graphity.py [-h] [-p] [-i] [-l] [-b] [-n] [-c CSVDUMP] input
positional arguments:
input Tool requires an input file or directory; directory, i.e. batch processing, only possible and feasible for csvdump option and Neo4j dump
optional arguments:
-h, --help show this help message and exit
-d, --deactivatecache Deactivate caching of graphs, for debugging of graph generation
-p, --printing Print the graph as text, as in, nodes with respective content
-i, --info Print info and stats of the graph
-l, --plotting Plotting the graph via pyplot
-b, --behavior Scan for behaviors listed in graphityFunc.py
-n, --neodump Dump graph to Neo4j (configured to flush previous data from Neo, might wanna change that)
-c CSVDUMP, --csvdump CSVDUMP Dump info data to a given csv file, appends a line per sample
R2Graphity is built to construct a graph structure based on the function call graph of a Windows executable. Details on how the graph is built and processing options can be found in the attached slide deck, presented at H2HC 2016 in Sao Paulo, Brasil.
Watch out to get the Python3 packages, or install directly with pip3.
radare2 https://github.com/radare/radare2
r2pipe https://github.com/radare/radare2/wiki/R2PipeAPI
NetworkX https://github.com/networkx/
Neo4j https://neo4j.com/download/
py2neo http://py2neo.org/v3/
numpy https://github.com/numpy/numpy
pefile https://github.com/erocarrera/pefile
pydeep https://github.com/kbandla/pydeep
Watch out to install radare2 from the git repository, do not use the Debian package. Tested to run best with radare2 1.6.0-git 15013 @ linux-x86-64, commit: f590de9e71ed87ebf276083a2876d006d87a506d build: 2017-06-08__12:52:05
(sudo) pip3 install -r requirements.txt