231(value, "utf-8") value = "%s*=%s" % (name, value) if six.PY2: # Python 2: value = value.decode("utf-8") return value_HTML5_REPLACEMENTS = { u"\u0022": u"%22", # Replace "\" with "\\". u"\u005C": u"\u005C\u005C",# All control characters from 0x00 to 0x1F *except* 0x1B._HTML5_REPLACEMENTS.update( { six.unichr(cc): u"%{:02X}".format(cc) for cc in range(0x00, 0x1F + 1) if cc not in (0x1B,) }def _replace_multiple(value, needles_and_replacements): def replacer(match): return needles_and_replacements[match.group(0)] pattern = re.compile( r"|".join([re.escape(needle) for needle in needles_and_replacements.keys()]) ) result = pattern.sub(replacer, value) return resultdef format_header_param_html5(name, value): """ Helper function to format and quote a single header parameter using the HTML5 strategy. Particularly useful for header parameters which might contain non-ASCII values, like file names. This follows the `HTML5 Working Draft Section 4.10.22.7`_ and matches the behavior of curl and modern browsers. .. _HTML5 Working Draft Section 4.10.22.7: https://w3c.github.io/html/sec-forms.html#multipart-form-data :param name: The name of the parameter, a string expected to be ASCII only. :param value: The value of the parameter, provided as ``bytes`` or `str``. :ret: A unicode string, stripped of troublesome characters. """ if isinstance(value, six.binary_type): value = value.decode("utf-8") value = _replace_multiple(value, _HTML5_REPLACEMENTS) return u'%s="%s"' % (name, value)# For backwards-compatibility.format_header_param = format_header_param_html5class RequestField(object): """ A data container for request body parameters. :param name: The name of this request field. Must be unicode. :param data: The data/value body. :param filename: An optional filename of the request field. Must be unicode. :param headers: An optional dict-like object of headers to initially use for the field. :param header_formatter: An optional callable that is used to encode and format the headers. By default, this is :func:`format_header_param_html5`. """ def __init__( self, name, data, filename=None, headers=None, header_formatter=format_header_param_html5, ): self._name = name self._filename = filename self.data = data self.headers = {} if headers: self.headers = dict(headers) self.header_formatter = header_formatter @classmethod def from_tuples(cls, fieldname, value, header_formatter=format_header_param_html5): """ A :class:`~urllib3.fields.RequestField` factory from old-style tuple parameters. Supports constructing :class:`~urllib3.fields.RequestField` from parameter of key/value strings AND key/filetuple. A filetuple is a (filename, data, MIME type) tuple where the MIME type is optional. For example:: 'foo': 'bar', 'fakefile': ('foofile.txt', 'contents of foofile'), 'realfile': ('barfile.txt', open('realfile').read()), 'typedfile': ('bazfile.bin', open('bazfile').read(), 'image/jpeg'), 'nonamefile': 'contents of nonamefile field', Field names and filenames must be unicode. """ if isinstance(value, tuple): if len(value) == 3: filename, data, content_type = value else: filename, data = value content_type = guess_content_type(filename) else: filename = None content_type = None data = value request_param = cls( fieldname, data, filename=filename, header_formatter=header_formatter ) request_param.make_multipart(content_type=content_type) return request_param def _render_part(self, name, value): """ Overridable helper function to format a single header parameter. By default, this calls ``self.header_formatter``. :param name: The name of the parameter, a string expected to be ASCII only. :param value: The value of the parameter, provided as a unicode string. """ return self.header_formatter(name, value) def _render_parts(self, header_parts): """ Helper function to format and quote a single header. Useful for single headers that are composed of multiple items. E.g., 'Content-Disposition' fields. :param header_parts: A sequence of (k, v) tuples or a :class:`dict` of (k, v) to format as `k1="v1"; k2="v2"; ...`. """ parts = [] iterable = header_parts if isinstance(header_parts, dict): iterable = header_parts.items() for name, value in iterable: if value is not None: parts.append(self._render_part(name, value)) return u"; ".join(parts) def render_headers(self): """ Renders the headers for this request field. """ lines = [] sort_keys = ["Content-Disposition", "Content-Type", "Content-Location"] for sort_key in sort_keys: if self.headers.get(sort_key, False): lines.append(u"%s: %s" % (sort_key, self.headers[sort_key])) for header_name, header_value in self.headers.items(): if header_name not in sort_keys: if header_value: lines.append(u"%s: %s" % (header_name, header_value)) lines.append(u"\r\n") return u"\r\n".join(lines) def make_multipart( self, content_disposition=None, content_type=None, content_location=None ): """ Makes this request field into a multipart request field. This method overrides "Content-Disposition", "Content-Type" and "Content-Location" headers to the request parameter. :param content_type: The 'Content-Type' of the request body. :param content_location: The 'Content-Location' of the request body. """ self.headers["Content-Disposition"] = content_disposition or u"form-data" self.headers["Content-Disposition"] += u"; ".join( [ u"", self._render_parts( ((u"name", self._name), (u"filename", self._filename)) ), ] ) self.headers["Content-Type"] = content_type self.headers["Content-Location"] = content_location" (Indicator: " curl ") in Source: fields.py, Observed string: "import localeimport loggingimport osimport sysfrom optparse import Valuesfrom types import ModuleTypefrom typing import Any, Dict, List, Optionalimport pip._vendorfrom pip._vendor.certifi import wherefrom pip._vendor.packaging.version import parse as parse_versionfrom pip import __file__ as pip_locationfrom pip._internal.cli import cmdoptionsfrom pip._internal.cli.base_command import Commandfrom pip._internal.cli.cmdoptions import make_target_pythonfrom pip._internal.cli.status_codes import SUCCESSfrom pip._internal.configuration import Configurationfrom pip._internal.metadata import get_environmentfrom pip._internal.utils.logging import indent_logfrom pip._internal.utils.misc import get_pip_versionlogger = logging.getLogger(__name__)def show_value(name: str, value: Any) -> None: logger.info('%s: %s', name, value)def show_sys_implementation() -> None: logger.info('sys.implementation:') implementation_name = sys.implementation.name with indent_log(): show_value('name', implementation_name)def create_vendor_txt_map() -> Dict[str, str]: vendor_txt_path = os.path.join( os.path.dirname(pip_location), '_vendor', 'vendor.txt' ) with open(vendor_txt_path) as f: # Purge non version specifying lines. # Also, remove any space prefix or suffixes (including comments). lines = [line.strip().split(' ', 1)[0] for line in f.readlines() if '==' in line] # Transform into "module" -> version dict. return dict(line.split('==', 1) for line in lines) # type: ignoredef get_module_from_module_name(module_name: str) -> ModuleType: # Module name can be uppercase in vendor.txt for some reason... module_name = module_name.lower() # PATCH: setuptools is actually only pkg_resources. if module_name == 'setuptools': module_name = 'pkg_resources' __import__( f'pip._vendor.{module_name}', globals(), locals(), level=0 ) return getattr(pip._vendor, module_name)def get_vendor_version_from_module(module_name: str) -> Optional[str]: module = get_module_from_module_name(module_name) version = getattr(module, '__version__', None) if not version: # Try to find version in debundled module info. env = get_environment([os.path.dirname(module.__file__)]) dist = env.get_distribution(module_name) if dist: version = str(dist.version) return versiondef show_actual_vendor_versions(vendor_txt_versions: Dict[str, str]) -> None: """Log the actual version and print extra info if there is a conflict or if the actual version could not be imported. """ for module_name, expected_version in vendor_txt_versions.items(): extra_message = '' actual_version = get_vendor_version_from_module(module_name) if not actual_version: extra_message = ' (Unable to locate actual module version, using'\ ' vendor.txt specified version)' actual_version = expected_version elif parse_version(actual_version) != parse_version(expected_version): extra_message = ' (CONFLICT: vendor.txt suggests version should'\ ' be {})'.format(expected_version) logger.info('%s==%s%s', module_name, actual_version, extra_message)def show_vendor_versions() -> None: logger.info('vendored library versions:') vendor_txt_versions = create_vendor_txt_map() with indent_log(): show_actual_vendor_versions(vendor_txt_versions)def show_tags(options: Values) -> None: tag_limit = 10 target_python = make_target_python(options) tags = target_python.get_tags() # Display the target options that were explicitly provided. formatted_target = target_python.format_given() suffix = '' if formatted_target: suffix = f' (target: {formatted_target})' msg = 'Compatible tags: {}{}'.format(len(tags), suffix) logger.info(msg) if options.verbose < 1 and len(tags) > tag_limit: tags_limited = True tags = tags[:tag_limit] else: tags_limited = False with indent_log(): for tag in tags: logger.info(str(tag)) if tags_limited: msg = ( '...\n' '[First {tag_limit} tags shown. Pass --verbose to show all.]' ).format(tag_limit=tag_limit) logger.info(msg)def ca_bundle_info(config: Configuration) -> str: levels = set() for key, _ in config.items(): levels.add(key.split('.')[0]) if not levels: return "Not specified" levels_that_override_global = ['install', 'wheel', 'download'] global_overriding_level = [ level for level in levels if level in levels_that_override_global ] if not global_overriding_level: return 'global' if 'global' in levels: levels.remove('global') return ", ".join(levels)class DebugCommand(Command): """ Display debug information. """ usage = """ %prog """ ignore_require_venv = True def add_options(self) -> None: cmdoptions.add_target_python_options(self.cmd_opts) self.parser.insert_option_group(0, self.cmd_opts) self.parser.config.load() def run(self, options: Values, args: List[str]) -> int: logger.warning( "This command is only meant for debugging. " "Do not use this with automation for parsing and getting these " "details, since the output and options of this command may " "change without notice." ) show_value('pip version', get_pip_version()) show_value('sys.version', sys.version) show_value('sys.executable', sys.executable) show_value('sys.getdefaultencoding', sys.getdefaultencoding()) show_value('sys.getfilesystemencoding', sys.getfilesystemencoding()) show_value( 'locale.getpreferredencoding', locale.getpreferredencoding(), ) show_value('sys.platform', sys.platform) show_sys_implementation() show_value("'cert' config value", ca_bundle_info(self.parser.config)) show_value("REQUESTS_CA_BUNDLE", os.environ.get('REQUESTS_CA_BUNDLE')) show_value("CURL_CA_BUNDLE", os.environ.get('CURL_CA_BUNDLE')) show_value("pip._vendor.certifi.where()", where()) show_value("pip._vendor.DEBUNDLED", pip._vendor.DEBUNDLED) show_vendor_versions() show_tags(options) return SUCCESS" (Indicator: ""curl") in Source: debug.py4f:T3e9f,Observed string: "import loggingimport os.pathimport pathlibimport reimport urllib.parseimport urllib.requestfrom typing import List, Optional, Tuplefrom pip._internal.exceptions import BadCommand, InstallationErrorfrom pip._internal.utils.misc import HiddenText, display_path, hide_urlfrom pip._internal.utils.subprocess import make_commandfrom pip._internal.vcs.versioncontrol import ( AuthInfo, RemoteNotFoundError, RemoteNotValidError, RevOptions, VersionControl, find_path_to_project_root_from_repo_root, vcs,urlsplit = urllib.parse.urlspliturlunsplit = urllib.parse.urlunsplitlogger = logging.getLogger(__name__)GIT_VERSION_REGEX = re.compile( r"^git version " # Prefix. r"(\d+)" # Major. r"\.(\d+)" # Dot, minor. r"(?:\.(\d+))?" # Optional dot, patch. r".*$" # Suffix, including any pre- and post-release segments we don't care about.HASH_REGEX = re.compile('^[a-fA-F0-9]{40}$')# SCP (Secure copy protocol) shorthand. e.g. 'git@example.com:foo/bar.git'SCP_REGEX = re.compile(r"""^ # Optional user e.g. 'git@' (\w+@)? # Server e.g. 'github.com'. ([^/:]+): # The server-side path. e.g. 'user/project.git'. Must start with an # alphanumeric character so as not to be confusable with a Windows paths # like 'C:/foo/bar' or 'C:\foo\bar'. (\w[^:]*)$""", re.VERBOSE)def looks_like_hash(sha): # type: (str) -> bool return bool(HASH_REGEX.match(sha))class Git(VersionControl): name = 'git' dirname = '.git' repo_name = 'clone' schemes = ( 'git+http', 'git+https', 'git+ssh', 'git+git', 'git+file', ) # Prevent the user's environment variables from interfering with pip: # https://github.com/pypa/pip/issues/1130 unset_environ = ('GIT_DIR', 'GIT_WORK_TREE') default_arg_rev = 'HEAD' @staticmethod def get_base_rev_args(rev): # type: (str) -> List[str] return [rev] def is_immutable_rev_checkout(self, url, dest): # type: (str, str) -> bool _, rev_options = self.get_url_rev_options(hide_url(url)) if not rev_options.rev: return False if not self.is_commit_id_equal(dest, rev_options.rev): # the current commit is different from rev, # which means rev was something else than a commit hash return False # return False in the rare case rev is both a commit hash # and a tag or a branch; we don't want to cache in that case # because that branch/tag could point to something else in the future is_tag_or_branch = bool( self.get_revision_sha(dest, rev_options.rev)[0] ) return not is_tag_or_branch def get_git_version(self) -> Tuple[int, ...]: version = self.run_command( ['version'], show_stdout=False, stdout_only=True ) match = GIT_VERSION_REGEX.match(version) if not match: return () return tuple(int(c) for c in match.groups()) @classmethod def get_current_branch(cls, location): # type: (str) -> Optional[str] """ Return the current branch or None if HEAD isn't at a branch (e.g. detached HEAD). """ # git-symbolic-ref exits with empty stdout if "HEAD" is a detached # HEAD rather than a symbolic ref. In addition, the -q causes the # command to exit with status code 1 instead of 128 in this case # and to suppress the message to stderr. args = ['symbolic-ref', '-q', 'HEAD'] output = cls.run_command( args, extra_ok_returncodes=(1, ), show_stdout=False, stdout_only=True, cwd=location, ) ref = output.strip() if ref.startswith('refs/heads/'): return ref[len('refs/heads/'):] return None @classmethod def get_revision_sha(cls, dest, rev): # type: (str, str) -> Tuple[Optional[str], bool] """ Return (sha_or_none, is_branch), where sha_or_none is a commit hash if the revision names a remote branch or tag, otherwise None. Args: dest: the repository directory. rev: the revision name. """ # Pass rev to pre-filter the list. output = cls.run_command( ['show-ref', rev], cwd=dest, show_stdout=False, stdout_only=True, on_returncode='ignore', ) refs = {} # NOTE: We do not use splitlines here since that would split on other # unicode separators, which can be maliciously used to install a # different revision. for line in output.strip().split("\n"): line = line.rstrip("\r") if not line: continue try: ref_sha, ref_name = line.split(" ", maxsplit=2) except ValueError: # Include the offending line to simplify troubleshooting if # this error ever occurs. raise ValueError(f'unexpected show-ref line: {line!r}') refs[ref_name] = ref_sha branch_ref = f'refs/remotes/origin/{rev}' tag_ref = f'refs/tags/{rev}' sha = refs.get(branch_ref) if sha is not None: return (sha, True) sha = refs.get(tag_ref) return (sha, False) @classmethod def _should_fetch(cls, dest, rev): # type: (str, str) -> bool """ Return true if rev is a ref or is a commit that we don't have locally. Branches and tags are not considered in this method because they are assumed to be always available locally (which is a normal outcome of ``git clone`` and ``git fetch --tags``). """ if rev.startswith("refs/"): # Always fetch remote refs. return True if not looks_like_hash(rev): # Git fetch would fail with abbreviated commits. return False if cls.has_commit(dest, rev): # Don't fetch if we have the commit locally. return False return True @classmethod def resolve_revision(cls, dest, url, rev_options): # type: (str, HiddenText, RevOptions) -> RevOptions """ Resolve a revision to a new RevOptions object with the SHA1 of the branch tag or ref if found. Args: rev_options: a RevOptions object. """ rev = rev_options.arg_rev # The arg_rev property's implementation for Git ensures that the # rev return value is always non-None. assert rev is not None sha, is_branch = cls.get_revision_sha(dest, rev) if sha is not None: