Check if the given sample has already been analyzed before uploading it.

Author: Pandora

bazaar/core/api_view.py

@@ -2,10 +2,12 @@
 
 from django.conf import settings
 from django.core.files.storage import default_storage
+from django.http import JsonResponse
+from rest_framework.reverse import reverse_lazy
 from elasticsearch import Elasticsearch
 from rest_framework.authentication import TokenAuthentication
 from rest_framework.decorators import api_view, authentication_classes, permission_classes, throttle_classes
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.permissions import IsAuthenticated, AllowAny
 from rest_framework.response import Response
 from rest_framework.throttling import UserRateThrottle
 
@@ -104,3 +106,28 @@ def search(request):
         return Response(results)
     except Exception as e:
         return Response([])
+
+
+@api_view(['GET'])
+@authentication_classes([])
+@permission_classes([AllowAny])
+def sample_exists(request, sha256):
+    if not sha256:
+        return Response({
+            'ret_code': -1,
+            'requested_hash': sha256,
+            'message': 'Parameter sha256 not specified'
+        })
+    if default_storage.exists(sha256):
+        return Response({
+            'ret_code': 0,
+            'requested_hash': sha256,
+            'message': 'A sample with the same sha256 already exists',
+            'report_url': reverse_lazy('front:report', [sha256]),
+        })
+    else:
+        return Response({
+            'ret_code': -2,
+            'requested_hash': sha256,
+            'message': 'Sample not found'
+        })

bazaar/core/urls.py

@@ -8,5 +8,6 @@
     path("upload", apk_upload, name="bazaar-api"),
     path("report/<str:sha256>", apk_analysis_report, name="bazaar-api"),
     path("status/<str:sha256>", analysis_tasks_status, name="bazaar-api"),
+    path("exists/<str:sha256>", sample_exists, name="bazaar-api"),
     path("search/", search, name="bazaar-api"),
 ]

bazaar/static/js/jquery-3.3.1.slim.min.js

@@ -6,5 +6,57 @@ $(function () {
         $(this).tab('show')
     })
     $('#menu-tabs a[href="#fingerprints"]').tab('show')
+    $('#file_upload_selector').change(function () {
+        const upload_btn = $('#upload_btn')
+        const show_report_btn = $('#show_report_btn')
+        upload_btn.hide()
+        show_report_btn.hide()
+        hashfile(this, upload_btn, show_report_btn)
+    })
 })
 
+
+function hashfile(file_selector, upload_btn, report_btn) {
+    return readbinaryfile(file_selector.files[0])
+        .then(function (result) {
+            result = new Uint8Array(result);
+            return window.crypto.subtle.digest('SHA-256', result);
+        }).then(function (result) {
+            result = new Uint8Array(result);
+            const hash = Uint8ArrayToHexString(result);
+            $.ajax(`/api/exists/${hash}`).done(function (data){
+                if(data.ret_code == 0){
+                    report_btn.attr('href', data.report_url)
+                    report_btn.show()
+                } else {
+                    upload_btn.show()
+                }
+            })
+        });
+}
+
+function readbinaryfile(file) {
+    return new Promise((resolve, reject) => {
+        var fr = new FileReader();
+        fr.onload = () => {
+            resolve(fr.result)
+        };
+        fr.readAsArrayBuffer(file);
+    });
+}
+
+function Uint8ArrayToHexString(ui8array) {
+    var hexstring = '',
+        h;
+    for (var i = 0; i < ui8array.length; i++) {
+        h = ui8array[i].toString(16);
+        if (h.length == 1) {
+            h = '0' + h;
+        }
+        hexstring += h;
+    }
+    var p = Math.pow(2, Math.ceil(Math.log2(hexstring.length)));
+    hexstring = hexstring.padStart(p, '0');
+    return hexstring;
+}
+

bazaar/static/js/project.js

@@ -125,6 +125,8 @@
   <script src="{% static 'js/clipboard.js' %}"></script>
   {% endcompress %}
   {% endblock javascript %}
+  {% block inline_js %}
+  {% endblock inline_js %}
 </body>
 
 </html>

bazaar/templates/base.html

@@ -43,25 +43,29 @@ <h3 class=" text-white">Mobile threat intelligence for the masses</h3>
           <form class="form-horizontal text-center" method="post" action="{% url "front:basic_upload" %}"
                 enctype="multipart/form-data">{% csrf_token %}
             <div class="custom-file ">
-              <input type="file" class="custom-file-input" id="customFile" name="apk">
-              <label class="custom-file-label" for="customFile">APK to be analyzed ({{ max_size|filesizeformat }}
+              <input type="file" class="custom-file-input" id="file_upload_selector" oncchange="javascript:hashfile();" name="apk">
+              <label class="custom-file-label" for="file_upload_selector">APK to be analyzed ({{ max_size|filesizeformat }}
                 max.)</label>
             </div>
             <div class="control-group mt-1">
               <div class="controls">
-                <button type="submit" class="btn btn-primary">
+                <button type="submit" class="btn btn-primary" id="upload_btn" style="display: none">
                   Upload
                 </button>
+                <a href="#" id="show_report_btn" style="display: none" class="btn btn-primary">
+                  Show report
+                </a>
               </div>
             </div>
           </form>
         </div>
       </div>
 
-      
+
       <div class="row justify-content-center">
         <div class="col text-center">
-            Try a real life example of Pithus on TryHackMe: <a href="https://tryhackme.com/room/androidmalwareanalysis">Android Malware Analysis</a>
+          Try a real life example of Pithus on TryHackMe: <a href="https://tryhackme.com/room/androidmalwareanalysis">Android
+          Malware Analysis</a>
         </div>
       </div>
       <div class="row justify-content-center">