{"nbformat":4,"nbformat_minor":0,"metadata":{"colab":{"provenance":[],"authorship_tag":"ABX9TyOjq0m1hbmcPaLCFCq8XqHL"},"kernelspec":{"name":"python3","display_name":"Python 3"},"language_info":{"name":"python"}},"cells":[{"cell_type":"code","execution_count":null,"metadata":{"id":"wMht3HO8xs-p"},"outputs":[],"source":["#extract opcode markov image"]},{"cell_type":"code","source":["from google.colab import drive\n","\n","\n","drive.mount('/content/gdrive', force_remount=True)"],"metadata":{"colab":{"base_uri":"https://localhost:8080/"},"id":"DqjAfzJhWLCY","executionInfo":{"status":"ok","timestamp":1724840826584,"user_tz":-60,"elapsed":20220,"user":{"displayName":"Jinwei","userId":"14655726557162511328"}},"outputId":"ec262e98-993b-40ba-e40f-ad907e579768"},"execution_count":null,"outputs":[{"output_type":"stream","name":"stdout","text":["Mounted at /content/gdrive\n"]}]},{"cell_type":"code","source":["import os\n","import pandas as pd\n","from collections import Counter\n","\n","def count_strings_in_range(folder_path, output_file, start_index, end_index, accumulated_counts_file=None):\n","\n","    total_counts = Counter()\n","\n","\n","    if accumulated_counts_file and os.path.exists(accumulated_counts_file):\n","        existing_counts = pd.read_csv(accumulated_counts_file, index_col=0, dtype={'出现次数': int})\n","        total_counts.update(existing_counts['出现次数'].to_dict())\n","\n","\n","    files = sorted([f for f in os.listdir(folder_path) if f.lower().endswith('.csv')])\n","\n","\n","    if start_index < 0 or end_index > len(files):\n","        print(\"指定的文件范围超出文件列表范围。\")\n","        return\n","\n","\n","    files_to_process = files[start_index:end_index]\n","\n","    processed = 0\n","\n","    for filename in files_to_process:\n","        file_path = os.path.join(folder_path, filename)\n","\n","        try:\n","\n","            df = pd.read_csv(file_path, header=None, dtype=str)\n","\n","\n","            string_list = df[0].dropna().tolist()\n","            total_counts.update(string_list)\n","\n","            processed += 1\n","\n","\n","            if processed % 10 == 0:\n","                print(f'已处理 {processed} 个文件...')\n","\n","        except Exception as e:\n","            print(f'处理文件 {filename} 时出错: {e}')\n","\n","\n","    result_df = pd.DataFrame(total_counts.items(), columns=['字符串', '出现次数'])\n","\n","\n","    result_df.sort_values(by='出现次数', ascending=False, inplace=True)\n","\n","\n","    result_df.to_csv(output_file, index=False, encoding='utf-8-sig')\n","\n","    print(f'统计完成，处理了文件索引范围 {start_index} 到 {end_index} 的文件。结果已保存到 {output_file}。')\n","\n","\n"],"metadata":{"id":"80xEr6RtZjFC"},"execution_count":null,"outputs":[]},{"cell_type":"code","source":["import os\n","import pandas as pd\n","import numpy as np\n","import matplotlib.pyplot as plt\n","\n","#Extract Opcode Markov Image\n","\n","\n","input_folder = './ASM opcode/'\n","output_folder = './OpcodeImage/'\n","map_file = './OpcodeAndFrequency.csv'\n","\n","\n","instruction_df = pd.read_csv(map_file)\n","instruction_map = {instruction_df.iloc[i, 0]: i for i in range(len(instruction_df))}\n","\n","\n","csv_files = [f for f in os.listdir(input_folder) if f.endswith('.csv')]\n","\n","\n","files_to_process = csv_files[0:min(6000, len(csv_files))]\n","\n","processed = 0\n","\n","\n","for file_name in files_to_process:\n","\n","    input_file_path = os.path.join(input_folder, file_name)\n","\n","    data = pd.read_csv(input_file_path, header=None)\n","\n","\n","    strings = data.iloc[:, 0].tolist()\n","    len_strings = len(strings)\n","\n","\n","    matrix = np.zeros((224, 224))\n","\n","\n","    for k in range(len_strings - 1):\n","        str1 = strings[k]\n","        str2 = strings[k + 1]\n","\n","\n","        if str1 in instruction_map and str2 in instruction_map:\n","            i = instruction_map[str1]\n","            j = instruction_map[str2]\n","\n","            i = min(i, 223)\n","            j = min(j, 223)\n","\n","            matrix[i, j] += 1\n","        else:\n","            print(f'字符串 {str1} 或 {str2} 不在map中')\n","\n","\n","    row_sums = matrix.sum(axis=1, keepdims=True)\n","\n","    matrix = np.divide(matrix, row_sums, where=row_sums!=0)\n","\n","\n","    matrix = matrix * 255\n","\n","\n","    name, _ = os.path.splitext(file_name)\n","    output_file_path = os.path.join(output_folder, f'{name}.png')\n","\n","\n","    plt.imsave(output_file_path, matrix, cmap='gray')\n","\n","    processed += 1\n","\n","\n","    if processed % 10 == 0:\n","        print(f'已处理 {processed} 个文件...')\n","\n","print('所有文件处理完成。')\n"],"metadata":{"id":"I8YFrI-Iajn_"},"execution_count":null,"outputs":[]},{"cell_type":"code","source":["import pandas as pd\n","\n","\n","def process_and_match_opcodes(csv_file, asm_file, output_csv):\n","\n","\n","    df = pd.read_csv(csv_file)\n","    opcodes = df.iloc[:, 0].tolist()\n","\n","\n","    def remove_comment(line):\n","        return line.split(';')[0].strip()\n","\n","\n","    def split_line(line):\n","        return line.split()\n","\n","\n","    matched_opcodes = []\n","\n","\n","    with open(asm_file, 'r', encoding='utf-8', errors='ignore') as asm:\n","        for line in asm:\n","            clean_line = remove_comment(line)\n","            tokens = split_line(clean_line)\n","            for token in tokens:\n","                if token in opcodes and token not in matched_opcodes:\n","                    matched_opcodes.append(token)\n","\n","\n","\n","    if matched_opcodes:\n","        output_df = pd.DataFrame(matched_opcodes, columns=['Opcode'])\n","        output_df.to_csv(output_csv, index=False, encoding='utf-8')\n","        print(f\"匹配结果已保存到 {output_csv}\")\n","    else:\n","        print(\"未匹配到任何操作码。\")\n","\n","\n"],"metadata":{"id":"RyYMxtyDmzsU"},"execution_count":null,"outputs":[]}]}