rev_options = rev_options.make_new(sha) rev_options.branch_name = rev if is_branch else None return rev_options # Do not show a warning for the common case of something that has # the form of a Git commit hash. if not looks_like_hash(rev): logger.warning( "Did not find branch or tag '%s' assuming revision or ref.", rev, ) if not cls._should_fetch(dest, rev): return rev_options # fetch the requested revision cls.run_command( make_command('fetch', '-q', url, rev_options.to_args()), cwd=dest, ) # Change the revision to the SHA of the ref we fetched sha = cls.get_revision(dest, rev='FETCH_HEAD') rev_options = rev_options.make_new(sha) return rev_options @classmethod def is_commit_id_equal(cls, dest, name): # type: (str, Optional[str]) -> bool """ Return whether the current commit hash equals the given name. Args: dest: the repository directory. name: a string name. """ if not name: # Then avoid an unnecessary subprocess call. return False return cls.get_revision(dest) == name def fetch_new(self, dest, url, rev_options): # type: (str, HiddenText, RevOptions) -> None rev_display = rev_options.to_display() logger.info('Cloning %s%s to %s', url, rev_display, display_path(dest)) self.run_command(make_command('clone', '-q', url, dest)) if rev_options.rev: # Then a specific revision was requested. rev_options = self.resolve_revision(dest, url, rev_options) branch_name = getattr(rev_options, 'branch_name', None) if branch_name is None: # Only do a checkout if the current commit id doesn't match # the requested revision. if not self.is_commit_id_equal(dest, rev_options.rev): cmd_args = make_command( 'checkout', '-q', rev_options.to_args(), ) self.run_command(cmd_args, cwd=dest) elif self.get_current_branch(dest) != branch_name: # Then a specific branch was requested, and that branch # is not yet checked out. track_branch = f'origin/{branch_name}' cmd_args = [ 'checkout', '-b', branch_name, '--track', track_branch, ] self.run_command(cmd_args, cwd=dest) else: sha = self.get_revision(dest) rev_options = rev_options.make_new(sha) logger.info("Resolved %s to commit %s", url, rev_options.rev) #: repo may contain submodules self.update_submodules(dest) def switch(self, dest, url, rev_options): # type: (str, HiddenText, RevOptions) -> None self.run_command( make_command('config', 'remote.origin.url', url), cwd=dest, ) cmd_args = make_command('checkout', '-q', rev_options.to_args()) self.run_command(cmd_args, cwd=dest) self.update_submodules(dest) def update(self, dest, url, rev_options): # type: (str, HiddenText, RevOptions) -> None # First fetch changes from the default remote if self.get_git_version() >= (1, 9): # fetch tags in addition to everything else self.run_command(['fetch', '-q', '--tags'], cwd=dest) else: self.run_command(['fetch', '-q'], cwd=dest) # Then reset to wanted revision (maybe even origin/master) rev_options = self.resolve_revision(dest, url, rev_options) cmd_args = make_command('reset', '--hard', '-q', rev_options.to_args()) self.run_command(cmd_args, cwd=dest) #: update submodules self.update_submodules(dest) @classmethod def get_remote_url(cls, location): # type: (str) -> str """ Return URL of the first remote encountered. Raises RemoteNotFoundError if the repository does not have a remote url configured. """ # We need to pass 1 for extra_ok_returncodes since the command # exits with return code 1 if there are no matching lines. stdout = cls.run_command( ['config', '--get-regexp', r'remote\..*\.url'], extra_ok_returncodes=(1, ), show_stdout=False, stdout_only=True, cwd=location, ) remotes = stdout.splitlines() try: found_remote = remotes[0] except IndexError: raise RemoteNotFoundError for remote in remotes: if remote.startswith('remote.origin.url '): found_remote = remote break url = found_remote.split(' ')[1] return cls._git_remote_to_pip_url(url.strip()) @staticmethod def _git_remote_to_pip_url(url): # type: (str) -> str """ Convert a remote url from what git uses to what pip accepts. There are 3 legal forms **url** may take: 1. A fully qualified url: ssh://git@example.com/foo/bar.git 2. A local project.git folder: /path/to/bare/repository.git 3. SCP shorthand for form 1: git@example.com:foo/bar.git Form 1 is output as-is. Form 2 must be converted to URI and form 3 must be converted to form 1. See the corresponding test test_git_remote_url_to_pip() for examples of sample inputs/outputs. """ if re.match(r"\w+://", url): # This is already valid. Pass it though as-is. return url if os.path.exists(url): # A local bare remote (git clone --mirror). # Needs a file:// prefix. return pathlib.PurePath(url).as_uri() scp_match = SCP_REGEX.match(url) if scp_match: # Add an ssh:// prefix and replace the ':' with a '/'. return scp_match.expand(r"ssh://\1\2/\3") # Otherwise, bail out. raise RemoteNotValidError(url) @classmethod def has_commit(cls, location, rev): # type: (str, str) -> bool """ Check if rev is a commit that is available in the local repository. """ try: cls.run_command( ['rev-parse', '-q', '--verify', "sha^" + rev], cwd=location, log_failed_cmd=False, ) except InstallationError: return False else: return True @classmethod def get_revision(cls, location, rev=None): # type: (str, Optional[str]) -> str if rev is None: rev = 'HEAD' current_rev = cls.run_command( ['rev-parse', rev], show_stdout=False, stdout_only=True, cwd=location, ) return current_rev.strip() @classmethod def get_subdirectory(cls, location): # type: (str) -> Optional[str] """ Return the path to Python project root relative to the repo root. Return None if the project root is in the repo root. """ # find the repo root git_dir = cls.run_command( ['rev-parse', '--git-dir'], show_stdout=False, stdout_only=True, cwd=location, ).strip() if not os.path.isabs(git_dir): git_dir = os.path.join(location, git_dir) repo_root = os.path.abspath(os.path.join(git_dir, '..')) return find_path_to_project_root_from_repo_root(location, repo_root) @classmethod def get_url_rev_and_auth(cls, url): # type: (str) -> Tuple[str, Optional[str], AuthInfo] """ Prefixes stub URLs like 'user@hostname:user/repo.git' with 'ssh://'. That's required because although they use SSH they sometimes don't work with a ssh:// scheme (e.g. GitHub). But we need a scheme for parsing. Hence we remove it again afterwards and return it as a stub. """ # Works around an apparent Git bug # (see https://article.gmane.org/gmane.comp.version-control.git/146500) scheme, netloc, path, query, fragment = urlsplit(url) if scheme.endswith('file'): initial_slashes = path[:-len(path.lstrip('/'))] newpath = ( initial_slashes + urllib.request.url2pathname(path) .replace('\\', '/').lstrip('/') ) after_plus = scheme.find('+') + 1 url = scheme[:after_plus] + urlunsplit( (scheme[after_plus:], netloc, newpath, query, fragment), ) if '://' not in url: assert 'file:' not in url url = url.replace('git+', 'git+ssh://') url, rev, user_pass = super().get_url_rev_and_auth(url) url = url.replace('ssh://', '') else: url, rev, user_pass = super().get_url_rev_and_auth(url) return url, rev, user_pass @classmethod def update_submodules(cls, location): # type: (str) -> None if not os.path.exists(os.path.join(location, '.gitmodules')): return cls.run_command( ['submodule', 'update', '--init', '--recursive', '-q'], cwd=location, ) @classmethod def get_repository_root(cls, location): # type: (str) -> Optional[str] lo" (Indicator: " scp ") in Source: git.py50:T8242,Found string """"distutils.command.registerImplements the Distutils 'register' command (register with the repository).# created 2002/10/21 Richard Jonesimport getpassimport ioimport urllib.parse urllib.requestfrom warnings import warnfrom distutils.core import PyPIRCCommandfrom distutils.errors import *from distutils import logclass register(PyPIRCCommand): description = ("register the distribution with the Python package index") user_options = PyPIRCCommand.user_options + [ ('list-classifiers', None, 'list the valid Trove classifiers') ('strict', None , 'Will stop the registering if the meta-data are not fully compliant') ] boolean_options = PyPIRCCommand.boolean_options + [ 'verify' 'list-classifiers' 'strict'] sub_commands = [('check', lambda self: True)] def initialize_options(self): PyPIRCCommand.initialize_options(self) self.list_classifiers = 0 self.strict = 0 def finalize_options(self): PyPIRCCommand.finalize_options(self) # setting options for the `check` subcommand check_options = {'strict': ('register', self.strict) 'restructuredtext': ('register', 1)} self.distribution.command_options['check'] = check_options def run(self): self.finalize_options() self._set_config() # Run sub commands for cmd_name in self.get_sub_commands(): self.run_command(cmd_name) if self.dry_run: self.verify_metadata() elif self.list_classifiers: self.classifiers() else: self.send_metadata() def check_metadata(self): """Deprecated API.""" warn("distutils.command.register.check_metadata is deprecated, \ use the check command instead", PendingDeprecationWarning) check = self.distribution.get_command_obj('check') check.ensure_finalized() check.strict = self.strict check.restructuredtext = 1 check.run() def _set_config(self): ''' Reads the configuration file and set attributes. ''' config = self._read_pypirc() if config != {}: self.username = config['username'] self.password = config['password'] self.repository = config['repository'] self.realm = config['realm'] self.has_config = True else: if self.repository not in ('pypi', self.DEFAULT_REPOSITORY): raise ValueError('%s not found in .pypirc' % self.repository) if self.repository == 'pypi': self.repository = self.DEFAULT_REPOSITORY self.has_config = False def classifiers(self): ''' Fetch the list of classifiers from the server. ''' url = self.repository+'?:action=list_classifiers' response = urllib.request.urlopen(url) log.info(self._read_pypi_response(response)) def verify_metadata(self): ''' Send the metadata to the package index server to be checked. ''' # send the info to the server and report the result (code, result) = self.post_to_server(self.build_post_data('verify')) log.info('Server response (%s): %s', code, result) def send_metadata(self): ''' Send the metadata to the package index server. Well do the following: 1. figure who the user is and then 2. send the data as a Basic auth'ed POST. First we try to read the username/password from $HOME/.pypirc, which is a ConfigParser-formatted file with a section [distutils] containing username and password entries (both in clear text). Eg: [distutils] index-servers = pypi [pypi] username: fred password: sekrit Otherwise, to figure who the user is, we offer the user three choices: 1. use existing login, 2. register as a new user, or 3. set the password to a random string and email the user. ''' # see if we can short-cut and get the username/password from the # config if self.has_config: choice = '1' username = self.username password = self.password else: choice = 'x' username = password = '' # get the user's login info choices = '1 2 3 4'.split() while choice not in choices: self.announce('''\We need to know who you are so please choose either: 1. use your existing login 2. register as a new user 3. have the server generate a new password for you (and email it to you) or 4. quitYour selection [default 1]: ''', log.INFO) choice = input() if not choice: choice = '1' elif choice not in choices: print('Please choose one of the four options!') if choice == '1': # get the username and password while not username: username = input('Username: ') while not password: password = getpass.getpass('Password: ') # set up the authentication auth = urllib.request.HTTPPasswordMgr() host = urllib.parse.urlparse(self.repository)[1] auth.add_password(self.realm, host, username, password) # send the info to the server and report the result code, result = self.post_to_server(self.build_post_data('submit'), auth) self.announce('Server response (%s): %s' % (code, result), log.INFO) # possibly save the login if code == 200: if self.has_config: # sharing the password in the distribution instance # so the upload command can reuse it self.distribution.password = password else: self.announce(('I can store your PyPI login so future ' 'submissions will be faster.'), log.INFO) self.announce('(the login will be stored in %s)' % \ self._get_rc_file(), log.INFO) choice = 'X' while choice.lower() not in 'yn': choice = input('Save your login (y/N)?') if not choice: choice = 'n' if choice.lower() == 'y': self._store_pypirc(username, password) elif choice == '2': data = {':action': 'user'} data['name'] = data['password'] = data['email'] = '' data['confirm'] = None while not data['name']: data['name'] = input('Username: ') while data['password'] != data['confirm']: while not data['password']: data['password'] = getpass.getpass('Password: ') while not data['confirm']: data['confirm'] = getpass.getpass(' Confirm: ') if data['password'] != data['confirm']: data['password'] = '' data['confirm'] = None print("Password and confirm don't match!") while not data['email']: data['email'] = input(' EMail: ') code, result = self.post_to_server(data) if code != 200: log.info('Server response (%s): %s', code, result) else: log.info('You will receive an email shortly.') log.info(('Follow the instructions in it to ' 'complete registration.')) elif choice == '3': data = {':action': 'password_reset'} data['email'] = '' while not data['email']: data['email'] = input('Your email address: ') code, result = self.post_to_server(data) log.info('Server response (%s): %s', code, result) def build_post_data(self, action): # figure the data to send - the metadata plus some additional # information used by the package server meta = self.distribution.metadata data = { ':action': action, 'metadata_version' : '1.0', 'name': meta.get_name(), 'version': meta.get_version(), 'summary': meta.get_description(), 'home_page': meta.get_url(), 'author': meta.get_contact(), 'author_email': meta.get_contact_email(), 'license': meta.get_licence(), 'description': meta.get_long_description(), 'keywords': meta.get_keywords(), 'platform': meta.get_platforms(), 'classifiers': meta.get_classifiers(), 'download_url': meta.get_download_url(), # PEP 314 'provides': meta.get_provides(), 'requires': meta.get_requires(), 'obsoletes': meta.get_obsoletes(), } if data['provides'] or data['requires'] or data['obsoletes']: data['metadata_version'] = '1.1' return data def post_to_server(self, data, auth=None): ''' Post a query to the server, and return a string response. ''' if 'name' in data: self.announce('Registering %s to %s' % (data['name'], self.repository), log.INFO) # Build up the MIME payload for the urllib2 POST data boundary = '--------------GHSKFJDLGDS7543FJKLFHRE75642756743254' sep_boundary = '\n--' + boundary end_boundary = sep_boundary + '--' body = io.StringIO() for key, value in data.items(): # handle multiple entries for the same name if type(value) not in (type([]), type( () )): value = [value] for value in value: value = str(value) body.write(sep_boundary) body.write('\nContent-Disposition: form-data; name="%s"'%key) body.write("\n\n") body.write(value) if value and value[-1] == '\r': body.write('\n') # write an extra newline (lurve Macs) body.write(end_boundary) body.write("\n") body = body.getvalue().encode("utf-8") # build the Request headers = { 'Content-type': 'multipart/form-data; boundary=%s; charset=utf-8'%boundary, 'Content-length': str(len(body)) } req = urllib.request.Request(self.repository, body, headers) # handle HTTP and include the Basic Auth handler opener = urllib.request.build_opener( urllib.request.HTTPBasicAuthHandler(password_mgr=auth) ) data = '' try: result = opener.open(req) except urllib.error.HTTPError as e: if self.show_response: data = e.fp.read() result = e.code, e.msg except urllib.error.URLError as e: result = 500, str(e) else: if self.show_response: data = self._read_pypi_response(result) result = 200, 'OK' if self.show_response: msg = '\n'.join(('-' * 75, data, '-' * 75)) self.announce(msg, log.INFO) return result"; File: "register.py") Found string "distutils.command.uploadImplements the Distutils 'upload' subcommand (upload package to a packageindex).import osimport ioimport hashlibfrom base64 import standard_b64encodefrom urllib.error import HTTPErrorfrom urllib.request import urlopen, Requestfrom urllib.parse import urlparsefrom distutils.errors import DistutilsError, DistutilsOptionErrorfrom distutils.core import PyPIRCCommandfrom distutils.spawn import spawnfrom distutils import log# PyPI Warehouse supports MD5, SHA256, and Blake2 (blake2-256)# https://bugs.python.org/issue40698_FILE_CONTENT_DIGESTS = { "md5_digest": getattr(hashlib, "md5", None), "sha256_digest": getattr(hashlib, "sha256", None), "blake2_256_digest": getattr(hashlib, "blake2b", None),class