steganography_module.py

"""
Steganografi ve Metadata Manipülasyon Modülü
Metadata Sherlock V4 için
"""

from PIL import Image
import piexif
from datetime import datetime
import struct
import numpy as np
from io import BytesIO

class SteganographyAnalyzer:
    """Steganografi analiz ve uygulama sınıfı"""
    
    @staticmethod
    def hide_message_lsb(image, message, key=""):
        """LSB metodu ile mesaj gömme"""
        # Mesajı binary'e çevir
        if key:
            # Basit XOR encryption
            message = ''.join(chr(ord(c) ^ ord(key[i % len(key)])) for i, c in enumerate(message))
        
        binary_message = ''.join(format(ord(char), '08b') for char in message)
        binary_message += '1111111111111110'  # Sonlandırma işareti
        
        img_array = np.array(image)
        flat = img_array.flatten()
        
        if len(binary_message) > len(flat):
            raise ValueError("Mesaj çok uzun!")
        
        # LSB'lere mesajı yerleştir
        for i, bit in enumerate(binary_message):
            flat[i] = (flat[i] & 0xFE) | int(bit)
        
        stego_img = flat.reshape(img_array.shape)
        return Image.fromarray(stego_img.astype('uint8'))
    
    @staticmethod
    def extract_message_lsb(image, key=""):
        """LSB metodundan mesaj çıkarma - geliştirilmiş versiyon"""
        img_array = np.array(image)
        flat = img_array.flatten()
        
        binary_message = ""
        for pixel in flat:
            binary_message += str(pixel & 1)
        
        # 8'erli gruplara böl
        chars = []
        for i in range(0, len(binary_message), 8):
            byte = binary_message[i:i+8]
            if len(byte) < 8:
                break
            
            # Sonlandırma işareti kontrolü (16 bit)
            if i + 16 <= len(binary_message):
                terminator_check = binary_message[i:i+16]
                if terminator_check == '1111111111111110':
                    break
            
            try:
                char_value = int(byte, 2)
                # Yazdırılabilir ASCII kontrolü (32-126) veya temel karakterler
                if 32 <= char_value <= 126 or char_value in [10, 13]:  # newline, carriage return
                    chars.append(chr(char_value))
                elif char_value == 0:  # NULL karakter - mesaj sonu olabilir
                    break
                else:
                    # Yazdırılamayan karakter - mesaj bitmiş olabilir
                    if len(chars) > 10:  # Eğer yeterli karakter varsa dur
                        break
            except:
                break
        
        message = ''.join(chars)
        
        # Trailing boşlukları temizle
        message = message.rstrip('\x00')
        
        # Eğer şifreliyse çöz
        if key and message:
            try:
                decrypted = ''.join(chr(ord(c) ^ ord(key[i % len(key)])) for i, c in enumerate(message))
                # Şifrelenmiş mesajın anlamlı olup olmadığını kontrol et
                if all(32 <= ord(c) <= 126 or c in '\n\r\t' for c in decrypted):
                    message = decrypted
            except:
                pass  # Şifre çözme başarısız, orijinal mesajı döndür
        
        return message.strip()
    
    @staticmethod
    def detect_steganography(image):
        """Steganografi olasılığını tespit eder"""
        img_array = np.array(image)
        flat = img_array.flatten()
        
        # LSB analizi - rastgelelik kontrolü
        lsb_bits = [pixel & 1 for pixel in flat[:10000]]  # İlk 10000 pixel
        ones = sum(lsb_bits)
        ratio = ones / len(lsb_bits)
        
        # İdeal oran 0.5 olmalı, çok sapma varsa şüpheli
        suspicion_score = abs(0.5 - ratio) * 200
        
        findings = {
            'suspicious': suspicion_score > 10,
            'score': suspicion_score,
            'lsb_ratio': ratio,
            'analysis': 'Şüpheli' if suspicion_score > 10 else 'Normal'
        }
        
        return findings


class MetadataManipulator:
    """EXIF metadata manipülasyon sınıfı"""
    
