admin/stellarbear-YaraSharp
1
0
Fork 0
mirror of https://github.com/stellarbear/YaraSharp synced 2026-06-08 17:36:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Comments and errors in English

Browse Source
This commit is contained in:
stellarbear
2018-04-16 14:51:14 +03:00
parent fb9ca6488e
commit 9f25d534b6
13 changed files with 48 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Build/Test/YaraSharp.dll
BIN
View File
Binary file not shown.
Build/Test/YaraTest.exe
BIN
View File
Binary file not shown.
README.md
+1 -2
View File
@@ -45,8 +45,7 @@ using (YaraSharp.CContext YSContext = new YaraSharp.CContext())
//...
}
}
// Log errorsìîæíî è òàê
// Log errors
}
```
For async scanning use **must** call destroy methods:
YaraSharp/AssemblyInfo.cpp
+3 -3
View File
@@ -14,10 +14,10 @@ using namespace System::Security::Permissions;
[assembly:AssemblyTitleAttribute(L"YaraSharp")];
[assembly:AssemblyDescriptionAttribute(L"")];
[assembly:AssemblyConfigurationAttribute(L"")];
[assembly:AssemblyCompanyAttribute(L"")];
[assembly:AssemblyCompanyAttribute(L"SB")];
[assembly:AssemblyProductAttribute(L"YaraSharp")];
[assembly:AssemblyCopyrightAttribute(L"Copyright (c) 2018")];
[assembly:AssemblyTrademarkAttribute(L"")];
[assembly:AssemblyTrademarkAttribute(L"stellarbears")];
[assembly:AssemblyCultureAttribute(L"")];
//
@@ -31,7 +31,7 @@ using namespace System::Security::Permissions;
// You can specify all the value or you can default the Revision and Build Numbers
// by using the '*' as shown below:
[assembly:AssemblyVersionAttribute("1.0.*")];
[assembly:AssemblyVersionAttribute("1.0.0")];
[assembly:ComVisible(false)];
YaraSharp/Compiler.cpp
+11 -11
View File
@@ -3,7 +3,7 @@
// CCompiler
namespace YaraSharp
{
// Êîíñòðóêòîð
// Constructor
CCompiler::CCompiler(Dictionary<String^, Object^>^ ExternalVariables)
{
YR_COMPILER* TestCompiler;
@@ -15,7 +15,7 @@ namespace YaraSharp
SetCompilerExternals(ExternalVariables);
SetCompilerCallback();
}
// Äåñòðóêòîð
// Destructor
CCompiler::~CCompiler() { if (Compiler) yr_compiler_destroy(Compiler); }
@@ -26,7 +26,7 @@ namespace YaraSharp
YR_COMPILER_CALLBACK_FUNC CallbackPointer = (YR_COMPILER_CALLBACK_FUNC)(Marshal::GetFunctionPointerForDelegate(CompilerCallback)).ToPointer();
yr_compiler_set_callback(Compiler, CallbackPointer, NULL);
}
// Äîáàâëåíèå ïðàâèë â êîëëåêöèþ èç ôàéëà
// Add a single rule
int CCompiler::AddFile(String^ FilePath)
{
FILE* File;
@@ -44,13 +44,13 @@ namespace YaraSharp
return errors;
}
// Äîáàâëåíèå íåñêîëüêèõ ôàéëîâ
// Add several files
void CCompiler::AddFiles(List<String^>^ FilePathList)
{
for each (auto FilePath in FilePathList)
AddFile(FilePath);
}
// Ïîëó÷åíèå ñïèñêà ïðàâèë
// Get rule list
CRules^ CCompiler::GetRules()
{
YR_RULES* Rules;
@@ -60,12 +60,12 @@ namespace YaraSharp
return gcnew CRules(Rules);
}
// Ïîëó÷åíèå ñïèñêà îøèáîê
// Get error list
List<String^>^ CCompiler::GetErrors()
{
return this->Errors;
}
// Óñòàíîâêà externals
// Set externals
void CCompiler::SetCompilerExternals(Dictionary<String^, Object^>^ ExternalVariables)
{
if (ExternalVariables)
@@ -87,21 +87,21 @@ namespace YaraSharp
else if (VariableType == String::typeid)