upload(PyPIRCCommand): description = "upload binary package to PyPI" user_options = PyPIRCCommand.user_options + [ ('sign', 's', 'sign files to upload using gpg'), ('identity=', 'i', 'GPG identity used to sign files'), ] boolean_options = PyPIRCCommand.boolean_options + ['sign'] def initialize_options(self): PyPIRCCommand.initialize_options(self) self.username = '' self.password = '' self.show_response = 0 self.sign = False self.identity = None def finalize_options(self): PyPIRCCommand.finalize_options(self) if self.identity and not self.sign: raise DistutilsOptionError( "Must use --sign for --identity to have meaning" ) config = self._read_pypirc() if config != {}: self.username = config['username'] self.password = config['password'] self.repository = config['repository'] self.realm = config['realm'] # getting the password from the distribution # if previously set by the register command if not self.password and self.distribution.password: self.password = self.distribution.password def run(self): if not self.distribution.dist_files: msg = ("Must create and upload files in one command " "(e.g. setup.py sdist upload)") raise DistutilsOptionError(msg) for command, pyversion, filename in self.distribution.dist_files: self.upload_file(command, pyversion, filename) def upload_file(self, command, pyversion, filename): # Makes sure the repository URL is compliant schema, netloc, url, params, query, fragments = \ urlparse(self.repository) if params or query or fragments: raise AssertionError("Incompatible url %s" % self.repository) if schema not in ('http', 'https'): raise AssertionError("unsupported schema " + schema) # Sign if requested if self.sign: gpg_args = ["gpg", "--detach-sign", "-a", filename] if self.identity: gpg_args[2:2] = ["--local-user", self.identity] spawn(gpg_args, dry_run=self.dry_run) # Fill in the data - send all the meta-data in case we need to # register a new release f = open(filename,'rb') try: content = f.read() finally: f.close() meta = self.distribution.metadata data = { # action ':action': 'file_upload', 'protocol_version': '1', # identify release 'name': meta.get_name(), 'version': meta.get_version(), # file content 'content': (os.path.basename(filename),content), 'filetype': command, 'pyversion': pyversion, # additional meta-data 'metadata_version': '1.0', 'summary': meta.get_description(), 'home_page': meta.get_url(), 'author': meta.get_contact(), 'author_email': meta.get_contact_email(), 'license': meta.get_licence(), 'description': meta.get_long_description(), 'keywords': meta.get_keywords(), 'platform': meta.get_platforms(), 'classifiers': meta.get_classifiers(), 'download_url': meta.get_download_url(), # PEP 314 'provides': meta.get_provides(), 'requires': meta.get_requires(), 'obsoletes': meta.get_obsoletes(), } data['comment'] = '' # file content digests for digest_name, digest_cons in _FILE_CONTENT_DIGESTS.items(): if digest_cons is None: continue try: data[digest_name] = digest_cons(content).hexdigest() except ValueError: # hash digest not available or blocked by security policy pass if self.sign: with open(filename + ".asc", "rb") as f: data['gpg_signature'] = (os.path.basename(filename) + ".asc", f.read()) # set up the authentication user_pass = (self.username + ":" + self.password).encode('ascii') # The exact encoding of the authentication string is debated. # Anyway PyPI only accepts ascii for both username or password. auth = "Basic " + standard_b64encode(user_pass).decode('ascii') # Build up the MIME payload for the POST data boundary = '--------------GHSKFJDLGDS7543FJKLFHRE75642756743254' sep_boundary = b'\r\n--' + boundary.encode('ascii') end_boundary = sep_boundary + b'--\r\n' body = io.BytesIO() for key, value in data.items(): title = '\r\nContent-Disposition: form-data; name="%s"' % key # handle multiple entries for the same name if not isinstance(value, list): value = [value] for value in value: if type(value) is tuple: title += '; filename="%s"' % value[0] value = value[1] else: value = str(value).encode('utf-8') body.write(sep_boundary) body.write(title.encode('utf-8')) body.write(b"\r\n\r\n") body.write(value) body.write(end_boundary) body = body.getvalue() msg = "Submitting %s to %s" % (filename, self.repository) self.announce(msg, log.INFO) # build the Request headers = { 'Content-type': 'multipart/form-data; boundary=%s' % boundary, 'Content-length': str(len(body)), 'Authorization': auth, } request = Request(self.repository, data=body, headers=headers) # send the data try: result = urlopen(request) status = result.getcode() reason = result.msg except HTTPError as e: status = e.code reason = e.msg except OSError as e: self.announce(str(e), log.ERROR) raise if status == 200: self.announce('Server response (%s): %s' % (status, reason), log.INFO) if self.show_response: text = self._read_pypi_response(result) msg = '\n'.join(('-' * 75, text, '-' * 75)) self.announce(msg, log.INFO) else: msg = 'Upload failed (%s): %s' % (status, reason) self.announce(msg, log.ERROR) raise DistutilsError(msg)"; File: "upload.py") Found string "distutils.command.uploadImplements the Distutils 'upload' subcommand (upload package to a packageindex).import osimport ioimport hashlibfrom base64 import standard_b64encodefrom urllib.request import urlopen, Request, HTTPErrorfrom urllib.parse import urlparsefrom distutils.errors import DistutilsError, DistutilsOptionErrorfrom distutils.core import PyPIRCCommandfrom distutils.spawn import spawnfrom distutils import log# PyPI Warehouse supports MD5, SHA256, and Blake2 (blake2-256)# https://bugs.python.org/issue40698_FILE_CONTENT_DIGESTS = { "md5_digest": getattr(hashlib, "md5", None), "sha256_digest": getattr(hashlib, "sha256", None), "blake2_256_digest": getattr(hashlib, "blake2b", None),class upload(PyPIRCCommand): description = "upload binary package to PyPI" user_options = PyPIRCCommand.user_options + [ ('sign', 's', 'sign files to upload using gpg'), ('identity=', 'i', 'GPG identity used to sign files'), ] boolean_options = PyPIRCCommand.boolean_options + ['sign'] def initialize_options(self): PyPIRCCommand.initialize_options(self) self.username = '' self.password = '' self.show_response = 0 self.sign = False self.identity = None def finalize_options(self): PyPIRCCommand.finalize_options(self) if self.identity and not self.sign: raise DistutilsOptionError( "Must use --sign for --identity to have meaning" ) config = self._read_pypirc() if config != {}: self.username = config['username'] self.password = config['password'] self.repository = config['repository'] self.realm = config['realm'] # getting the password from the distribution # if previously set by the register command if not self.password and self.distribution.password: self.password = self.distribution.password def run(self): if not self.distribution.dist_files: msg = ("Must create and upload files in one command " "(e.g. setup.py sdist upload)") raise DistutilsOptionError(msg) for command, pyversion, filename in self.distribution.dist_files: self.upload_file(command, pyversion, filename) def upload_file(self, command, pyversion, filename): # Makes sure the repository URL is compliant schema, netloc, url, params, query, fragments = \ urlparse(self.repository) if params or query or fragments: raise AssertionError("Incompatible url %s" % self.repository) if schema not in ('http', 'https'): raise AssertionError("unsupported schema " + schema) # Sign if requested if self.sign: gpg_args = ["gpg", "--detach-sign", "-a", filename] if self.identity: gpg_args[2:2] = ["--local-user", self.identity] spawn(gpg_args, dry_run=self.dry_run) # Fill in the data - send all the meta-data in case we need to # register a new release f = open(filename,'rb') try: content = f.read() finally: f.close() meta = self.distribution.metadata data = { # action ':action': 'file_upload', 'protocol_version': '1', # identify release 'name': meta.get_name(), 'version': meta.get_version(), # file content 'content': (os.path.basename(filename),content), 'filetype': command, 'pyversion': pyversion, # additional meta-data 'metadata_version': '1.0', 'summary': meta.get_description(), 'home_page': meta.get_url(), 'author': meta.get_contact(), 'author_email': meta.get_contact_email(), 'license': meta.get_licence(), 'description': meta.get_long_description(), 'keywords': meta.get_keywords(), 'platform': meta.get_platforms(), 'classifiers': meta.get_classifiers(), 'download_url': meta.get_download_url(), # PEP 314 'provides': meta.get_provides(), 'requires': meta.get_requires(), 'obsoletes': meta.get_obsoletes(), } data['comment'] = '' # file content digests for digest_name, digest_cons in _FILE_CONTENT_DIGESTS.items(): if digest_cons is None: continue try: data[digest_name] = digest_cons(content).hexdigest() except ValueError: # hash digest not available or blocked by security policy pass if self.sign: with open(filename + ".asc", "rb") as f: data['gpg_signature'] = (os.path.basename(filename) + ".asc", f.read()) # set up the authentication user_pass = (self.username + ":" + self.password).encode('ascii') # The exact encoding of the authentication string is debated. # Anyway PyPI only accepts ascii for both username or password. auth = "Basic " + standard_b64encode(user_pass).decode('ascii') # Build up the MIME payload for the POST data boundary = '--------------GHSKFJDLGDS7543FJKLFHRE75642756743254' sep_boundary = b'\r\n--' + boundary.encode('ascii') end_boundary = sep_boundary + b'--\r\n' body = io.BytesIO() for key, value in data.items(): title = '\r\nContent-Disposition: form-data; name="%s"' % key # handle multiple entries for the same name if not isinstance(value, list): value = [value] for value in value: if type(value) is tuple: title += '; filename="%s"' % value[0] value = value[1] else: value = str(value).encode('utf-8') body.write(sep_boundary) body.write(title.encode('utf-8')) body.write(b"\r\n\r\n") body.write(value) body.write(end_boundary) body = body.getvalue() msg = "Submitting %s to %s" % (filename, self.repository) self.announce(msg, log.INFO) # build the Request headers = { 'Content-type': 'multipart/form-data; boundary=%s' % boundary, 'Content-length': str(len(body)), 'Authorization': auth, } request = Request(self.repository, data=body, headers=headers) # send the data try: result = urlopen(request) status = result.getcode() reason = result.msg except HTTPError as e: status = e.code reason = e.msg except OSError as e: self.announce(str(e), log.ERROR) raise if status == 200: self.announce('Server response (%s): %s' % (status, reason), log.INFO) if self.show_response: text = self._read_pypi_response(result) msg = '\n'.join(('-' * 75, text, '-' * 75)) self.announce(msg, log.INFO) else: msg = 'Upload failed (%s): %s' % (status, reason) self.announce(msg, log.ERROR) raise DistutilsError(msg)"; File: "upload.py") Found string "# -*- coding: utf-8 -*-"""upload_docsImplements a Distutils 'upload_docs' subcommand (upload documentation tosites other than PyPi such as devpi).from base64 import standard_b64encodefrom distutils import logfrom distutils.errors import DistutilsOptionErrorimport osimport socketimport zipfileimport tempfileimport shutilimport itertoolsimport functoolsimport http.clientimport urllib.parsefrom pkg_resources import iter_entry_pointsfrom .upload import uploaddef _encode(s): return s.encode('utf-8', 'surrogateescape')class upload_docs(upload): # override the default repository as upload_docs isn't # supported by Warehouse (and won't be). DEFAULT_REPOSITORY = 'https://pypi.python.org/pypi/' description = 'Upload documentation to sites other than PyPi such as devpi' user_options = [ ('repository=', 'r', "url of repository [default: %s]" % upload.DEFAULT_REPOSITORY) ('show-response', None, 'display full response text from server') ('upload-dir=', None, 'directory to upload') ] boolean_options = upload.boolean_options def has_sphinx(self): if self.upload_dir is None: for ep in iter_entry_points('distutils.commands', 'build_sphinx'): return True sub_commands = [('build_sphinx', has_sphinx)] def initialize_options(self): upload.initialize_options(self) self.upload_dir = None self.target_dir = None def finalize_options(self): upload.finalize_options(self) if self.upload_dir is None: if self.has_sphinx(): build_sphinx = self.get_finalized_command('build_sphinx') self.target_dir = dict(build_sphinx.builder_target_dirs)['html'] else: build = self.get_finalized_command('build') self.target_dir = os.path.join(build.build_base, 'docs') else: self.ensure_dirname('upload_dir') self.target_dir = self.upload_dir if 'pypi.python.org' in self.repository: log.warn("Upload_docs command is deprecated for PyPi. Use RTD instead.") self.announce('Using upload directory %s' % self.target_dir) def create_zipfile(self, filename): zip_file = zipfile.ZipFile(filename, "w") try: self.mkpath(self.target_dir) # just in case for root dirs files in os.walk(self.target_dir): if root == self.target_dir and not files: tmpl = "no files found in upload directory '%s'" raise DistutilsOptionError(tmpl % self.target_dir) for name in files: full = os.path.join(root, name) relative = root[len(self.target_dir):].lstrip(os.path.sep) dest = os.path.join(relative, name) zip_file.write(full, dest) finally: zip_file.close() def run(self): # Run sub commands for cmd_name in self.get_sub_commands(): self.run_command(cmd_name) tmp_dir = tempfile.mkdtemp() name = self.distribution.metadata.get_name() zip_file = os.path.join(tmp_dir, "%s.zip" % name) try: self.create_zipfile(zip_file) self.upload_file(zip_file) finally: shutil.rmtree(tmp_dir) @staticmethod def _build_part(item, sep_boundary): key values = item title = '\nContent-Disposition: form-data; name="%s"' % key # handle multiple entries for the same name if not isinstance(values, list): values = [values] for value in values: if isinstance(value, tuple): title += '; filename="%s"' % value[0] value = value[1] else: value = _encode(value) yield sep_boundary yield _encode(title) yield b"\n\n" yield value if value and value[-1:] == b'\r': yield b'\n' # write an extra newline (lurve Macs) @classmethod def _build_multipart(cls, data): """ Build up the MIME payload for the POST data """ boundary = '--------------GHSKFJDLGDS7543FJKLFHRE75642756743254' sep_boundary = b'\n--' + boundary.encode('ascii') end_boundary = sep_boundary + b'--' end_items = end_boundary b"\n" builder = functools.partial( cls._build_part, sep_boundary=sep_boundary, ) part_groups = map(builder, data.items()) parts = itertools.chain.from_iterable(part_groups) body_items = itertools.chain(parts, end_items) content_type = 'multipart/form-data; boundary=%s' % boundary return b''.join(body_items) content_type def upload_file(self, filename): with open(filename, 'rb') as f: content = f.read() meta = self.distribution.metadata data = { ':action': 'doc_upload' 'name': meta.get_name() 'content': (os.path.basename(filename) content) } # set up the authentication credentials = _encode(self.username + ':' + self.password) credentials = standard_b64encode(credentials).decode('ascii') auth = "Basic " + credentials body ct = self._build_multipart(data) msg = "Submitting documentation to %s" % (self.repository) self.announce(msg, log.INFO) # build the Request # We can't use urllib2 since we need to send the Basic # auth right with the first request schema, netloc, url, params, query, fragments = \ urllib.parse.urlparse(self.repository) assert not params and not query and not fragments if schema == 'http': conn = http.client.HTTPConnection(netloc) elif schema == 'https': conn = http.client.HTTPSConnection(netloc) else: raise AssertionError("unsupported schema " + schema) data = '' try: conn.connect() conn.putrequest("POST", url) content_type = ct conn.putheader('Content-type', content_type) conn.putheader('Content-length', str(len(body))) conn.putheader('Authorization', auth) conn.endheaders() conn.send(body) except socket.error as e: self.announce(str(e), log.ERROR) return r = conn.getresponse() if r.status == 200: msg = 'Server response (%s): %s' % (r.status, r.reason) self.announce(msg, log.INFO) elif r.status == 301: location = r.getheader('Location') if location is None: location = 'https://pythonhosted.org/%s/' % meta.get_name() msg = 'Upload successful. Visit %s' % location self.announce(msg, log.INFO) else: msg = 'Upload failed (%s): %s' % (r.status, r.reason) self.announce(msg, log.ERROR) if self.show_response: print('-' * 75, r.read(), '-' * 75)"; File: "upload_docs.py")51:T536,Found string "--use-openssl-ca" (Indicator: "openssl-"; Source: "00000000-00002248.00000000.256927.00258000.00000004.mdmp, 00000000-00002248.00000001.258846.00258000.00000004.mdmp, 