missingservices.py

#!/usr/bin/env python3
"""
This script compares the json output of a known registry key using printkey and
svcscan of volatility. The registry key can be searched for after the malware
family has been determined through other methods.

To get the information required, execute the following commands on the image:
volatility -f $image --profile $profile svcscan --output=json --output-file=svcscan.json
volatility -f $image --profile $profile printkey --output=json --output-file=printkey.json

The following arguments are available:
    --svc=svcscan.json
    --reg=printkey.json
Usage:
    missingservices.py --svc=<svcscan> --reg=<printkey>

Options:
    <svcscan>        JSON output of volatility svcscan command
    <printkey>       JSON output of volatility printkey command
"""

import json
from pprint import pprint
import sys

print("This is the name of the script: ", sys.argv[0])
print("Number of arguments: ", len(sys.argv))
print("The arguments are: ", str(sys.argv))

svcfile = ""
regfile = ""

for arg in sys.argv:
    if arg.startswith("--svc="):
        svcfile = arg.replace("--svc=", "")
    elif arg.startswith("--reg="):
        regfile = arg.replace("--reg=", "")
    elif arg == sys.argv[0]:
        continue
    else:
        print("invalid argument " + arg)

print(regfile)
print(svcfile)

with open(regfile) as f:
    regdata = json.load(f)

with open(svcfile) as f:
    svcdata = json.load(f)

servicefield = 4

svcservices = []
for service in svcdata["rows"]:
    svcservices.append(service[servicefield])

regservices = []
for service in regdata["rows"]:
    regservices.append(service[servicefield])

missingregservices = []
for regservice in regservices:
    found = False
    for svcservice in svcservices:
        if(regservice == svcservice):
            found = True
            break
    if not found:
        missingregservices.append(regservice)

missingsvcservices = []
for svcservice in svcservices:
    found = False
    for regservice in regservices:
        if(regservice == svcservice):
            found = True
            break
    if not found:
        missingsvcservices.append(svcservice)

pprint(missingregservices)
pprint(missingsvcservices)