AiCSA_pub

Ai(ChatGPT-4) Code Security Audit

The source code has been released recently: https://github.com/hktalent/AiCSA

feature

• For the same jar and the same java file, chatGPT (GPT-4) is only executed once, and the results are retained in the index library, so there is no need to worry about repeated executions.

• Free chatGPT has a speed limit of 20 times/minute. Paid users can adjust the frequency by modifying config/config.json.

• Files larger than 3500 bytes are automatically split and sent to chatGPT to prevent chatGPT from being unable to process files that are too long.

• Supports several openai api keys to improve concurrency capabilities

• Store results based on big data index

• Provides HTTP/2.0 HTTP/3.0 web interface

web UI

mkdir -p src config
vi config/config.json
 ./AiCSA  
 
open https://127.0.0.1:8080/indexes/

How Test

• Before running, please adjust the ./tools/doFernflower.sh file to ensure that java is version 11 or higher.

• Determine the path of rt.jar and modify the path of rt.jar in the ./tools/doFernflower.sh file

find /Library/Java/JavaVirtualMachines -name "rt.jar"

out

/Library/Java/JavaVirtualMachines/jdk1.8.0_181.jdk/Contents/Home/jre/lib/rt.jar
/Library/Java/JavaVirtualMachines/jdk1.8.0_72.jdk/Contents/Home/jre/lib/rt.jar

config/config.json example

LimitPerMinute: Recommended number of api keys * 3

{
  "proxy": "socks5://127.0.0.1:7890",
  "LimitPerMinute": 6,
  "HttpPort": 8080,
  "org": "org-xx",
  "api_key": "sk-xxx,sk-xxx2",
  "Prefix": "用中文问答，分析%s java代码存在哪些安全风险,如何验证、确认他们",
  "CheckRpt": true
}

How to build

go get -u ./...
go mod vendor
go build -o AiCSA main.go

Decompile jar to java

• The source code will be automatically saved in the src directory

• Different jars will build a source code directory based on hash to avoid source code conflicts between multiple jars.

find $HOME/MyWork/vulScanPro/tools/weblogic/weblogic12.2.1.3 -type f -name "*.jar" | xargs -I {} ./tools/doFernflower.sh {}
ls $HOME/MyWork/vulScanPro/tools/weblogic/weblogic12.2.1.3/coherence/lib/*.jar|xargs -I {} ./tools/doFernflower.sh {}
./tools/doFernflower.sh $HOME/MyWork/vulScanPro/tools/weblogic/weblogic12.2.1.3/coherence/lib/coherence.jar

Tips

• Convert all subdirectory images to mp4 on Mac OS

brew install ffmpeg
brew update && brew upgrade ffmpeg

find $HOME/Downloads/outImg -name '*.png' | sort | sed 's/.*/"&"/' | tr 'n' ' ' | xargs ffmpeg -r 30 -i - -c:v libx264 -pix_fmt yuv420p output.mp4

Star

Donation

Wechat Pay	AliPay	Paypal	BTC Pay	BCH Pay
		paypal [email protected]