00000000-00002248.00000002.260765.00258000.00000004.mdmp") Found string "I --openssl-config" (Indicator: "openssl-"; Source: "00000000-00002248.00000000.256927.00258000.00000004.mdmp, 00000000-00002248.00000001.258846.00258000.00000004.mdmp, 00000000-00002248.00000002.260765.00258000.00000004.mdmp") Found string "--use-openssl-ca" (Indicator: "openssl-"; Source: "00000000-00005564.00000000.257718.0025C000.00000004.mdmp, 00000000-00005564.00000001.259637.0025C000.00000004.mdmp") Found string "I --openssl-config" (Indicator: "openssl-"; Source: "00000000-00005564.00000000.257718.0025C000.00000004.mdmp, 00000000-00005564.00000001.259637.0025C000.00000004.mdmp") Found string "--use-openssl-ca" (Indicator: "openssl-"; Source: "00000000-00007332.00000000.254672.0025C000.00000004.mdmp, 00000000-00007332.00000001.256594.0025C000.00000004.mdmp, 00000000-00007332.00000002.258514.0025C000.00000004.mdmp") Found string "I --openssl-config" (Indicator: "openssl-"; Source: "00000000-00007332.00000000.254672.0025C000.00000004.mdmp, 00000000-00007332.00000001.256594.0025C000.00000004.mdmp, 00000000-00007332.00000002.258514.0025C000.00000004.mdmp")52:T101f,file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " accept "; File: "_socket.pyd") file/memory contains long string with (Indicator: "inet_ntoa"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostbyname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "gethostname"; File: "_socket.pyd") file/memory contains long string with (Indicator: "wsastartup"; File: "_socket.pyd") file/memory contains long string with (Indicator: " send "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " socket "; File: "connection.py") file/memory contains long string with (Indicator: " accept "; File: "connection.py") file/memory contains long string with (Indicator: " accept "; File: "specifiers.py") file/memory contains long string with (Indicator: " shutdown "; File: "process.py") file/memory contains long string with (Indicator: " send "; File: "process.py") file/memory contains long string with (Indicator: " socket "; File: "sessions.py") file/memory contains long string with (Indicator: " accept "; File: "sessions.py") file/memory contains long string with (Indicator: " accept "; File: "__init__.py") file/memory contains long string with (Indicator: " socket "; File: "cmdoptions.py") file/memory contains long string with (Indicator: " shutdown "; File: "tempfile.py") file/memory contains long string with (Indicator: " accept "; File: "plistlib.py") file/memory contains long string with (Indicator: " socket "; File: "response.py") file/memory contains long string with (Indicator: " socket "; File: "socketserver.py") file/memory contains long string with (Indicator: " bind "; File: "socketserver.py") file/memory contains long string with (Indicator: " shutdown "; File: "socketserver.py") file/memory contains long string with (Indicator: " socket "; File: "events.py") file/memory contains long string with (Indicator: " bind "; File: "events.py") file/memory contains long string with (Indicator: " accept "; File: "events.py") file/memory contains long string with (Indicator: " shutdown "; File: "events.py") file/memory contains long string with (Indicator: " send "; File: "events.py") file/memory contains long string with (Indicator: " socket "; File: "sslproto.py") file/memory contains long string with (Indicator: " shutdown "; File: "sslproto.py") file/memory contains long string with (Indicator: " send "; File: "sslproto.py") file/memory contains long string with (Indicator: " send "; File: "contextlib.py") file/memory contains long string with (Indicator: " socket "; File: "streams.py") file/memory contains long string with (Indicator: " bind "; File: "spreadsheet.py") file/memory contains long string with (Indicator: " socket "; File: "select.pyd") file/memory contains long string with (Indicator: " socket "; File: "prepare.py") file/memory contains long string with (Indicator: " socket "; File: "webbrowser.py") file/memory contains long string with (Indicator: " socket "; File: "telnetlib.py") file/memory contains long string with (Indicator: " connect "; File: "telnetlib.py") file/memory contains long string with (Indicator: " send "; File: "telnetlib.py") file/memory contains long string with (Indicator: " accept "; File: "loader.py") file/memory contains long string with (Indicator: " accept "; File: "gzip.py") file/memory contains long string with (Indicator: " accept "; File: "handlers.py") file/memory contains long string with (Indicator: " send "; File: "handlers.py") file/memory contains long string with (Indicator: " socket "; File: "adapters.py") file/memory contains long string with (Indicator: " connect "; File: "adapters.py") file/memory contains long string with (Indicator: " send "; File: "adapters.py")53:T366c,Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0`'ujqphmzxfl5x" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" Pattern match: "http://www.w3.org/xml/1998/namespacendataentitynotationpublicpcdatasystemdoctypeelementimpliedattlistversionutf-16" Pattern match: "http://www.w3.org/xml/1998/namespacecdatanotation" Pattern match: "www.memtest86.com" Pattern match: "https://bugs.python.org/issue32751" Pattern match: "https://bugs.python.org/issue20164" Pattern match: "http://domain.tld/path/to/resource" Pattern match: "myimport.zip/mydirectory" Pattern match: "https://github.com/pypa/pip/issues/5868" Pattern match: "https://packaging.python.org/specifications/entry-points/" Pattern match: "http://www.apache.org/licenses/license-2.0#" Pattern match: "http://zooko.com/#" Pattern match: "http://www.apple.com/dtds/propertylist-1.0.dtd" Pattern match: "https://www.gnu.org/software/gettext/manual/gettext.html#plural-forms#" Pattern match: "https://en.wikipedia.org/wiki/mac_address#universal_vs._localdef" Pattern match: "https://github.com/html5lib/html5lib-python/issues/443" Pattern match: "http://bugs.python.org/issue19404" Pattern match: "http://github.com/activestate/appdirs" Pattern match: "https://github.com/pypa/pip/pull/6770" Pattern match: "https://www.python.org/workshops/1997-10/proceedings/loewis.html" Pattern match: "https://github.com/python/mypy/issues/4125" Pattern match: "https://packaging.python.org/specifications/recording-installed-packages/" Pattern match: "http://docs.python.org/reference/datamodel#object.__hash__" Pattern match: "https://github.com/pypa/pip/issues/3383#issuecomment-173267692" Pattern match: "http://myrepo/svn/myapp#egg=myapp.format(url)" Pattern match: "www.python.org" Pattern match: "https://bugs.python.org/issue29585#" Pattern match: "http://www.iana.org/assignments/media-types" Pattern match: "https://www.python.org/dev/peps/pep-0205/#" Pattern match: "http://bugs.python.org/issue14443" Pattern match: "http://example.com/" Pattern match: "http://zgp.org/pipermail/p2p-hackers/2001-september/000316.html" Pattern match: "https://pypi.org/pypi'default_realm" Pattern match: "http://google.com/" Pattern match: "https://github.com/urllib3/urllib3/issues/497" Pattern match: "https://developer.apple.com/documentation/security/1550981-ssl_cipher_suite_values" Pattern match: "https://github.com/python/mypy/issues/2427" Pattern match: "http://www.w3.org/tr/html5/tokenization.html#tag-open-state#" Pattern match: "https://github.com/pypa/pip/issues/1130" Pattern match: "https://wiki.mozilla.org/security/server_side_tls#" Pattern match: "http://www.in-ulm.de/~mascheck/various/shebang/#length" Pattern match: "https://en.wikipedia.org/wiki/server_name_indication" Pattern match: "https://github.com/nir0s/distro/pull/269#" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "https://github.com/python/mypy/issues/7696" Pattern match: "http://starship.python.net/crew/kernr/mingw32/notes.html#" Pattern match: "http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/v1_chap04.html#tag_04_13" Pattern match: "http://json.org" Pattern match: "http://blahblah@rev#egg=foobar[baz]&subdirectory=version_subdir" Pattern match: "http://docs.python.org/library/itertools.html#recipesimport" Pattern match: "http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml" Pattern match: "http://xml.org/sax/features/namespaces" Pattern match: "http://docs.python.org/distutils/sourcedist.html#commands" Pattern match: "http://sourceforge.net/tracker/index.php" Pattern match: "http://www.planetpublish.com/xmlarena/xap/thursday/wordtoxml.pdf_msmarkedsectionclose" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "https://tools.ietf.org/html/rfc7234#section-5.2" Pattern match: "https://github.com/python-hyper/rfc3986percent_re" Pattern match: "http://bugs.python.org/issue18699" Pattern match: "https://github.com/pypa/pip/issues/4963" Pattern match: "http://twistedmatrix.com/trac/browser/trunk/twisted/trial/runner.py" Pattern match: "dkuug.dk/i18n/charmaps/hp-roman8" Pattern match: "http://ru.wikipedia.org/wiki/#" Pattern match: "https://bugs.python.org/issue44497" Pattern match: "https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/dlopen.htmhttps://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/load.htmaix" Pattern match: "https://bugs.python.org/issue19612" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "https://en.wikipedia.org/wiki/executable_and_linkable_format#file_header" Pattern match: "https://github.com/pypa/pip/issues/10151" Pattern match: "https://cloud.google.com/appengine/docs/python/urlfetch" Pattern match: "http://encoding.spec.whatwg.org/" Pattern match: "https://bugs.python.org/issue31672" Pattern match: "http://docs.python.org/3/library/subprocess#subprocess.popen.returncode" Pattern match: "tools.ietf.org/html/rfc2046#section-5.2.4" Pattern match: "https://stackoverflow.com/questions/12632894/why-doesnt-getattr-work-with-exit" Pattern match: "https://github.com/psf/requests/issues/3772" Pattern match: "https://github.com/pypa/pip/issues/7296" Pattern match: "http://bugs.python.org/issue19734" Pattern match: "http://www.robotstxt.org/norobots-rfc.txtimport" Pattern match: "http://www.mozilla.org/projects/intl/universalcharsetdetection.html" Pattern match: "https://github.com/ipython/ipython/issues/4698" Pattern match: "http://en.wikipedia.org/wiki/ansi_escape_code" Pattern match: "https://github.com/python/typeshed/issues/2673" Pattern match: "https://tools.ietf.org/html/rfc2388#section-4.4" Pattern match: "http://bugs.python.org/issue1339007" Pattern match: "https://github.com/python/mypy/issues/5887" Pattern match: "https://bugs.python.org/issue40698_file_content_digests" Pattern match: "https://en.wikipedia.org/wiki/sic" Pattern match: "https://www.python.org/dev/peps/pep-0427/" Pattern match: "https://urllib3.readthedocs.io/en/1.26.x/contrib.html#socks-proxies" Pattern match: "https://pypi.python.org/pypi/" Pattern match: "tar.gz/tar.bz2" Pattern match: "http://www.pythonware.com#" Pattern match: "https://httpbin.org/get" Pattern match: "https://wheel.readthedocs.io/en/latest/" Pattern match: "https://pypi.org/project/build/" Pattern match: "https://github.com/byvoid/uchardet/commit/55b4f23971db61" Pattern match: "https://bugs.python.org/issue30048" Pattern match: "https://bugs.python.org/issue37700" Pattern match: "https://docs.python.org/3/install/index.html#alternate-installation" Pattern match: "http://docs.python.org/3/license.htmlimport" Pattern match: "https://www.python.org/dev/peps/pep-0599/#backwards-compatibility-with-manylinux2010-wheels" Pattern match: "http://localhost:8000/xyz?abc" Pattern match: "https://www.python.org" Pattern match: "https://github.com/pypa/pip/issues/3418" Pattern match: "https://github.com/pypa/setuptools/issues/1024" Pattern match: "http://bugs.jython.org/issue2039" Pattern match: "https://github.com/urllib3/urllib3/issues/1446" Pattern match: "https://upload.pypi.org/legacy/" Pattern match: "http://www.w3.org/tr/html5/syntax.html#tokenizing-character-references_invalid_charrefs" Pattern match: "https://github.com/kennethreitz/requests/pull/2567.def" Pattern match: "https://github.com/pypa/setuptools/issues/199/_install" Pattern match: "http://code.google.com/p/urllib3/issues/detail?id=10from" Pattern match: "https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca" Pattern match: "https://github.com/ionrock/cachecontrol/issues/63" Pattern match: "http://tools.ietf.org/html/rfc7234#section-5.5.4" Pattern match: "http://en.wikipedia.org/wiki/yiq#" Pattern match: "http://www.w3.org/xml/1998/namespacexmlns_namespace" Pattern match: "http://dev.w3.org/html5/spec/entities.jsonwritten" Pattern match: "http://docs.python.org/library/unittest.htmlcopyright" Pattern match: "www.megginson.com/sax/" Pattern match: "https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/site.py#l250" Pattern match: "https://github.com/pypa/pip/issues/1150" Pattern match: "https://github.com/urllib3/urllib3/issues/800" Pattern match: "https://www.ibm.com/\" Pattern match: "https://github.com/pypa/pip/issues/" Pattern match: "https://github.com/python/cpython/blob/fcf1d003bf4f0100c9d0921ff3d70e1127ca1b71/lib/platform.py#l175-l183" Pattern match: "https://pip.pypa.io/surveys/backtracking" Pattern match: "http://en.wikipedia.org/wiki/ansi_escape_codecsi" Pattern match: "https://docs.python.org/2/reference/expressions.html#atom-identifiers" Pattern match: "https://pip.pypa.io/en/stable/user_guide/#using-pip-from-your-program.#" Pattern match: "https://www.python.org/dev/peps/pep-0506/__all__" Pattern match: "https://github.com/archiverjs/node-archiver/blob/master/license" Pattern match: "https://github.com/pypa/pip/pull/935#discussion_r5307003" Pattern match: "https://github.com/python/mypy/issues/3216__all__" Pattern match: "http://www.w3.org/" Pattern match: "http://encoding.spec.whatwg.org/encodings.json" Pattern match: "https://github.com/pypa/pip/issues/1733" Pattern match: "https://whatwg.org/html" Pattern match: "https://pypi.org/" Pattern match: "https://github.com/pypa/pip/issues/5599" Pattern match: "https://cloud.google.com/appengine/docs/standard/runtimes" Pattern match: "https://pypi.org/pypi/{}/json.format(project)" Pattern match: "docs.python.org/3/install/index.html#alternate-installation.scheme_keys" Pattern match: "https://github.com/pypa/packaging__version__" Pattern match: "http://stackoverflow.com/questions/19622133/" Pattern match: "https://github.com/pypa/pip/issues/7498" Pattern match: "https://github.com/pypa/setuptools/pull/1083#issuecomment-315168663needs_makedirs" Pattern match: "https://www.google.com/search" Pattern match: "https://pypi.org/p/twine" Pattern match: "http://svn.red-bean.com/bob/macholib/trunk/macholib/" Heuristic match: "datawebsync-lvmv.onrender.com" Pattern match: "https://github.com/bitinn/node-fetch" Heuristic match: "globalcdn.nuget.org" Heuristic match: "%temp%\nsw44f5.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\liblzma-build.sh" Heuristic match: "%temp%\nsw44f5.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\liblzma-config.sh" Pattern match: "https://nodejs.org/download/release/v14.16.0/win-x64/node.lib" Pattern match: "https://nodejs.org/download/release/v14.16.0/node-v14.16.0-headers.tar.gz" Pattern match: "https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gz" Heuristic match: ".data.rel.ro" Pattern match: "http://www.w3.org/tr/html4/strict.dtd" Pattern match: "http://localhost:8080/swiftconfig" Heuristic match: ".ggpht.com" Heuristic match: ".c.youtube.com" Heuristic match: ".googlevideo.com" Heuristic match: ",.googleusercontent.com" Heuristic match: ".gvt1.com" Heuristic match: "5x.ls" Heuristic match: "!w.am" Pattern match: "http://example.com" Pattern match: "https://support.google.com/chrome/answer/6098869" Pattern match: "g.co/safebrowsingstatus.insecure" Pattern match: "https://bugs.chromium.org/p/chromium/issues/entry?template=safety+tips+appeals.possible" Pattern match: "https://bugs.chromium.org/p/chromium/issues/entry?template=safety+tips+appeals.computerdeviceverify" Heuristic match: "ake.py" Heuristic match: "svs.py" Heuristic match: "svs_test.py" Heuristic match: "inja.py" Heuristic match: "inja_test.py" Heuristic match: "code.py" Heuristic match: "code_test.py" Heuristic match: "_init__.py" Heuristic match: "nalyzer.py" Heuristic match: "ndroid.py" Heuristic match: "make.py" Heuristic match: "clipse.py" Heuristic match: "ypd.py" Heuristic match: "update-gyp.py" Heuristic match: "liblzma-build.sh" Heuristic match: "liblzma-config.sh" Heuristic match: "graphviz.py" Heuristic match: "pretty_gyp.py" Heuristic match: "pretty_sln.py" Heuristic match: "pretty_vcproj.py" Heuristic match: "print.py" Heuristic match: "msvsnew.py" Heuristic match: "msvsproject.py" Heuristic match: "msvssettings.py" Heuristic match: "(msvssettings_test.py" Heuristic match: "msvstoolfile.py" Heuristic match: "msvsuserfile.py" Heuristic match: "msvsutil.py" Heuristic match: "msvsversion.py" Heuristic match: "__init__.py" Heuristic match: "common.py" Heuristic match: "common_test.py" Heuristic match: "easy_xml.py" Heuristic match: "easy_xml_test.py" Heuristic match: "flock_tool.py" Heuristic match: "input.py" Heuristic match: "input_test.py" Heuristic match: "mac_tool.py" Heuristic match: "msvs_emulation.py" Heuristic match: "ninja_syntax.py" Heuristic match: "simple_copy.py" Heuristic match: "win_tool.py" Heuristic match: "$xcode_emulation.py" Heuristic match: "xcode_ninja.py" Heuristic match: "xcodeproj_file.py" Heuristic match: "xml_fix.py" Heuristic match: "analyzer.py" Heuristic match: "android.py" Heuristic match: "cmake.py" Heuristic match: "eclipse.py" Heuristic match: "gypd.py" Heuristic match: "gypsh.py" Heuristic match: "msvs.py" Heuristic match: "msvs_test.py" Heuristic match: "ninja.py" Heuristic match: "ninja_test.py" Heuristic match: "xcode.py" Heuristic match: "xcode_test.py" Heuristic match: "gyp_main.py" Heuristic match: "setup.py" Heuristic match: "test_gyp.py" Heuristic match: "dashdash.bash_completion.in" Heuristic match: "macos_catalina_acid_test.sh" Heuristic match: "dump_dependency_json.py" Heuristic match: "compile_commands_json.py" Heuristic match: "function.prototype.name"54:T1f41,Found URL "https://nodejs.org/download/release/v14.16.0/win-x64/node.lib--debug-port--debug=--debug-brk=--inspect-brk=&--inspect-brk-node=--inspect=--print" - Source: "00000000-00002248.00000000.256927.00258000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0-headers.tar.gzhelp" - Source: "00000000-00002248.00000000.256927.0027C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gz" - Source: "00000000-00002248.00000000.256927.0027C000.00000004.mdmp") Found URL "http://www.w3.org/tr/html4/strict.dtd'>.

