Models API#

class Base(StructuredNode):
    """Base node type"""

    __abstract_node__ = True

    # Common attributes
    uid = UniqueIdProperty()

    md5 = StringProperty(required=True)
    sha256 = StringProperty(required=True)
    size = IntegerProperty(required=True)
    ts = DateTimeProperty(required=True)
    type = StringProperty(required=True)

    ssdeep = StringProperty(default=None) # set later

    extracts = RelationshipTo('Base', 'EXTRACTS', model=Extracts)
    similar = Relationship('Base', 'SIMILAR', model=Similar)
    retyped = RelationshipTo('Base', 'RETYPED', model=Retyped)

class Artifact(Base):
    """A generic artifact for unknown/untyped data"""
    pass

class APK(Base):

    # APK Attribute
    package = StringProperty()
    name = StringProperty()
    androidversion_code = StringProperty()
    androidversion_name = StringProperty()
    permissions = ArrayProperty(StringProperty())
    activities = ArrayProperty(StringProperty())
    providers = ArrayProperty(StringProperty())
    receivers = ArrayProperty(StringProperty())
    services = ArrayProperty(StringProperty())
    min_sdk_version = StringProperty()
    max_sdk_version = StringProperty()
    max_sdk_version = StringProperty()
    effective_target_sdk_version = StringProperty()
    libraries = ArrayProperty(StringProperty())
    main_activity = StringProperty()
    content_provider_uris = ArrayProperty(StringProperty())

    classes = ArrayProperty(JSONProperty())

class BZ2(Base):
    """bz2 compressed file"""

    pass

class CPIO(Base):
    """CPIO firmware"""
    pass

class Dex(Base):
    """Android DEX file"""
    pass

class Elf(Base):
    """Linux ELF file"""
    pass

class Eml(Base):
    """EML"""
    pass

class Excel(Base):
    """Excel file"""
    pass

class Gzip(Base):
    """GZIP compressed file"""
    pass

class HTML(Base):
    """HTML file"""
    pass

class Jar(Base):
    """JAR file"""
    pass

class JFFS2(Base):
    """JFFS2 firmware"""
    pass

class JPEG(Base):
    """JPEF Image file"""

    # PNG attributes
    exif = JSONProperty()

class LZMA(Base):
    """LZMA compressed file"""
    pass

class Macho(Base):
    """MachO file"""
    pass

class MemoryDump(Base):
    """memory dump file"""
    pass

class Msg(Base):
    """MSG file"""
    pass

class PDF(Base):
    """PDF file"""
    pass

class PE(Base):
    """PE file"""
    pass

class PNG(Base):

    # PNG attributes
    exif = JSONProperty()

class Powerpoint(Base):
    """Powerpoint file"""
    pass

class RTF(Base):
    """RTF file"""
    pass

class SquashFS(Base):
    """SquashFS firmware"""
    pass

class Tar(Base):
    """TAR archive file"""
    pass

class URL(Base):
    """extracted URL"""

    # URL Attribute
    url = StringProperty()

class TIFF(Base):
    """TIFf image file"""

    # attributes
    exif = JSONProperty()

class Word(Base):
    """Word file"""
    pass

class Zip(Base):
    """Zip compressed file"""
    pass

class BaseRelationship(StructuredRel):
    """Base relationship"""

    ts = DateTimeProperty(default=lambda: datetime.now())

class Extracts(BaseRelationship):
    """Establish a node (some binary data) as being
        extracted from another node"""
    label = 'extracts'

    # E.g. 'dynamic', 'static'
    method = StringProperty()

class Retyped(BaseRelationship):
    """Establish a node (some binary data) as being
        extracted from another node"""
    pass