Update: python-per-line.py Version 0.0.2

Malware Analysis
1

python-per-line is a tool to apply a Python expression on each line of input.

I updated it because I had to process large credential dumps (I’ll blog about this later).

This new version can process .gz files too, and includes three new predefined Python functions: IFF, RIN and SBC.

From the man page:

IFF is a predefined Python function that implements the if Function
(IFF = IF Function). It takes three arguments: expression, valueTrue,
valueFalse. If expression is true, then valueTrue is returned,
otherwise valueFalse is returned.

RIN is a predefined Python function that uses the repr function if

needed (RIN = Repr If Needed). When a string contains characters that

need to be escaped to be used in Python source code, repr(string) is

returned, otherwise the string itself is returned.


SBC is a predefined Python function that helps with selecting a value

from lines with values and separators (Separator Based Cut = SBC). SBC

takes five arguments: data, separator, columns, column, failvalue.

data is the data we want to parse (usually line), separator is the

separator character, columns is the number of columns per line, column

is the value we want to select (cut) starting from 0, and failvalue is

the value that SBC needs to return if the function fails (for example

because there are less columns in the line than specified by the

columns value).

Here is an example. We use this file with credentials (creds.txt):

username1:password

username2

username3:pass:word

username4:


And this is the command to extract the passwords:

python-per-line.py “SBC(line, ‘:’, 2, 1, [])” creds.txt


The result:

password

pass:word


If a line contains more separators than specified by the columns

argument, then everything past the last expected separator is

considered the last value (this includes the extra separator(s)). We

can see this with line “username3:pass:word”. The password is

pass:word (not pass). SBC returns pass:word.

If a line contains less separators than specified by the columns

argument, then the failvalue is returned. [] makes python-per-line

skip an output line, that is why no output is produced for user2.

python-per-line_V0_0_2.zip (https)
MD5: AB2377D366AB33992A535AF1EE489CBD
SHA256: 045F398FBCF6DDFF4A25B38007ADDF89B3256C21C8808B58FBC96855D55E6171


Article Link: https://blog.didierstevens.com/2017/07/23/update-python-per-line-py-version-0-0-2/