" - Source: "00000000-00005564.00000001.259637.28410000.00000002.mdmp") Found URL "http://," - Source: "00000000-00005564.00000001.259637.28410000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00005564.00000001.259637.28410000.00000002.mdmp") Found URL "https://support.google.com/chrome/answer/6098869" - Source: "00000000-00005564.00000001.259637.28410000.00000002.mdmp") Found URL "https://bugs.chromium.org/p/chromium/issues/entry?template=safety+tips+appeals.possible" - Source: "00000000-00005564.00000001.259637.28410000.00000002.mdmp") Found URL "https://bugs.chromium.org/p/chromium/issues/entry?template=safety+tips+appeals.computerdeviceverify" - Source: "00000000-00005564.00000001.259637.28410000.00000002.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/win-x64/node.lib--debug-port--debug=--debug-brk=--inspect-brk=&--inspect-brk-node=--inspect=--print" - Source: "00000000-00007332.00000000.254672.0025C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gz" - Source: "00000000-00007332.00000000.254672.0027C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0-headers.tar.gzhelp" - Source: "00000000-00007332.00000000.254672.0027C000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json04/05" - Source: "00000000-00007332.00000000.254672.EDD50000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,004/05" - Source: "00000000-00007332.00000000.254672.EDD50000.00000002.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/win-x64/node.lib--debug-port--debug=--debug-brk=--inspect-brk=&--inspect-brk-node=--inspect=--print" - Source: "00000000-00007332.00000001.256594.0025C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gz" - Source: "00000000-00007332.00000001.256594.0027C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0-headers.tar.gzhelp" - Source: "00000000-00007332.00000001.256594.0027C000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00007332.00000001.256594.00700000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00007332.00000001.256594.00700000.00000004.mdmp") Found URL "https://chrome.google.com/webstore4003797aextensions.chromeextensionsclientinittime2app.window.fullscreen.overrideesc2hio(a:mf4adk4w7yc5!)k?r" - Source: "00000000-00007332.00000001.256594.01D20000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxalarmsa0])0audioappview,app.window.alwaysontop" - Source: "00000000-00007332.00000001.256594.01D20000.00000004.mdmp") Found URL "https://github.com/webpack/webpack/issues/4175" - Source: "00000000-00007332.00000001.256594.01F9C000.00000004.mdmp") Found URL "http://www.msftcdesktop-f-192.168.0.22001:0negotsssppku2uschannel311\scripts\;c:\users\hapubws\ta\local\programs\python\python311\;c:\userubws\appdata\local\microsoft\windowsapps;c:ram\registry\machine\software\classes\wow64e\clsid\" - Source: "00000000-00007332.00000001.256594.EDB10000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/win-x64/node.lib--debug-port--debug=--debug-brk=--inspect-brk=&--inspect-brk-node=--inspect=--print" - Source: "00000000-00007332.00000002.258514.0025C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gz" - Source: "00000000-00007332.00000002.258514.0025C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0-headers.tar.gzhelp" - Source: "00000000-00007332.00000002.258514.0025C000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00007332.00000002.258514.00700000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00007332.00000002.258514.00700000.00000004.mdmp") Found URL "https://chrome.google.com/webstore4003797aextensions.chromeextensionsclientinittime2app.window.fullscreen.overrideesc2hio(a:mf4adk4w7yc5!)k?r" - Source: "00000000-00007332.00000002.258514.01D20000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxalarmsa0])0audioappview,app.window.alwaysontop" - Source: "00000000-00007332.00000002.258514.01D20000.00000004.mdmp") Found URL "https://www.electronjs.org/docs/tutorial/application-debugging" - Source: "00000000-00007332.00000002.258514.09200000.00000004.mdmp") Found URL "http://www.msftc??\c:\windows\system32\drivers\etc\hosts001:0negotsssppku2uschannel??\c:\windows\system32\drivers\etc\hosts??\c:\windows\system32\drivers\etc\hosts??\pipe\mojo.7332.4340.11572127660449364918??\pipe\mojo.7332.4340.383048035036653496311\scripts\;con311\ubws\appdata\local\microsoft\windowsapps;c:??\c:\windows\system32\drivers\etc\hosts:\windows\registration\r000000000018.clbd\" - Source: "00000000-00007332.00000002.258514.EDB5D000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json04/05" - Source: "00000000-00007332.00000002.258514.EDD50000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,004/05" - Source: "00000000-00007332.00000002.258514.EDD50000.00000002.mdmp")55:T7d6c,Observed string: "r"""TELNET client class.Based on RFC 854: TELNET Protocol Specification by J. Postel andJ. ReynoldsExample:>>> from telnetlib import Telnet>>> tn = Telnet('www.python.org', 79) # connect to finger port>>> tn.write(b'guido\r\n')>>> print(tn.read_all())Login Name TTY Idle When Whereguido Guido van Rossum pts/2 snag.cnri.reston..Note that read_all() won't read until eof -- it just reads some data-- but it guarantees to read at least one byte unless EOF is hit.It is possible to pass a Telnet object to a selector in order to wait untilmore data is available. Note that in this case, read_eager() may return b''even if there was data on the socket, because the protocol negotiation may haveeaten the data. This is why EOFError is needed in some cases to distinguishbetween "no data" and "connection closed" (since the socket also appears readyfor reading when it is closed).To do:- option negotiation- timeout should be intrinsic to the connection object instead of an option on one of the read calls only# Imported modulesimport sysimport socketimport selectorsfrom time import monotonic as _time__all__ = ["Telnet"]# Tunable parametersDEBUGLEVEL = 0# Telnet protocol defaultsTELNET_PORT = 23# Telnet protocol characters (don't change)IAC = bytes([255]) # "Interpret As Command"DONT = bytes([254])DO = bytes([253])WONT = bytes([252])WILL = bytes([251])theNULL = bytes([0])SE = bytes([240]) # Subnegotiation EndNOP = bytes([241]) # No OperationDM = bytes([242]) # Data MarkBRK = bytes([243]) # BreakIP = bytes([244]) # Interrupt processAO = bytes([245]) # Abort outputAYT = bytes([246]) # Are You ThereEC = bytes([247]) # Erase CharacterEL = bytes([248]) # Erase LineGA = bytes([249]) # Go AheadSB = bytes([250]) # Subnegotiation Begin# Telnet protocol options code (don't change)# These ones all come from arpa/telnet.hBINARY = bytes([0]) # 8-bit data pathECHO = bytes([1]) # echoRCP = bytes([2]) # prepare to reconnectSGA = bytes([3]) # suppress go aheadNAMS = bytes([4]) # approximate message sizeSTATUS = bytes([5]) # give statusTM = bytes([6]) # timing markRCTE = bytes([7]) # remote controlled transmission and echoNAOL = bytes([8]) # negotiate about output line widthNAOP = bytes([9]) # negotiate about output page sizeNAOCRD = bytes([10]) # negotiate about CR dispositionNAOHTS = bytes([11]) # negotiate about horizontal tabstopsNAOHTD = bytes([12]) # negotiate about horizontal tab dispositionNAOFFD = bytes([13]) # negotiate about formfeed dispositionNAOVTS = bytes([14]) # negotiate about vertical tab stopsNAOVTD = bytes([15]) # negotiate about vertical tab dispositionNAOLFD = bytes([16]) # negotiate about output LF dispositionXASCII = bytes([17]) # extended ascii character setLOGOUT = bytes([18]) # force logoutBM = bytes([19]) # byte macroDET = bytes([20]) # data entry terminalSUPDUP = bytes([21]) # supdup protocolSUPDUPOUTPUT = bytes([22]) # supdup outputSNDLOC = bytes([23]) # send locationTTYPE = bytes([24]) # terminal typeEOR = bytes([25]) # end or recordTUID = bytes([26]) # TACACS user identificationOUTMRK = bytes([27]) # output markingTTYLOC = bytes([28]) # terminal location numberVT3270REGIME = bytes([29]) # 3270 regimeX3PAD = bytes([30]) # X.3 PADNAWS = bytes([31]) # window sizeTSPEED = bytes([32]) # terminal speedLFLOW = bytes([33]) # remote flow controlLINEMODE = bytes([34]) # Linemode optionXDISPLOC = bytes([35]) # X Display LocationOLD_ENVIRON = bytes([36]) # Old - Environment variablesAUTHENTICATION = bytes([37]) # AuthenticateENCRYPT = bytes([38]) # Encryption optionNEW_ENVIRON = bytes([39]) # New - Environment variables# the following ones come from# http://www.iana.org/assignments/telnet-options# Unfortunately that document does not assign identifiers# to all of them so we are making them upTN3270E = bytes([40]) # TN3270EXAUTH = bytes([41]) # XAUTHCHARSET = bytes([42]) # CHARSETRSP = bytes([43]) # Telnet Remote Serial PortCOM_PORT_OPTION = bytes([44]) # Com Port Control OptionSUPPRESS_LOCAL_ECHO = bytes([45]) # Telnet Suppress Local EchoTLS = bytes([46]) # Telnet Start TLSKERMIT = bytes([47]) # KERMITSEND_URL = bytes([48]) # SEND-URLFORWARD_X = bytes([49]) # FORWARD_XPRAGMA_LOGON = bytes([138]) # TELOPT PRAGMA LOGONSSPI_LOGON = bytes([139]) # TELOPT SSPI LOGONPRAGMA_HEARTBEAT = bytes([140]) # TELOPT PRAGMA HEARTBEATEXOPL = bytes([255]) # Extended-Options-ListNOOPT = bytes([0])# poll/select have the advantage of not requiring any extra file descriptor # contrarily to epoll/kqueue (also, they require a single syscall).if hasattr(selectors, 'PollSelector'): _TelnetSelector = selectors.PollSelectorelse: _TelnetSelector = selectors.SelectSelectorclass Telnet: """Telnet interface class. An instance of this class represents a connection to a telnet server. The instance is initially not connected; the open() method must be used to establish a connection. Alternatively, the host name and optional port number can be passed to the constructor, too. Don't try to reopen an already connected instance. This class has many read_*() methods. Note that some of them raise EOFError when the end of the connection is read, because they can return an empty string for other reasons. See the individual doc strings. read_until(expected, [timeout]) Read until the expected string has been seen, or a timeout is hit (default is no timeout); may block. read_all() Read all data until EOF; may block. read_some() Read at least one byte or EOF; may block. read_very_eager() Read all data available already queued or on the socket, without blocking. read_eager() Read either data already queued or some data available on the socket, without blocking. read_lazy() Read all data in the raw queue (processing it first), without doing any socket I/O. read_very_lazy() Reads all data in the cooked queue, without doing any socket I/O. read_sb_data() Reads available data between SB ... SE sequence. Don't block. set_option_negotiation_callback(callback) Each time a telnet option is read on the input flow, this callback (if set) is called with the following parameters : callback(telnet socket, command, option) option will be chr(0) when there is no option. No other action is done afterwards by telnetlib. """ def __init__(self, host=None, port=0, timeout=socket._GLOBAL_DEFAULT_TIMEOUT): """Constructor. When called without arguments, create an unconnected instance. With a hostname argument, it connects the instance; port number and timeout are optional. """ self.debuglevel = DEBUGLEVEL self.host = host self.port = port self.timeout = timeout self.sock = None self.rawq = b'' self.irawq = 0 self.cookedq = b'' self.eof = 0 self.iacseq = b'' # Buffer for IAC sequence. self.sb = 0 # flag for SB and SE sequence. self.sbdataq = b'' self.option_callback = None if host is not None: self.open(host, port, timeout) def open(self, host, port=0, timeout=socket._GLOBAL_DEFAULT_TIMEOUT): """Connect to a host. The optional second argument is the port number, which defaults to the standard telnet port (23). Don't try to reopen an already connected instance. """ self.eof = 0 if not port: port = TELNET_PORT self.host = host self.port = port self.timeout = timeout sys.audit("telnetlib.Telnet.open", self, host, port) self.sock = socket.create_connection((host, port) timeout) def __del__(self): """Destructor -- close the connection.""" self.close() def msg(self, msg, *args): """Print a debug message, when the debug level is > 0. If extra arguments are present, they are substituted in the message using the standard string formatting operator. """ if self.debuglevel > 0: print('Telnet(%s,%s):' % (self.host, self.port), end=' ') if args: print(msg % args) else: print(msg) def set_debuglevel(self, debuglevel): """Set the debug level. The higher it is, the more debug output you get (on sys.stdout). """ self.debuglevel = debuglevel def close(self): """Close the connection.""" sock = self.sock self.sock = None self.eof = True self.iacseq = b'' self.sb = 0 if sock: sock.close() def get_socket(self): """Return the socket object used internally.""" return self.sock def fileno(self): """Return the fileno() of the socket object used internally.""" return self.sock.fileno() def write(self, buffer): """Write a string to the socket, doubling any IAC characters. Can block if the connection is blocked. May raise OSError if the connection is closed. """ if IAC in buffer: buffer = buffer.replace(IAC, IAC+IAC) sys.audit("telnetlib.Telnet.write", self, buffer) self.msg("send %r", buffer) self.sock.sendall(buffer) def read_until(self, match, timeout=None): """Read until a given string is encountered or until timeout. When no match is found, return whatever is available instead, possibly the empty string. Raise EOFError if the connection is closed and no cooked data is available. """ n = len(match) self.process_rawq() i = self.cookedq.find(match) if i >= 0: i = i+n buf = self.cookedq[:i] self.cookedq = self.cookedq[i:] return buf if timeout is not None: deadline = _time() + timeout with _TelnetSelector() as selector: selector.register(self, selectors.EVENT_READ) while not self.eof: if selector.select(timeout): i = max(0, len(self.cookedq)-n) self.fill_rawq() self.process_rawq() i = self.cookedq.find(match, i) if i >= 0: i = i+n buf = self.cookedq[:i] self.cookedq = self.cookedq[i:] return buf if timeout is not None: timeout = deadline - _time() if timeout < 0: break return self.read_very_lazy() def read_all(self): """Read all data until EOF; block until connection closed.""" self.process_rawq() while not self.eof: self.fill_rawq() self.process_rawq() buf = self.cookedq self.cookedq = b'' return buf def read_some(self): """Read at least one byte of cooked data unless EOF is hit. Return b'' if EOF is hit. Block if no data is immediately available. """ self.process_rawq() while not self.cookedq and not self.eof: self.fill_rawq() self.process_rawq() buf = self.cookedq self.cookedq = b'' return buf def read_very_eager(self): """Read everything that's possible without blocking in I/O (eager). Raise EOFError if connection closed and no cooked data available. Return b'' if no cooked data available otherwise. Don't block unless in the midst of