ExternalError = yr_compiler_define_string_variable(Compiler, VariablePointer, CTX.marshal_as<const char*>((String^)ExternalVariable.Value));
else
throw gcnew NotSupportedException(String::Format("Íåïîääåðæèâàåìûé òèï external variable: '{0}'", VariableType->Name));
throw gcnew NotSupportedException(String::Format("Unsupported external variable: '{0}'", VariableType->Name));
if (ExternalError != ERROR_SUCCESS)
ErrorUtility::ThrowOnError("(Compiler) Íå óäàëîñü èíèöèàëèçèðîâàòü external variable");
ErrorUtility::ThrowOnError("(Compiler) Error during external variable intialization");
}
}
}
// Îáðàáîòêà îòâåòà
// Callback
void CCompiler::HandleCompilerCallback(int ErrorLevel, const char* Filename, int LineNumber, const char* Message, void* UserData)
{
UNREFERENCED_PARAMETER(ErrorLevel);
UNREFERENCED_PARAMETER(UserData);
auto msg = String::Format("{0} â ñòðîêå {1} â ôàéëå: {2}",
auto msg = String::Format("{0} in line {1} in file: {2}",
marshal_as<String^>(Message), LineNumber,
Filename ? marshal_as<String^>(Filename) : "[none]");
YaraSharp/Context.cpp
+2 -2
View File
@@ -3,9 +3,9 @@
// CContext
namespace YaraSharp
{
// Êîíñòðóêòîð
// Constructor
CContext::CContext() { ErrorUtility::ThrowOnError(yr_initialize()); }
// Äåñòðóêòîð
// Destructor
CContext::~CContext() { ErrorUtility::ThrowOnError(yr_finalize()); }
void CContext::Destroy() { delete this; }
}
YaraSharp/Exceptions.cpp
+1 -1
View File
@@ -24,7 +24,7 @@ namespace YaraSharp
String^ ErrorUtility::NiceErrorCode(int error)
{
// TODO: ñäåëàòü íîðìàëüíîå îïèñàíèó
// TODO: nice erros
switch (error)
{
case ERROR_INSUFICIENT_MEMORY:
YaraSharp/Rules.cpp
+1 -1
View File
@@ -74,7 +74,7 @@ namespace YaraSharp
break;
}
// Îòñåèâàåì äóáëèêàòû
// Distinct
if (!Result->ContainsKey(MetaID))
Result->Add(MetaID, MetaValue);
}
YaraSharp/Rules.h
+2 -2
View File
@@ -21,9 +21,9 @@ namespace YaraSharp
property String^ Identifier;
property List<String^>^ Tags;
property Dictionary<String^, Object^>^ Meta;
// It's some kind of useless here
// Match has already a section for this
// property List<String^>^ Strings;
// Íåñêîëüêî áåñïîëåçíî, ïîñêîëüêó â Match óæå èìååòñÿ êëþ÷,
// ñîîòâåòâóþùèé íàéäåííîìó ñîâïàäåíèþ
CRule();
CRule(YR_RULE* Rule);
YaraSharp/Scanner.cpp
+6 -6
View File
@@ -3,7 +3,7 @@
// CScanner
namespace YaraSharp
{
// Êîíñòðóêòîð
// Constructor
CScanner::CScanner(CRules^ rules, Dictionary<String^, Object^>^ ExternalVariables)
{
YR_SCANNER* TestScanner;
@@ -12,10 +12,10 @@ namespace YaraSharp
SetScannerExternals(ExternalVariables);
}
// Äåñòðóêòîð
// Destructor
CScanner::~CScanner() { if (Scanner) yr_scanner_destroy(Scanner); }
// Óñòàíîâêà externals
// Set externals
void CScanner::SetScannerExternals(Dictionary<String^, Object^>^ ExternalVariables)
{
if (ExternalVariables)
@@ -37,15 +37,15 @@ namespace YaraSharp
else if (VariableType == String::typeid)
ExternalError = yr_scanner_define_string_variable(Scanner, VariablePointer, CTX.marshal_as<const char*>((String^)ExternalVariable.Value));
else
throw gcnew NotSupportedException(String::Format("Íåïîääåðæèâàåìûé òèï external variable: '{0}'", VariableType->Name));
throw gcnew NotSupportedException(String::Format("Unsupported external variable: '{0}'", VariableType->Name));
if (ExternalError != ERROR_SUCCESS)
