Using pycparser to accomplish replacement of sensitive snippets to more healthy ones.
This extension is made for vscode . The extension uses the power of pycparser to generate an AST of C file in an active editor window.
The C file may possibly contain harmful snippets which cause buffer overflow and these may write to sensitive blocks of memory.
To avoid that we replace those snippets of code with their better halfs.
- pycparser
- python shell
- shelljs
- node.js.
- vscode (OFCOURSE)
- Clone the Repo and install the requirements first.
- Put the whole folder to the following path:
- Linux / Mac : $HOME/.vscode/extensions
- Windows : %USERPROFILE%.vscode\extensions
- You're done. The extension has been setup.
Currently we have few snippets of code that we are replacing. But it can be extended by the following steps:
- In req/doASTcheck/checkAST.py :
- update the classMap dictionary with the classes as key that maybe involved in buffer overflow and their start and end lines in req/doASTcheck/initialPattern.txt file.
Example : classMap = {'FuncCall':(1,10)}
- update the classMap dictionary with the classes as key that maybe involved in buffer overflow and their start and end lines in req/doASTcheck/initialPattern.txt file.
- In req/doASTcheck/initialPattern.txt :
- update the patterns you want to find in the file in the following format. ( In the below code replace_lines refer to those in req/doASTreplace/replacementPattern.txt file).
start: line_with_which_to_replace_start : line_with_which_to_replace_end // the pattern end:
- update the patterns you want to find in the file in the following format. ( In the below code replace_lines refer to those in req/doASTreplace/replacementPattern.txt file).
- In req/doASTreplace/replacementPattern.txt:
- update the patterns that is to be replaced in the following format.
//the pattern
- update the patterns that is to be replaced in the following format.
We have checked the plugin on Ubuntu 15.04 and 16.04. It is yet to be tested on Windows. Further some classes ( in checkAST.py ) have not been fully coded as we did not see any harmful snippets produced by those. So as we discover more such threats, we'll update the code.