an IAC sequence. """ self.process_rawq() while not self.eof and self.sock_avail(): self.fill_rawq() self.process_rawq() return self.read_very_lazy() def read_eager(self): """Read readily available data. Raise EOFError if connection closed and no cooked data available. Return b'' if no cooked data available otherwise. Don't block unless in the midst of an IAC sequence. """ self.process_rawq() while not self.cookedq and not self.eof and self.sock_avail(): self.fill_rawq() self.process_rawq() return self.read_very_lazy() def read_lazy(self): """Process and return data that's already in the queues (lazy). Raise EOFError if connection closed and no data available. Return b'' if no cooked data available otherwise. Don't block unless in the midst of an IAC sequence. """ self.process_rawq() return self.read_very_lazy() def read_very_lazy(self): """Return any data available in the cooked queue (very lazy). Raise EOFError if connection closed and no data available. Return b'' if no cooked data available otherwise. Don't block. """ buf = self.cookedq self.cookedq = b'' if not buf and self.eof and not self.rawq: raise EOFError('telnet connection closed') return buf def read_sb_data(self): """Return any data available in the SB ... SE queue. Return b'' if no SB ... SE available. Should only be called after seeing a SB or SE command. When a new SB command is found, old unread SB data will be discarded. Don't block. """ buf = self.sbdataq self.sbdataq = b'' return buf def set_option_negotiation_callback(self, callback): """Provide a callback function called after each receipt of a telnet option.""" self.option_callback = callback def process_rawq(self): """Transfer from raw queue to cooked queue. Set self.eof when connection is closed. Don't block unless in the midst of an IAC sequence. """ buf = [b'', b''] try: while self.rawq: c = self.rawq_getchar() if not self.iacseq: if c == theNULL: continue if c == b"\021": continue if c != IAC: buf[self.sb] = buf[self.sb] + c continue else: self.iacseq += c elif len(self.iacseq) == 1: # 'IAC: IAC CMD [OPTION only for WILL/WONT/DO/DONT]' if c in (DO, DONT, WILL, WONT): self.iacseq += c continue self.iacseq = b'' if c == IAC: buf[self.sb] = buf[self.sb] + c else: if c == SB: # SB ... SE start. self.sb = 1 self.sbdataq = b'' elif c == SE: self.sb = 0 self.sbdataq = self.sbdataq + buf[1] buf[1] = b'' if self.option_callback: # Callback is supposed to look into # the sbdataq self.option_callback(self.sock, c, NOOPT) else: # We can't offer automatic processing of # suboptions. Alas we should not get any # unless we did a WILL/DO before. self.msg('IAC %d not recognized' % ord(c)) elif len(self.iacseq) == 2: cmd = self.iacseq[1:2] self.iacseq = b'' opt = c if cmd in (DO, DONT): self.msg('IAC %s %d', cmd == DO and 'DO' or 'DONT', ord(opt)) if self.option_callback: self.option_callback(self.sock, cmd, opt) else: self.sock.sendall(IAC + WONT + opt)" (Indicator: " finger ") in Source: telnetlib.py, Observed string: "from __future__ import absolute_importimport hmacimport osimport sysimport warningsfrom binascii import hexlify unhexlifyfrom hashlib import md5 sha1 sha256from ..exceptions import ( InsecurePlatformWarning, ProxySchemeUnsupported, SNIMissingWarning, SSLError,from ..packages import sixfrom .url import BRACELESS_IPV6_ADDRZ_RE, IPV4_RESSLContext = NoneSSLTransport = NoneHAS_SNI = FalseIS_PYOPENSSL = FalseIS_SECURETRANSPORT = FalseALPN_PROTOCOLS = ["http/1.1"]# Maps the length of a digest to a possible hash function producing this digestHASHFUNC_MAP = {32: md5, 40: sha1, 64: sha256}def _const_compare_digest_backport(a, b): """ Compare two digests of equal length in constant time. The digests must be of type str/bytes. Returns True if the digests match, and False otherwise. """ result = abs(len(a) - len(b)) for left right in zip(bytearray(a) bytearray(b)): result |= left ^ right return result == 0_const_compare_digest = getattr(hmac, "compare_digest", _const_compare_digest_backport)try: # Test for SSL features import ssl from ssl import CERT_REQUIRED wrap_socketexcept ImportError: passtry: from ssl import HAS_SNI # Has SNI?except ImportError: passtry: from .ssltransport import SSLTransportexcept ImportError: passtry: # Platform-specific: Python 3.6 from ssl import PROTOCOL_TLS PROTOCOL_SSLv23 = PROTOCOL_TLSexcept ImportError: try: from ssl import PROTOCOL_SSLv23 as PROTOCOL_TLS PROTOCOL_SSLv23 = PROTOCOL_TLS except ImportError: PROTOCOL_SSLv23 = PROTOCOL_TLS = 2try: from ssl import PROTOCOL_TLS_CLIENTexcept ImportError: PROTOCOL_TLS_CLIENT = PROTOCOL_TLStry: from ssl import OP_NO_COMPRESSION OP_NO_SSLv2 OP_NO_SSLv3except ImportError: OP_NO_SSLv2 OP_NO_SSLv3 = 0x1000000 0x2000000 OP_NO_COMPRESSION = 0x20000try: # OP_NO_TICKET was added in Python 3.6 from ssl import OP_NO_TICKETexcept ImportError: OP_NO_TICKET = 0x4000# A secure default.# Sources for more information on TLS ciphers:# - https://wiki.mozilla.org/Security/Server_Side_TLS# - https://www.ssllabs.com/projects/best-practices/index.html# - https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/# The general intent is:# - prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE) # - prefer ECDHE over DHE for better performance # - prefer any AES-GCM and ChaCha20 over any AES-CBC for better performance and# security # - prefer AES-GCM over ChaCha20 because hardware-accelerated AES is common # - disable NULL authentication MD5 MACs DSS and other# insecure ciphers for security reasons.# - NOTE: TLS 1.3 cipher suites are managed through a different interface# not exposed by CPython (yet!) and are enabled by default if they're available.DEFAULT_CIPHERS = ":".join( [ "ECDHE+AESGCM", "ECDHE+CHACHA20", "DHE+AESGCM", "DHE+CHACHA20", "ECDH+AESGCM", "DH+AESGCM", "ECDH+AES", "DH+AES", "RSA+AESGCM", "RSA+AES", "!aNULL", "!eNULL", "!MD5", "!DSS", ]try: from ssl import SSLContext # Modern SSL?except ImportError: class SSLContext(object): # Platform-specific: Python 2 def __init__(self, protocol_version): self.protocol = protocol_version # Use default values from a real SSLContext self.check_hostname = False self.verify_mode = ssl.CERT_NONE self.ca_certs = None self.options = 0 self.certfile = None self.keyfile = None self.ciphers = None def load_cert_chain(self, certfile, keyfile): self.certfile = certfile self.keyfile = keyfile def load_verify_locations(self, cafile=None, capath=None, cadata=None): self.ca_certs = cafile if capath is not None: raise SSLError("CA directories not supported in older Pythons") if cadata is not None: raise SSLError("CA data not supported in older Pythons") def set_ciphers(self, cipher_suite): self.ciphers = cipher_suite def wrap_socket(self, socket, server_hostname=None, server_side=False): warnings.warn( "A true SSLContext object is not available. This prevents " "urllib3 from configuring SSL appropriately and may cause " "certain SSL connections to fail. You can upgrade to a newer " "version of Python to solve this. For more information, see " "https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html" "#ssl-warnings", InsecurePlatformWarning, ) kwargs = { "keyfile": self.keyfile, "certfile": self.certfile, "ca_certs": self.ca_certs, "cert_reqs": self.verify_mode, "ssl_version": self.protocol, "server_side": server_side, } return wrap_socket(socket, ciphers=self.ciphers, **kwargs)def assert_fingerprint(cert, fingerprint): """ Checks if given fingerprint matches the supplied certificate. :param cert: Certificate as bytes object. :param fingerprint: Fingerprint as string of hexdigits, can be interspersed by colons. """ fingerprint = fingerprint.replace(":", "").lower() digest_length = len(fingerprint) hashfunc = HASHFUNC_MAP.get(digest_length) if not hashfunc: raise SSLError("Fingerprint of invalid length: {0}".format(fingerprint)) # We need encode() here for py32; works on py2 and p33. fingerprint_bytes = unhexlify(fingerprint.encode()) cert_digest = hashfunc(cert).digest() if not _const_compare_digest(cert_digest, fingerprint_bytes): raise SSLError( 'Fingerprints did not match. Expected "{0}" got "{1}".'.format( fingerprint, hexlify(cert_digest) ) )def resolve_cert_reqs(candidate): """ Resolves the argument to a numeric constant, which can be passed to the wrap_socket function/method from the ssl module. Defaults to :data:`ssl.CERT_REQUIRED`. If given a string it is assumed to be the name of the constant in the :mod:`ssl` module or its abbreviation. (So you can specify `REQUIRED` instead of `CERT_REQUIRED`. If it's neither `None` nor a string we assume it is already the numeric constant which can directly be passed to wrap_socket. """ if candidate is None: return CERT_REQUIRED if isinstance(candidate, str): res = getattr(ssl, candidate, None) if res is None: res = getattr(ssl, "CERT_" + candidate) return res return candidatedef resolve_ssl_version(candidate): """ like resolve_cert_reqs """ if candidate is None: return PROTOCOL_TLS if isinstance(candidate, str): res = getattr(ssl, candidate, None) if res is None: res = getattr(ssl, "PROTOCOL_" + candidate) return res return candidatedef create_urllib3_context( ssl_version=None, cert_reqs=None, options=None, ciphers=None """All arguments have the same meaning as ``ssl_wrap_socket``. By default this function does a lot of the same work that ``ssl.create_default_context`` does on Python 3.4+. It: - Disables SSLv2 SSLv3 and compression - Sets a restricted set of server ciphers If you wish to enable SSLv3 you can do:: from pip._vendor.urllib3.util import ssl_ context = ssl_.create_urllib3_context() context.options &= ~ssl_.OP_NO_SSLv3 You can do the same to enable compression (substituting ``COMPRESSION`` for ``SSLv3`` in the last line above). :param ssl_version: The desired protocol version to use. This will default to PROTOCOL_SSLv23 which will negotiate the highest protocol that both the server and your installation of OpenSSL support. :param cert_reqs: Whether to require the certificate verification. This defaults to ``ssl.CERT_REQUIRED``. :param options: Specific OpenSSL options. These default to ``ssl.OP_NO_SSLv2`` ``ssl.OP_NO_SSLv3`` ``ssl.OP_NO_COMPRESSION`` and ``ssl.OP_NO_TICKET``. :param ciphers: Which cipher suites to allow the server to select. :returns: Constructed SSLContext object with specified options :rtype: SSLContext """ # PROTOCOL_TLS is deprecated in Python 3.10 if not ssl_version or ssl_version == PROTOCOL_TLS: ssl_version = PROTOCOL_TLS_CLIENT context = SSLContext(ssl_version) context.set_ciphers(ciphers or DEFAULT_CIPHERS) # Setting the default here, as we may have no ssl module on import cert_reqs = ssl.CERT_REQUIRED if cert_reqs is None else cert_reqs if options is None: options = 0 # SSLv2 is easily broken and is considered harmful and dangerous options |= OP_NO_SSLv2 # SSLv3 has several problems and is now dangerous options |= OP_NO_SSLv3 # Disable compression to prevent CRIME attacks for OpenSSL 1.0+ # (issue #309) options |= OP_NO_COMPRESSION # TLSv1.2 only. Unless set explicitly, do not request tickets. # This may save some bandwidth on wire, and although the ticket is encrypted, # there is a risk associated with it being on wire, # if the server is not rotating its ticketing keys properly. options |= OP_NO_TICKET context.options |= options # Enable post-handshake authentication for TLS 1.3, see GH #1634. PHA is # necessary for conditional client cert authentication with TLS 1.3. # The attribute is None for OpenSSL <= 1.1.0 or does not exist in older # versions of Python. We only enable on Python 3.7.4+ or if certificate # verification is enabled to work around Python issue #37428 # See: https://bugs.python.org/issue37428 if (cert_reqs == ssl.CERT_REQUIRED or sys.version_info >= (3, 7, 4)) and getattr( context, "post_handshake_auth", None ) is not None: context.post_handshake_auth = True def disable_check_hostname(): if ( getattr(context, "check_hostname", None) is not None ): # Platform-specific: Python 3.2 # We do our own verification, including fingerprints and alternative # hostnames. So disable it here context.check_hostname = False # The order of the below lines setting verify_mode and check_hostname # matter due to safe-guards SSLContext has to prevent an SSLContext with # check_hostname=True, verify_mode=NONE/OPTIONAL. This is made even more # complex because we don't know whether PROTOCOL_TLS_CLIENT will be used # or not so we don't know the initial state of the freshly created SSLContext. if cert_reqs == ssl.CERT_REQUIRED: context.verify_mode = cert_reqs disable_check_hostname() else: disable_check_hostname() context.verify_mode = cert_reqs # Enable logging of TLS session keys via defacto standard environment variable # 'SSLKEYLOGFILE', if the feature is available (Python 3.8+). Skip empty values. if hasattr(context, "keylog_filename"): sslkeylogfile = os.environ.get("SSLKEYLOGFILE") if sslkeylogfile: context.keylog_filename = sslkeylogfile return contextdef ssl_wrap_socket( sock, keyfile=None, certfile=None, cert_reqs=None, ca_certs=None, server_hostname=None, ssl_version=None, ciphers=None, ssl_context=None, ca_cert_dir=None, key_password=None, ca_cert_data=None, tls_in_tls=False, """ All arguments except for server_hostname ssl_context and ca_cert_dir have the same meaning as they do when using :func:`ssl.wrap_socket`. :param server_hostname: When SNI is supported the expected hostname of the certificate :param ssl_context: A pre-made :class:`SSLContext` object. If none is provided one will be created using :func:`create_urllib3_context`. :param ciphers: A string of ciphers we wish the client to support. :param ca_cert_dir: A directory containing CA certificates in multiple separate files as supported by OpenSSL's -CApath flag or the capath argument to SSLContext.load_verify_locations(). :param key_password: Optional password if the keyfile is encrypted. :param ca_cert_data: Optional string containing CA certificates in PEM format suitable for passing as the cadata parameter to SSLContext.load_verify_locations() :param tls_in_tls: Use SSLTransport to wrap the existing socket. """ context = ssl_context if context is None: # Note: This branch of code and all the variables in it are no longer # used by urllib3 itself. We should consider deprecating and removing # this code. context = create_urllib3_context(ssl_version, cert_reqs, ciphers=ciphers) if ca_certs or ca_cert_dir or ca_cert_data: try: context.load_verify_locations(ca_certs, ca_cert_dir, ca_cert_data) except (IOError, OSError) as e: raise SSLError(e) elif ssl_context is None and hasattr(context, "load_default_certs"): # try to load OS default certs; works well on Windows (require Python3.4+) context.load_default_certs() # Attempt to detect if we get the goofy behavior of the # keyfile being encrypted and OpenSSL asking for the # passphrase via the terminal and instead error out. if keyfile and key_password is None and _is_key_file_encrypted(keyfile): raise SSLError("Client private key is encrypted password is required") if certfile: if key_password is None: context.load_cert_chain(certfile, keyfile) else: context.load_cert_chain(certfile, keyfile, key_password) try: if hasattr(context, "set_alpn_protocols"): context.set_alpn_protocols(ALPN_PROTOCOLS) except NotImplementedError: # Defensive: in CI, we always have set_alpn_protocols pass # If we detect server_hostname is an IP address then the SNI # extension should not be used according to RFC3546 Section 3.1 use_sni_hostname = server_hostname and not is_ipaddress(server_hostname) # SecureTransport uses server_hostname in certificate verification. send_sni = (use_sni_hostname and HAS_SNI) or ( IS_SECURETRANSPORT and server_hostname ) # Do not warn the user if server_hostname is an invalid SNI hostname. if not HAS_SNI and use_sni_hostname: warnings.warn( "An HTTPS request has been made but the SNI (Server Name " "Indication) extension to TLS is not available on this platform. " "This may cause the server to present an incorrect TLS " "certificate which can cause validation failures. You can upgrade to " "a newer version of Python to solve this. For more information see " "https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html" "#ssl-warnings", SNIMissingWarning, ) if send_sni: ssl_sock = _ssl_wrap_socket_impl( sock, context, tls_in_tls, server_hostname=server_hostname ) else: ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls) return ssl_sockdef is_ipaddress(hostname): """Detects whether the hostname given is an IPv4 or IPv6 address. Also detects IPv6 addresses with Zone IDs. :param str hostname: Hostname to examine. :return: True if the hostname is an IP address False otherwise. """ if not six.PY2 and isinstance(hostname, bytes): # IDN A-label bytes are ASCII compatible. hostname = hostname.decode("ascii") return bool(IPV4_RE.match(hostname) or BRACELESS_IPV6_ADDRZ_RE.match(hostname))def _is_key_file_encrypted(key_file): """Detects if a key file is encrypted or not.""" with open(key_file, "r") as f: for line in f: # Look for P" (Indicator: ""finger") in Source: ssl_.py56:T536,Found registry query API: "RegEnumValueW" in file "a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66.bin" Found registry query API: "RegEnumKeyW" in file "a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66.bin" Found registry query API: "RegQueryValueExW" in file "a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66.bin" Found registry query API: "RegOpenKeyExW" in file "a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66.bin" Found registry query API: "RegOpenKeyExW" in "00000000-00002248.00000001.258846.99E7F000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002248.00000001.258846.99E7F000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002248.00000001.258846.99E7F000.00000002.