#include "Stdafx.h" // CMatches namespace YaraSharp { // Проверка правил Dictionary^>^ CYaraSharp::CheckYaraRules([Out] List^ FilePathList, Dictionary^ ExternalVariables) { Dictionary^>^ CompilationErrors = gcnew Dictionary^>(); // Последовательная проверка for (int i = 0; i < FilePathList->Count; i++) { CCompiler^ TestCompiler = gcnew CCompiler(ExternalVariables); if (TestCompiler->AddFile(FilePathList[i])) { CompilationErrors->Add(FilePathList[i], TestCompiler->Errors); FilePathList->Remove(FilePathList[i--]); } } // Одновременная проверка bool SuccessFlag = false; while (!SuccessFlag) { SuccessFlag = true; CCompiler^ TestCompiler = gcnew CCompiler(ExternalVariables); for each (auto FilePath in FilePathList) { if (TestCompiler->AddFile(FilePath)) { CompilationErrors->Add(FilePath, TestCompiler->Errors); FilePathList->Remove(FilePath); SuccessFlag = false; // В случае ошибки необходимо создавать новый компилятор break; } } } return CompilationErrors; } // Компиляция правил CRules^ CYaraSharp::CompileFromFiles(CCompiler^ Compiler, List^ FilePathList, Dictionary^ ExternalVariables, [Out] Dictionary^>^% CompilationErrors) { // TODO: добавить поддержку namespace // Проверка правил на корректность CompilationErrors = CheckYaraRules(FilePathList, ExternalVariables); // Компиляция правил Compiler->AddFiles(FilePathList); // Возвращаем скомпилированные правила return Compiler->GetRules(); } // Сканирование файла List^ CYaraSharp::ScanFile(String^ Path, CRules^ Rules, Dictionary^ ExternalVariables, int Timeout) { CScanner^ FScanner = gcnew CScanner(Rules, ExternalVariables); if (!File::Exists(Path)) throw gcnew FileNotFoundException(Path); auto results = gcnew List(); auto nativePath = marshal_as(Path); GCHandle resultsHandle = GCHandle::Alloc(results); ErrorUtility::ThrowOnError( yr_rules_scan_file(Rules, nativePath.c_str(), 0, FScanner->Scanner->callback, GCHandle::ToIntPtr(resultsHandle).ToPointer(), Timeout)); return results; } // Сканирование процесса List^ CYaraSharp::ScanProcess(int PID, CRules^ Rules, int Timeout, Dictionary^ ExternalVariables) { CScanner^ PScanner = gcnew CScanner(Rules, ExternalVariables); auto results = gcnew List(); GCHandle resultsHandle = GCHandle::Alloc(results); ErrorUtility::ThrowOnError( yr_rules_scan_proc(Rules, PID, 0, PScanner->Scanner->callback, GCHandle::ToIntPtr(resultsHandle).ToPointer(), Timeout)); return results; } // Сканирование памяти List^ CYaraSharp::ScanMemory(array^ Buffer, CRules^ Rules, Dictionary^ ExternalVariables, int Timeout) { if (Buffer == nullptr || Buffer->Length == 0) return gcnew List(); else { pin_ptr BufferPointer = &Buffer[0]; return ScanMemory(BufferPointer, Buffer->Length, Rules, ExternalVariables, Timeout); } } // Сканирование памяти List^ CYaraSharp::ScanMemory(uint8_t* Buffer, int Length, CRules^ Rules, Dictionary^ ExternalVariables, int Timeout) { CScanner^ MScanner = gcnew CScanner(Rules, ExternalVariables); auto results = gcnew List(); GCHandle resultsHandle = GCHandle::Alloc(results); ErrorUtility::ThrowOnError( yr_rules_scan_mem(Rules, Buffer, Length, 0, MScanner->Scanner->callback, GCHandle::ToIntPtr(resultsHandle).ToPointer(), Timeout)); return results; } }