plugin_http_heuristics.py 文件源码

def Heuristics(self, data, noDecode=False):
        if data.lower().startswith('http:'):
            return data
        if data[::-1].lower().startswith('http:'):
            return data[::-1]
        if noDecode:
            return data
        try:
            decoded = binascii.a2b_hex(data)
            return self.Heuristics(decoded, True)
        except:
            if not re.compile(r'^[0-9a-zA-Z/=]+$').match(data):
                return data
            try:
                decoded = binascii.a2b_base64(data)
                return self.Heuristics(decoded, True)
            except:
                return data

    # bruteforce XOR; short strings (< 10) are keys