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00002248.00000001.258846.99E7F000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002248.00000001.258846.99E7F000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp"57:T4fc,Found reference to API "LookupAccountSidLocalW" (Indicator: "LookupAccountSid"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp") Found reference to API "LookupAccountNameLocalW" (Indicator: "LookupAccountName"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp") Found reference to API "LsaLookupNames" (Indicator: "LsaLookupNames"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp") Found reference to API "NetWkstaUserGetInfo" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp")58:Tb52,"'.format(' '.join(info)) def cancel(self): if not self._cancelled: self._cancelled = True if self._loop.get_debug(): # Keep a representation in debug mode to keep callback and # parameters. For example, to log the warning # "Executing took 2.5 second" self._repr = repr(self) self._callback = None self._args = None def cancelled(self): return self._cancelled def _run(self): try: self._context.run(self._callback, *self._args) except (SystemExit, KeyboardInterrupt): raise except BaseException as exc: cb = format_helpers._format_callback_source( self._callback, self._args) msg = f'Exception in callback {cb}' context = { 'message': msg, 'exception': exc, 'handle': self, } if self._source_traceback: context['source_traceback'] = self._source_traceback self._loop.call_exception_handler(context) self = None # Needed to break cycles when an exception occurs.class TimerHandle(Handle): """Object returned by timed callback registration methods.""" __slots__ = ['_scheduled', '_when'] def __init__(self, when, callback, args, loop, context=None): assert when is not None super().__init__(callback, args, loop, context) if self._source_traceback: del self._source_traceback[-1] self._when = when self._scheduled = False def _repr_info(self): info = super()._repr_info() pos = 2 if self._cancelled else 1 info.insert(pos, f'when={self._when}') return info def __hash__(self): return hash(self._when) def __lt__(self, other): if isinstance(other, TimerHandle): return self._when < other._when return NotImplemented def __le__(self, other): if isinstance(other, TimerHandle): return self._when < other._when or self.__eq__(other) return NotImplemented def __gt__(self, other): if isinstance(other, TimerHandle): return self._when > other._when return NotImplemented def __ge__(self, other): if isinstance(other, TimerHandle): return self._when > other._when or self.__eq__(other) return NotImplemented def __eq__(self, other): if isinstance(other, TimerHandle): return (self._when == other._when and self._callback == other._callback and self._args == other._args and self._cancelled == other._cancelled) return NotImplemented def cancel(self): if not self._cancelled: self._loop._timer_handle_cancelled(self) super().cancel() def when(self): """Return a scheduled callback time. The time is an absolute timestamp using the same time reference as loop.time(). """ return self._whenclass AbstractServer: """Abstract server returned by create_server().""" def close(self): """Stop serving. This leaves existing connections open.""" raise NotImplementedError def get_loop(self): """Get the event loop the Server object is attached to.""" raise NotImplementedError def is_serving(self): """Return True if the server is accepting connections.""" raise NotImplementedError async def start_serving(self): """Start accepting connections. This method is idempotent so it can be called when the server is already being serving. """ raise NotImplementedError async def serve_forever(self): """Start accepting connections until the coroutine is cancelled. The server is closed when the coroutine is cancelled. """ raise NotImplementedError async def wait_closed(self): """Coroutine to wait until service is closed.""" raise NotImplementedError async def __aenter__(self): return self async def __aexit__(self, *exc): self.close() await self.wait_closed()class AbstractEventLoop: """Abstract event loop.""" # Running and stopping the event loop. def run_forever(self): """Run the event loop until stop() is called.""" raise NotImplementedError def run_until_complete(self, future): """Run the event loop until a Future is done. Return the Future's result, or raise its exception. """ raise NotImplementedError def stop(self): """Stop the event loop as soon as reasonable. Exactly how soon that is may depend on the implementation, but no more I/O callbacks should be scheduled. """ raise NotImplementedError def is_running(self): """Return whether the event loop is currently running.""" raise NotImplementedError def is_closed(self): """Returns True if the event loop was closed.""" raise NotImplementedError def close(self): """Close the loop. The loop should not be running. This is idempotent and irreversible. No other methods should be called after this one. """ raise NotImplementedError async def shutdown_asyncgens(self): """Shutdown all active asynchronous generators.""" raise NotImplementedError async def shutdown_default_executor(self): """Schedule the shutdown of the default executor.""" raise NotImplementedError # Methods scheduling callbacks. All these return Handles. def _timer_handle_cancelled(self, handle): """Notification that a TimerHandle has been cancelled.""" raise NotImplementedError def call_soon(self, callback, *args): return self.call_later(0, callback, *args) def call_later(self, delay, callback, *args): raise NotImplementedError def call_at(self, when, callback, *args): raise NotImplementedError def time(self): raise NotImplementedError def create_future(self): raise NotImplementedError # Method scheduling a coroutine object: create a task. def create_task(self, coro, *, name=None): raise NotImplementedError # Methods for interacting with threads. def call_soon_threadsafe(self, callback, *args): raise NotImplementedError def run_in_executor(self, executor, func, *args): raise NotImplementedError def set_default_executor(self, executor): raise NotImplementedError # Network I/O methods returning Futures. async def getaddrinfo(self, host, port, *, family=0, type=0, proto=0, flags=0): raise NotImplementedError async def getnameinfo(self, sockaddr, flags=0): raise NotImplementedError async def create_connection( self, protocol_factory, host=None, port=None, *, ssl=None, family=0, proto=0, flags=0, sock=None, local_addr=None, server_hostname=None, ssl_handshake_timeout=None, happy_eyeballs_delay=None, interleave=None): raise NotImplementedError async def create_server( self, protocol_factory, host=None, port=None, *, family=socket.AF_UNSPEC, flags=socket.AI_PASSIVE, sock=None, backlog=100, ssl=None, reuse_address=None, reuse_port=None, ssl_handshake_timeout=None, start_serving=True): """A coroutine which creates a TCP server bound to host and port. The return value is a Server object which can be used to stop the service. If host is an empty string or None all interfaces are assumed and a list of multiple sockets will be returned (most likely one for IPv4 and another one for IPv6). The host parameter can also be a sequence (e.g. list) of hosts to bind to. family can be set to either AF_INET or AF_INET6 to force the socket to use IPv4 or IPv6. If not set it will be determined from host (defaults to AF_UNSPEC). flags is a bitmask for getaddrinfo(). sock can optionally be specified in order to use a preexisting socket object. backlog is the maximum number of queued connections passed to listen() (defaults to 100). ssl can be set to an SSLContext to enable SSL over the accepted connections. reuse_address tells the kernel to reuse a local socket in TIME_WAIT state, without waiting for its natural timeout to expire. If not specified will automatically be set to True on UNIX. reuse_port tells the kernel to allow this endpoint to be bound to the same port as other existing endpoints are bound to, so long as they all set this flag when being created. This option is not supported on Windows. ssl_handshake_timeout is the time in seconds that an SSL server will wait for completion of the SSL handshake before aborting the connection. Default is 60s. start_serving set to True (default) causes the created server to start accepting connections immediately. When set to False, the user should await Server.start_serving() or Server.serve_forever() to make the server to start accepting connections. """ raise NotImplementedError async def sendfile(self, transport, file, offset=0, count=None, *, fallback=True): """Send a file through a transport. Return an amount of sent bytes. """ raise NotImplementedError async def start_tls(self, transport, protocol, sslcontext, *, server_side=False, server_hostname=None, ssl_handshake_timeout=None): """Upgrade a transport to TLS. Return a new transport that *protocol* should start using immediately. """ raise NotImplementedError async def create_unix_connection( self, protocol_factory, path=None, *, ssl=None, sock=None, server_hostname=None, ssl_handshake_timeout=None): raise NotImplementedError async def create_unix_server( self, protocol_factory, path=None, *, sock=None, backlog=100, ssl=None, ssl_handshake_timeout=None, start_serving=True): """A coroutine which creates a UNIX Domain Socket server. The return value is a Server object, which can be used to stop the service. path is a str, representing a file system path to bind the server socket to. sock can optionally be specified in order to use a preexisting socket object. backlog is the maximum number of queued connections passed to listen() (defaults to 100). ssl can be set to an SSLContext to enable SSL over the accepted connections. ssl_handshake_timeout is the time in seconds that an SSL server will wait for the SSL handshake to complete (defaults to 60s). start_serving set to True (default) causes the created server to start accepting connections immediately. When set to False, the user should await Server.start_serving() or Server.serve_forever() to make the server to start accepting connections. """ raise NotImplementedError async def connect_accepted_socket( self, protocol_factory, sock, *, ssl=None, ssl_handshake_timeout=None): """Handle an accepted connection. This is used by servers that accept connections outside of asyncio, but use asyncio to handle connections. This method is a coroutine. When completed, the coroutine returns a (transport, protocol) pair. """ raise NotImplementedError async def create_datagram_endpoint(self, protocol_factory, local_addr=None, remote_addr=None, *, family=0, proto=0, flags=0, reuse_address=None, reuse_port=None, allow_broadcast=None, sock=None): """A coroutine which creates a datagram endpoint. This method will try to establish the endpoint in the background. When successful, the coroutine returns a (transport, protocol) pair. protocol_factory must be a callable returning a protocol instance. socket family AF_INET, socket.AF_INET6 or socket.AF_UNIX depending on host (or family if specified), socket type SOCK_DGRAM. reuse_address tells the kernel to reuse a local socket in TIME_WAIT state, without waiting for its natural timeout to expire. If not specified it will automatically be set to True on UNIX. reuse_port tells the kernel to allow this endpoint to be bound to the same port as other existing endpoints are bound to, so long as they all set this flag when being created. This option is not supported on Windows and some UNIX's. If the :py:data:`~socket.SO_REUSEPORT` constant is not defined then this capability is unsupported. allow_broadcast tells the kernel to allow this endpoint to send messages to the broadcast address. sock can optionally be specified in order to use a preexisting socket object. """ raise NotImplementedError # Pipes and subprocesses. async def connect_read_pipe(self, protocol_factory, pipe): """Register read pipe in event loop. Set the pipe to non-blocking mode. protocol_factory should instantiate object with Protocol interface. pipe is a file-like object. Return pair (transport, protocol) where transport supports the ReadTransport interface.""" # The reason to accept file-like object instead of just file descriptor # is: we need to own pipe and close it at transport finishing # Can got complicated errors if pass f.fileno(), # close fd in pipe transport then close f and vise versa. raise NotImplementedError async def connect_write_pipe(self, protocol_factory, pipe):" (Indicator: ""shutdown ") in Source: events.py62:T451,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "nsExec.dll") file/memory contains long string with (Indicator: "TerminateProcess"; File: "nsExec.dll") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002248.00000000.256927.99A8A000.00000002.mdmp, 00000000-00002248.00000001.258846.AF531000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002248.00000000.256927.99A8A000.00000002.mdmp, 00000000-00002248.00000001.258846.AF531000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002248.00000000.256927.99A8A000.00000002.mdmp, 00000000-00002248.00000001.258846.99E7F000.00000002.mdmp, 00000000-00002248.00000001.258846.AF531000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004668.00000000.255813.F83C0000.00000002.mdmp")63:T14ab,"JRbot.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "52FA734E2EC5DC010000000000000000000000000200000000") "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "496FF4512EC5DC010000000000000000000000000200000000") "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "974FF8522EC5DC010000000000000000000000000200000000") "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C966527C2EC5DC010000000000000000000000000200000000") "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "63FDEA7C2EC5DC010000000000000000000000000200000000") "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "E0CD9D7D2EC5DC010000000000000000000000000200000000") "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "));~."), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "94ABDF7E2EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "0BF4697F2EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "D8A7E2802EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "960461812EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "5061DF812EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "E1D070822EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "BA7BFD822EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "D36185832EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "3C8308842EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "666990842EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "29ED15852EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "DF4994852EC5DC010000000000000000000000000200000000"), "JRbot.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "EFCD19862EC5DC010000000000000000000000000200000000")64:T3503,"Low-level helpers for the SecureTransport bindings.These are Python functions that are not directly related to the high-level APIsbut are necessary to get them to work. They include a whole bunch of low-levelCoreFoundation messing about and memory management. The concerns in this moduleare almost entirely about trying to avoid memory leaks and providingappropriate and useful assistance to the higher-level code.import base64import ctypesimport itertoolsimport osimport reimport sslimport structimport tempfilefrom .bindings import CFConst, CoreFoundation, Security# This regular expression is used to grab PEM data out of a PEM bundle._PEM_CERTS_RE = re.compile( b"-----BEGIN CERTIFICATE-----\n(.*?)