molly

README

Molly
=====

Molly (after Molly Hooper in Sherlock Holmes, not the drug) is an automated file analysis and extraction tool. It can search files for user-defined patterns and perform various actions when a match is found.  

Molly comes with a number of operators for analyzing and files in addition to a simple API for adding custom ones.

Molly was initially developed in the SECONDS (Secure Connected Devices) project for binary extraction from foreign firmware images.

Installation
------------

Binaries are found on the `download page <https://bitbucket.org/vahidi/molly/downloads/>`_, but might be slightly out of date.

To build from source::

    sudo apt install golang build-essential git
    git clone https://bitbucket.org/vahidi/molly
    cd molly
    make && make test && make run

Rules
-----

Molly uses a rule database to store known patterns. The rules have a simple and familiar syntax, for example the following will recognize ZIP files)::

    rule ZIP (bigendian = false, tag = "archive") {
        var header = String(0, 4); /* extract 4-byte string at position 0 */
        var csize = Long(18);      /* extract 32-bit at position 18 */
        var usize = Long(22);
        if header == { 'P', 'K', 0x05, 0x06} || header == {'P', 'K', 0x03, 0x04};
        extract("zip", "");       /* apply the ZIP extractor on this file */
    }

For more detailed information refer to the `manual <manual.pdf>`_.

Documentation

Overview

Package molly is the root for the library API in molly

Index

• func ExtractReport(m *types.Molly) *types.Report
• func LoadRules(m *types.Molly, files ...string) error
• func LoadRulesFromText(m *types.Molly, text string) error
• func New() *types.Molly
• func ScanData(m *types.Molly, data []byte) error
• func ScanFiles(m *types.Molly, files ...string) error
• func Version() (int, int, int)

Functions

func ExtractReport

func ExtractReport(m *types.Molly) *types.Report

ExtractReport generates a report

func LoadRules

func LoadRules(m *types.Molly, files ...string) error

LoadRules reads rules from files

func LoadRulesFromText

func LoadRulesFromText(m *types.Molly, text string) error

LoadRulesFromText reads rules from a string

func New

func New() *types.Molly

New creates a new molly context

func ScanData

func ScanData(m *types.Molly, data []byte) error

ScanData scans a byte vector for matches.

func ScanFiles

func ScanFiles(m *types.Molly, files ...string) error

ScanFiles scans a set of files for matches.

func Version

func Version() (int, int, int)

Version returns the library version (major, minor, maintenance)