    @staticmethod
    def create_fake_gps(lat, lon, alt=0):
        """Sahte GPS verisi oluşturur"""
        def decimal_to_dms(decimal):
            degrees = int(abs(decimal))
            minutes = int((abs(decimal) - degrees) * 60)
            seconds = int(((abs(decimal) - degrees) * 60 - minutes) * 60 * 100)
            return [(degrees, 1), (minutes, 1), (seconds, 100)]
        
        lat_ref = 'N' if lat >= 0 else 'S'
        lon_ref = 'E' if lon >= 0 else 'W'
        
        gps_ifd = {
            piexif.GPSIFD.GPSLatitudeRef: lat_ref,
            piexif.GPSIFD.GPSLatitude: decimal_to_dms(lat),
            piexif.GPSIFD.GPSLongitudeRef: lon_ref,
            piexif.GPSIFD.GPSLongitude: decimal_to_dms(lon),
            piexif.GPSIFD.GPSAltitude: (int(alt * 100), 100)
        }
        
        return gps_ifd
    
    @staticmethod
    def create_fake_camera_data(make="Canon", model="EOS 5D Mark IV", lens="EF24-70mm f/2.8L II USM"):
        """Sahte kamera verisi oluşturur"""
        exif_ifd = {
            piexif.ExifIFD.LensMake: make.encode(),
            piexif.ExifIFD.LensModel: lens.encode(),
            piexif.ExifIFD.ISO: 400,
            piexif.ExifIFD.FNumber: (28, 10),  # f/2.8
            piexif.ExifIFD.ExposureTime: (1, 100),  # 1/100s
            piexif.ExifIFD.FocalLength: (50, 1),  # 50mm
        }
        
        zeroth_ifd = {
            piexif.ImageIFD.Make: make.encode(),
            piexif.ImageIFD.Model: model.encode(),
            piexif.ImageIFD.Software: b"Adobe Photoshop CC 2024 (Windows)",
        }
        
        return zeroth_ifd, exif_ifd
    
    @staticmethod
    def inject_metadata(image, gps_data=None, camera_data=None, custom_date=None):
        """Metadata'yı görüntüye enjekte eder"""
        # RGBA → RGB dönüşümü (JPEG için gerekli)
        if image.mode in ('RGBA', 'LA', 'P'):
            # Alpha channel'ı beyaz arkaplan ile birleştir
            background = Image.new('RGB', image.size, (255, 255, 255))
            if image.mode == 'P':
                image = image.convert('RGBA')
            background.paste(image, mask=image.split()[-1] if image.mode in ('RGBA', 'LA') else None)
            image = background
        elif image.mode != 'RGB':
            image = image.convert('RGB')

        # Mevcut EXIF'i al (varsa)
        try:
            exif_dict = piexif.load(image.info.get('exif', b''))
        except:
            exif_dict = {"0th": {}, "Exif": {}, "GPS": {}, "1st": {}}

        # GPS ekle
        if gps_data:
            exif_dict['GPS'] = gps_data

        # Kamera verisi ekle
        if camera_data:
            zeroth_ifd, exif_ifd = camera_data
            exif_dict['0th'].update(zeroth_ifd)
            exif_dict['Exif'].update(exif_ifd)

        # Tarih ekle
        if custom_date:
            date_str = custom_date.strftime("%Y:%m:%d %H:%M:%S").encode()
            exif_dict['0th'][piexif.ImageIFD.DateTime] = date_str
            exif_dict['Exif'][piexif.ExifIFD.DateTimeOriginal] = date_str
            exif_dict['Exif'][piexif.ExifIFD.DateTimeDigitized] = date_str

        # EXIF bytes'a çevir
        exif_bytes = piexif.dump(exif_dict)

        # Yeni görüntü oluştur
        output = BytesIO()
        image.save(output, format='JPEG', exif=exif_bytes, quality=95)
        output.seek(0)

        return output.getvalue()


class StringsAnalyzer:
    """Binary içindeki string'leri analiz eder"""

    @staticmethod
    def extract_strings(data, min_length=4):
        """Binary data'dan ASCII string'leri çıkarır"""
        strings = []
        current = ""

        for byte in data:
            if 32 <= byte <= 126:  # Yazdırılabilir ASCII
                current += chr(byte)
            else:
                if len(current) >= min_length:
                    strings.append(current)
                current = ""

        if len(current) >= min_length:
            strings.append(current)

        return strings

    @staticmethod
    def find_patterns(strings):
        """String'lerde pattern bulur (URL, email, telefon vs.)"""
        import re

        patterns = {
            'urls': [],
            'emails': [],
            'phones': [],
            'ips': [],
            'suspicious': []
        }