ErrorUtility::ThrowOnError("(Scanner) Íå óäàëîñü èíèöèàëèçèðîâàòü external variable");
ErrorUtility::ThrowOnError("(Scanner) Error during external variable intialization");
}
}
}
// Îáðàáîòêà îòâåòà
// Callback
int CScanner::HandleScannerCallback(int message, void* data, void* context)
{
if (message == CALLBACK_MSG_RULE_MATCHING)
YaraSharp/YaraSharp.cpp
+20 -21
View File
@@ -3,13 +3,13 @@
// CMatches
namespace YaraSharp
{
// Ïðîâåðêà ïðàâèë
// Check list of yara files
Dictionary<String^, List<String^>^>^ CYaraSharp::CheckYaraRules([Out] List<String^>^ FilePathList, Dictionary<String^, Object^>^ ExternalVariables)
{
Dictionary<String^, List<String^>^>^ CompilationErrors =
gcnew Dictionary<String^, List<String^>^>();
// Ïîñëåäîâàòåëüíàÿ ïðîâåðêà
// Iterative check
for (int i = 0; i < FilePathList->Count; i++)
{
CCompiler^ TestCompiler = gcnew CCompiler(ExternalVariables);
@@ -23,7 +23,7 @@ namespace YaraSharp
delete TestCompiler;
}
// Îäíîâðåìåííàÿ ïðîâåðêà
// Simultaneous check
bool SuccessFlag = false;
while (!SuccessFlag)
{
@@ -37,7 +37,7 @@ namespace YaraSharp
FilePathList->Remove(FilePath);
SuccessFlag = false;
//  ñëó÷àå îøèáêè íåîáõîäèìî ñîçäàâàòü íîâûé êîìïèëÿòîð
// New compiler must be created if we fail
delete TestCompiler;
break;
}
@@ -48,36 +48,35 @@ namespace YaraSharp
}
// Êîìïèëÿöèÿ ïðàâèë
// Rule compilation
CRules^ CYaraSharp::CompileFromFiles(List<String^>^ FilePathList, Dictionary<String^, Object^>^ ExternalVariables,
[Out] Dictionary<String^, List<String^>^>^% CompilationErrors)
{
// TODO: äîáàâèòü ïîääåðæêó namespace
// TODO: add namespace support
// Ïðîâåðêà ïðàâèë íà êîððåêòíîñòü
// First: check
CompilationErrors = CheckYaraRules(FilePathList, ExternalVariables);
// Êîìïèëÿöèÿ ïðàâèë
// Second: compile
CCompiler^ Compiler = gcnew CCompiler(ExternalVariables);
Compiler->AddFiles(FilePathList);
CRules^ Result = Compiler->GetRules();
delete Compiler;
// Âîçâðàùàåì ñêîìïèëèðîâàííûå ïðàâèëà
// Return compiled rules
return Result;
}
// Ñêàíèðîâàíèå ôàéëà
// Scanning file
List<CMatches^>^ CYaraSharp::ScanFile(String^ Path, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout)
{
CScanner^ FScanner = gcnew CScanner(Rules, ExternalVariables);
// Ïðîâåðêà îòêëþ÷åíà, òàê êàê ñëèøêîì äëèííûå èìåíà ôàéëîâ èãíîðèðóþòñÿ
// Ïðîâåðêà íà ñóùåñòâîâàíèå ñêàíèðóåìîãî ôàéëà íà âàñ
// File existance check disabled. This cause crashes on long filenames (260+ symbols)
//if (!File::Exists(Path))
// throw gcnew FileNotFoundException(Path);
// Callback ñåêöèÿ
// Callback section
List<CMatches^>^ Results = gcnew List<CMatches^>();
GCHandle ResultsHandle = GCHandle::Alloc(Results);
void* ResultsPointer = GCHandle::ToIntPtr(ResultsHandle).ToPointer();
@@ -86,17 +85,17 @@ namespace YaraSharp
GCHandle CallbackHandle = GCHandle::Alloc(ScannerCallback);
YR_CALLBACK_FUNC CallbackPointer = (YR_CALLBACK_FUNC)Marshal::GetFunctionPointerForDelegate(ScannerCallback).ToPointer();
// Ñêàíèðîâàíèå
// Scanning
ErrorUtility::ThrowOnError(yr_rules_scan_file(Rules, (marshal_as<std::string>(Path)).c_str(), 0, CallbackPointer, ResultsPointer, Timeout));
return Results;
}
// Ñêàíèðîâàíèå ïðîöåññà
// Scanning process (not yet tested)
List<CMatches^>^ CYaraSharp::ScanProcess(int PID, CRules^ Rules, int Timeout, Dictionary<String^, Object^>^ ExternalVariables)