\n-----END CERTIFICATE-----", re.DOTALLdef _cf_data_from_bytes(bytestring): """ Given a bytestring create a CFData object from it. This CFData object must be CFReleased by the caller. """ return CoreFoundation.CFDataCreate( CoreFoundation.kCFAllocatorDefault, bytestring, len(bytestring) )def _cf_dictionary_from_tuples(tuples): """ Given a list of Python tuples create an associated CFDictionary. """ dictionary_size = len(tuples) # We need to get the dictionary keys and values out in the same order. keys = (t[0] for t in tuples) values = (t[1] for t in tuples) cf_keys = (CoreFoundation.CFTypeRef * dictionary_size)(*keys) cf_values = (CoreFoundation.CFTypeRef * dictionary_size)(*values) return CoreFoundation.CFDictionaryCreate( CoreFoundation.kCFAllocatorDefault, cf_keys, cf_values, dictionary_size, CoreFoundation.kCFTypeDictionaryKeyCallBacks, CoreFoundation.kCFTypeDictionaryValueCallBacks, )def _cfstr(py_bstr): """ Given a Python binary data create a CFString. The string must be CFReleased by the caller. """ c_str = ctypes.c_char_p(py_bstr) cf_str = CoreFoundation.CFStringCreateWithCString( CoreFoundation.kCFAllocatorDefault, c_str, CFConst.kCFStringEncodingUTF8, ) return cf_strdef _create_cfstring_array(lst): """ Given a list of Python binary data create an associated CFMutableArray. The array must be CFReleased by the caller. Raises an ssl.SSLError on failure. """ cf_arr = None try: cf_arr = CoreFoundation.CFArrayCreateMutable( CoreFoundation.kCFAllocatorDefault, 0, ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks), ) if not cf_arr: raise MemoryError("Unable to allocate memory!") for item in lst: cf_str = _cfstr(item) if not cf_str: raise MemoryError("Unable to allocate memory!") try: CoreFoundation.CFArrayAppendValue(cf_arr, cf_str) finally: CoreFoundation.CFRelease(cf_str) except BaseException as e: if cf_arr: CoreFoundation.CFRelease(cf_arr) raise ssl.SSLError("Unable to allocate array: %s" % (e,)) return cf_arrdef _cf_string_to_unicode(value): """ Creates a Unicode string from a CFString object. Used entirely for error reporting. Yes it annoys me quite a lot that this function is this complex. """ value_as_void_p = ctypes.cast(value, ctypes.POINTER(ctypes.c_void_p)) string = CoreFoundation.CFStringGetCStringPtr( value_as_void_p, CFConst.kCFStringEncodingUTF8 ) if string is None: buffer = ctypes.create_string_buffer(1024) result = CoreFoundation.CFStringGetCString( value_as_void_p, buffer, 1024, CFConst.kCFStringEncodingUTF8 ) if not result: raise OSError("Error copying C string from CFStringRef") string = buffer.value if string is not None: string = string.decode("utf-8") return stringdef _assert_no_error(error, exception_class=None): """ Checks the return code and throws an exception if there is an error to report """ if error == 0: return cf_error_string = Security.SecCopyErrorMessageString(error, None) output = _cf_string_to_unicode(cf_error_string) CoreFoundation.CFRelease(cf_error_string) if output is None or output == u"": output = u"OSStatus %s" % error if exception_class is None: exception_class = ssl.SSLError raise exception_class(output)def _cert_array_from_pem(pem_bundle): """ Given a bundle of certs in PEM format turns them into a CFArray of certs that can be used to validate a cert chain. """ # Normalize the PEM bundle's line endings. pem_bundle = pem_bundle.replace(b"\r\n", b"\n") der_certs = [ base64.b64decode(match.group(1)) for match in _PEM_CERTS_RE.finditer(pem_bundle) ] if not der_certs: raise ssl.SSLError("No root certificates specified") cert_array = CoreFoundation.CFArrayCreateMutable( CoreFoundation.kCFAllocatorDefault, 0, ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks), ) if not cert_array: raise ssl.SSLError("Unable to allocate memory!") try: for der_bytes in der_certs: certdata = _cf_data_from_bytes(der_bytes) if not certdata: raise ssl.SSLError("Unable to allocate memory!") cert = Security.SecCertificateCreateWithData( CoreFoundation.kCFAllocatorDefault, certdata ) CoreFoundation.CFRelease(certdata) if not cert: raise ssl.SSLError("Unable to build cert object!") CoreFoundation.CFArrayAppendValue(cert_array, cert) CoreFoundation.CFRelease(cert) except Exception: # We need to free the array before the exception bubbles further. # We only want to do that if an error occurs: otherwise, the caller # should free. CoreFoundation.CFRelease(cert_array) return cert_arraydef _is_cert(item): """ Returns True if a given CFTypeRef is a certificate. """ expected = Security.SecCertificateGetTypeID() return CoreFoundation.CFGetTypeID(item) == expecteddef _is_identity(item): """ Returns True if a given CFTypeRef is an identity. """ expected = Security.SecIdentityGetTypeID() return CoreFoundation.CFGetTypeID(item) == expecteddef _temporary_keychain(): """ This function creates a temporary Mac keychain that we can use to work with credentials. This keychain uses a one-time password and a temporary file to store the data. We expect to have one keychain per socket. The returned SecKeychainRef must be freed by the caller including calling SecKeychainDelete. Returns a tuple of the SecKeychainRef and the path to the temporary directory that contains it. """ # Unfortunately, SecKeychainCreate requires a path to a keychain. This # means we cannot use mkstemp to use a generic temporary file. Instead, # we're going to create a temporary directory and a filename to use there. # This filename will be 8 random bytes expanded into base64. We also need # some random bytes to password-protect the keychain we're creating, so we # ask for 40 random bytes. random_bytes = os.urandom(40) filename = base64.b16encode(random_bytes[:8]).decode("utf-8") password = base64.b16encode(random_bytes[8:]) # Must be valid UTF-8 tempdirectory = tempfile.mkdtemp() keychain_path = os.path.join(tempdirectory, filename).encode("utf-8") # We now want to create the keychain itself. keychain = Security.SecKeychainRef() status = Security.SecKeychainCreate( keychain_path, len(password), password, False, None, ctypes.byref(keychain) ) _assert_no_error(status) # Having created the keychain, we want to pass it off to the caller. return keychain, tempdirectorydef _load_items_from_file(keychain, path): """ Given a single file loads all the trust objects from it into arrays and the keychain. Returns a tuple of lists: the first list is a list of identities the second a list of certs. """ certificates = [] identities = [] result_array = None with open(path, "rb") as f: raw_filedata = f.read() try: filedata = CoreFoundation.CFDataCreate( CoreFoundation.kCFAllocatorDefault, raw_filedata, len(raw_filedata) ) result_array = CoreFoundation.CFArrayRef() result = Security.SecItemImport( filedata, # cert data None, # Filename, leaving it out for now None, # What the type of the file is, we don't care None, # what's in the file, we don't care 0, # import flags None, # key params, can include passphrase in the future keychain, # The keychain to insert into ctypes.byref(result_array), # Results ) _assert_no_error(result) # A CFArray is not very useful to us as an intermediary # representation, so we are going to extract the objects we want # and then free the array. We don't need to keep hold of keys: the # keychain already has them! result_count = CoreFoundation.CFArrayGetCount(result_array) for index in range(result_count): item = CoreFoundation.CFArrayGetValueAtIndex(result_array, index) item = ctypes.cast(item, CoreFoundation.CFTypeRef) if _is_cert(item): CoreFoundation.CFRetain(item) certificates.append(item) elif _is_identity(item): CoreFoundation.CFRetain(item) identities.append(item) finally: if result_array: CoreFoundation.CFRelease(result_array) CoreFoundation.CFRelease(filedata) return (identities, certificates)def _load_client_cert_chain(keychain, *paths): """ Load certificates and maybe keys from a number of files. Has the end goal of returning a CFArray containing one SecIdentityRef and then zero or more SecCertificateRef objects suitable for use as a client certificate trust chain. """ # Ok, the strategy. # # This relies on knowing that macOS will not give you a SecIdentityRef # unless you have imported a key into a keychain. This is a somewhat # artificial limitation of macOS (for example, it doesn't necessarily # affect iOS), but there is nothing inside Security.framework that lets you # get a SecIdentityRef without having a key in a keychain. # # So the policy here is we take all the files and iterate them in order. # Each one will use SecItemImport to have one or more objects loaded from # it. We will also point at a keychain that macOS can use to work with the # private key. # # Once we have all the objects, we'll check what we actually have. If we # already have a SecIdentityRef in hand, fab: we'll use that. Otherwise, # we'll take the first certificate (which we assume to be our leaf) and # ask the keychain to give us a SecIdentityRef with that cert's associated # key. # # We'll then return a CFArray containing the trust chain: one # SecIdentityRef and then zero-or-more SecCertificateRef objects. The # responsibility for freeing this CFArray will be with the caller. This # CFArray must remain alive for the entire connection, so in practice it # will be stored with a single SSLSocket, along with the reference to the # keychain. certificates = [] identities = [] # Filter out bad paths. paths = (path for path in paths if path) try: for file_path in paths: new_identities, new_certs = _load_items_from_file(keychain, file_path) identities.extend(new_identities) certificates.extend(new_certs) # Ok, we have everything. The question is: do we have an identity? If # not, we want to grab one from the first cert we have. if not identities: new_identity = Security.SecIdentityRef() status = Security.SecIdentityCreateWithCertificate( keychain, certificates[0], ctypes.byref(new_identity) ) _assert_no_error(status) identities.append(new_identity) # We now want to release the original certificate, as we no longer # need it. CoreFoundation.CFRelease(certificates.pop(0)) # We now need to build a new CFArray that holds the trust chain. trust_chain = CoreFoundation.CFArrayCreateMutable( CoreFoundation.kCFAllocatorDefault, 0, ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks), ) for item in itertools.chain(identities, certificates): # ArrayAppendValue does a CFRetain on the item. That's fine, # because the finally block will release our other refs to them. CoreFoundation.CFArrayAppendValue(trust_chain, item) return trust_chain finally: for obj in itertools.chain(identities, certificates): CoreFoundation.CFRelease(obj)TLS_PROTOCOL_VERSIONS = { "SSLv2": (0, 2), "SSLv3": (3, 0), "TLSv1": (3, 1), "TLSv1.1": (3, 2), "TLSv1.2": (3, 3),def _build_tls_unknown_ca_alert(version): """ Builds a TLS alert record for an unknown CA. """ ver_maj, ver_min = TLS_PROTOCOL_VERSIONS[version] severity_fatal = 0x02 description_unknown_ca = 0x30 msg = struct.pack(">BB", severity_fatal, description_unknown_ca) msg_len = len(msg) record_type_alert = 0x15 record = struct.pack(">BBBH", record_type_alert, ver_maj, ver_min, msg_len) + msg return record" (Indicator: "----begin certificate----") in Source: low_level.py65:Tcee," HTTP/1.1 502 Bad Gateway Date: Sun 05 Apr 2026 12:01:55 GMT Content-Length: 0 Connection: close rndr-id: ec02d05a-a40d-43da x-render-origin-server: Render cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9e7865e3f99bcea4-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /api/heartbeat?hwid=DESKTOP-FVVF82A&userKey=MONTHLY-A47B7636141D6E507112EE783AB7C929 HTTP/1.1 x-api-key: test_api_key_12345 Accept: */* User-Agent: node-fetch/1.0 (+https://github.com/bitinn/node-fetch) Accept-Encoding: gzip,deflate Host: datawebsync-lvmv.onrender.com Connection: close" Response ==> HTTP/1.1 503 Service Unavailable Date: Sun 05 Apr 2026 12:01:55 GMT Content-Length: 0 Connection: close rndr-id: f8b13983-dd1e-4f7d x-render-routing: hibernate-wake-error cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9e7866a1f8f8eb30-SJC alt-svc: h3=":443"; ma=86400 with no response body6c:T425," None # Only relevant on macOS if sys.platform != \"darwin\": return try: import ssl except ImportError: return # Checks for OpenSSL 1.0.1 if ssl.OPENSSL_VERSION_NUMBER >= 0x1000100F: return try: from pip._vendor.urllib3.contrib import securetransport except (ImportError, OSError): return securetransport.inject_into_urllib3()inject_securetransport()\" (Indicator: \"OpenSSL 1.\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"S\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00005564.00000000.257718.0027C000.00000004.mdmp, 00000000-00005564.00000001.259637.0027C000.00000004.mdmp\")\n Found string \"C:\\WINDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00005564.00000000.257718.0027C000.00000004.mdmp, 00000000-00005564.00000001.259637.0027C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://localhost:8000\"Found ip/domain with port number \"http://localhost:8080\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://datawebsync-lvmv.onrender.com/api/heartbeat?hwid=DESKTOP-FVVF82A&userKey=MONTHLY-A47B7636141D6E507112EE783AB7C929","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"datawebsync-lvmv.onrender.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"23.38.109.79\" on port \"443\"\n HTTPS traffic to \"216.24.57.7\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-1_1.dll\"\n YARA signature for AES encryption matched on file \"nsis7z.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"libGLESv2.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"d3dcompiler_47.dll\"\n YARA signature for encryption algorithm process \"00000000-00002248\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"file/memory contains long string with (Indicator: \" ssh \"; File: \"git.py\")\n file/memory contains long string with (Indicator: \" ssh \"; File: \"session.py\")","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"$55","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00004668.00000000.255813.9A060000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002248.00000000.256927.7DB30000.00000004.mdmp, 00000000-00002248.00000001.258846.7DB30000.00000004.mdmp, 00000000-00002248.00000002.260765.7DB30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66.bin\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00002248.00000000.256927.99A8A000.00000002.mdmp, 00000000-00002248.00000001.258846.AF531000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00002248.00000000.256927.99A8A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00004668.00000000.255813.F83C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"\"; File: \"spreadsheet.py\")\n file/memory contains long string with (Indicator: \"\"; File: \"spreadsheet.py\")\n file/memory contains long string with (Indicator: \"\"; File: \"feedparser.py\")\n file/memory contains long string with (Indicator: \"[end]\"; File: \"util.py\")\n file/memory contains long string with (Indicator: \"[left]\"; File: \"sortvisu.py\")\n file/memory contains long string with (Indicator: \"[right]\"; File: \"sortvisu.py\")\n file/memory contains long string with (Indicator: \"[esc]\"; File: \"decoder.py\")\n file/memory contains long string with (Indicator: \"[end]\"; File: \"decoder.py\")\n file/memory contains long string with (Indicator: \"[end]\"; File: \"lazy_wheel.py\")\n file/memory contains long string with (Indicator: \"[end]\"; File: \"abitype.py\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"hostname\"; Source: \"00000000-00005564.00000001.259637.28410000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"JRbot.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"JRbot.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"PROFILEENUMMODE\")\n \"JRbot.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"ICMPROFILE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00004668.00000000.255813.F83C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete users from a group (API string)","description":"Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDelUser\"; Source: \"00000000-00004668.00000000.255813.F83C0000.00000002.mdmp\")\n Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00004668.00000000.255813.F83C0000.00000002.mdmp\")\n Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00004668.00000000.255813.F83C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-218","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66.bin\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66.bin\"\n Found registry deletion API: \"RegDeleteKeyExW\" in file \"a06e55a35e81e1f42ad14bd372554f97a06d89efa4bbba31388b44be33008d66.bin\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69d24e457fdbfc80040a6177"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"