        # Regex'ler
        url_pattern = r'https?://[^\s<>"{}|\\^`\[\]]+'
        email_pattern = r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b'
        phone_pattern = r'\b\d{3}[-.]?\d{3}[-.]?\d{4}\b'
        ip_pattern = r'\b(?:\d{1,3}\.){3}\d{1,3}\b'

        for string in strings:
            # URL
            urls = re.findall(url_pattern, string)
            patterns['urls'].extend(urls)

            # Email
            emails = re.findall(email_pattern, string)
            patterns['emails'].extend(emails)

            # Telefon
            phones = re.findall(phone_pattern, string)
            patterns['phones'].extend(phones)

            # IP
            ips = re.findall(ip_pattern, string)
            patterns['ips'].extend(ips)

            # Şüpheli kelimeler
            suspicious_keywords = ['password', 'key', 'secret', 'token', 'api', 'admin']
            if any(kw in string.lower() for kw in suspicious_keywords):
                patterns['suspicious'].append(string)

        return patterns


class ThumbnailAnalyzer:
    """EXIF thumbnail analizi"""

    @staticmethod
    def extract_thumbnail(image):
        """EXIF'ten thumbnail çıkarır"""
        try:
            exif = image.info.get('exif')
            if not exif:
                return None

            exif_dict = piexif.load(exif)
            if '1st' in exif_dict and piexif.ImageIFD.JPEGInterchangeFormat in exif_dict['1st']:
                offset = exif_dict['1st'][piexif.ImageIFD.JPEGInterchangeFormat]
                length = exif_dict['1st'][piexif.ImageIFD.JPEGInterchangeFormatLength]

                thumbnail = exif[offset:offset+length]
                return Image.open(BytesIO(thumbnail))
        except:
            pass

        return None

    @staticmethod
    def compare_with_main(main_image, thumbnail):
        """Ana görsel ile thumbnail'i karşılaştırır"""
        if not thumbnail:
            return None

        # Boyutları karşılaştır
        main_size = main_image.size
        thumb_size = thumbnail.size

        # Histogram karşılaştırma
        main_hist = main_image.resize((100, 100)).histogram()
        thumb_hist = thumbnail.resize((100, 100)).histogram()

        # Korelasyon hesapla (basit benzerlik)
        similarity = sum(min(a, b) for a, b in zip(main_hist, thumb_hist)) / sum(main_hist)

        return {
            'main_size': main_size,
            'thumb_size': thumb_size,
            'similarity': similarity * 100,
            'suspicious': similarity < 0.8  # %80'den düşükse şüpheli
        }


class HexAnalyzer:
    """Hex dump ve analiz"""

    @staticmethod
    def hex_dump(data, length=256, width=16):
        """Hex dump oluşturur"""
        lines = []
        for i in range(0, min(len(data), length), width):
            chunk = data[i:i+width]
            hex_part = ' '.join(f'{byte:02x}' for byte in chunk)
            ascii_part = ''.join(chr(byte) if 32 <= byte <= 126 else '.' for byte in chunk)
            lines.append(f"{i:08x}  {hex_part:<{width*3}}  {ascii_part}")

        return '\n'.join(lines)

    @staticmethod
    def find_file_signatures(data):
        """Dosya imzalarını arar (magic bytes)"""
        signatures = {
            b'\xFF\xD8\xFF': 'JPEG',
            b'\x89PNG': 'PNG',
            b'GIF8': 'GIF',
            b'PK\x03\x04': 'ZIP/JAR',
            b'%PDF': 'PDF',
            b'\x50\x4B\x03\x04': 'ZIP',
            b'\x1F\x8B': 'GZIP',
            b'BM': 'BMP'
        }

        found = []
        for sig, file_type in signatures.items():
            if sig in data[:1000]:  # İlk 1KB'ta ara
                found.append(file_type)

        return found