{
CScanner^ PScanner = gcnew CScanner(Rules, ExternalVariables);
// Callback ñåêöèÿ
// Callback section
List<CMatches^>^ Results = gcnew List<CMatches^>();
GCHandle ResultsHandle = GCHandle::Alloc(Results);
void* ResultsPointer = GCHandle::ToIntPtr(ResultsHandle).ToPointer();
@@ -105,12 +104,12 @@ namespace YaraSharp
GCHandle CallbackHandle = GCHandle::Alloc(ScannerCallback);
YR_CALLBACK_FUNC CallbackPointer = (YR_CALLBACK_FUNC)Marshal::GetFunctionPointerForDelegate(ScannerCallback).ToPointer();
// Ñêàíèðîâàíèå
// Scanning
ErrorUtility::ThrowOnError(yr_rules_scan_proc(Rules, PID, 0, CallbackPointer, ResultsPointer, Timeout));
return Results;
}
// Ñêàíèðîâàíèå ïàìÿòè
// Scanning memory (not yet tested)
List<CMatches^>^ CYaraSharp::ScanMemory(array<uint8_t>^ Buffer, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout)
{
if (Buffer == nullptr || Buffer->Length == 0)
@@ -121,12 +120,12 @@ namespace YaraSharp
return ScanMemory(BufferPointer, Buffer->Length, Rules, ExternalVariables, Timeout);
}
}
// Ñêàíèðîâàíèå ïàìÿòè
// Scanning memory (not yet tested)
List<CMatches^>^ CYaraSharp::ScanMemory(uint8_t* Buffer, int Length, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout)
{
CScanner^ MScanner = gcnew CScanner(Rules, ExternalVariables);
// Callback ñåêöèÿ
// Callback section
List<CMatches^>^ Results = gcnew List<CMatches^>();
GCHandle ResultsHandle = GCHandle::Alloc(Results);
void* ResultsPointer = GCHandle::ToIntPtr(ResultsHandle).ToPointer();
@@ -135,7 +134,7 @@ namespace YaraSharp
GCHandle CallbackHandle = GCHandle::Alloc(ScannerCallback);
YR_CALLBACK_FUNC CallbackPointer = (YR_CALLBACK_FUNC)Marshal::GetFunctionPointerForDelegate(ScannerCallback).ToPointer();
// Ñêàíèðîâàíèå
// Scanning
ErrorUtility::ThrowOnError(yr_rules_scan_mem(Rules, Buffer, Length, 0, CallbackPointer, ResultsPointer, Timeout));
return Results;
YaraSharp/YaraSharp.h
-3
View File
@@ -5,16 +5,13 @@ namespace YaraSharp
public ref class CYaraSharp
{
private:
// Ïðîâåðêà ôàéëîâ
Dictionary<String^, List<String^>^>^ CheckYaraRules([Out] List<String^>^ FilePathList, Dictionary<String^, Object^>^ ExternalVariables);
public:
// Êîìïèëÿöèÿ ïðàâèë
CRules^ CompileFromFiles(List<String^>^ FilePathList,
Dictionary<String^, Object^>^ ExternalVariables,
[Out] Dictionary<String^, List<String^>^>^% CompilationErrors);
// Ñêàíèðîâàðíèå
List<CMatches^>^ ScanFile(String^ Path, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout);
List<CMatches^>^ ScanProcess(int PID, CRules^ Rules, int Timeout, Dictionary<String^, Object^>^ ExternalVariables);
List<CMatches^>^ ScanMemory(array<uint8_t>^ Buffer, CRules^ Rules, Dictionary<String^, Object^>^ ExternalVariables, int Timeout);
YaraTest/Program.cs
+1 -1
View File
@@ -32,7 +32,7 @@ namespace YaraTest
using (YaraSharp.CRules YSRules = YSInstance.CompileFromFiles(Directory.GetFiles(Path.Combine(Directory.GetCurrentDirectory(), "..\\..\\signatures"), "*.yar", SearchOption.AllDirectories).ToList(), Externals, out Errors))
{
// Some file to test yara rules
string Filename = @"\\?\<Filename>";
string Filename = @"\\?\D:\test\MW vol 5.0.rar";
// Get matches
List<YaraSharp.CMatches> Matches = YSInstance.ScanFile(Filename, YSRules,