Skip to content

Commit 7342bea

Browse files
codeyourwebcodeyourweb
committed
go 1.16 upgrade & archives introspection
1 parent 387fa4e commit 7342bea

File tree

13 files changed

+148
-31
lines changed

13 files changed

+148
-31
lines changed

‎analysis.go‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,14 @@ import (
44
"crypto/rc4"
55
b64 "encoding/base64"
66
"fmt"
7-
"io/ioutil"
87
"log"
98
"os"
109
"path/filepath"
1110
"runtime/debug"
1211
"time"
1312

14-
"github.com/hillu/go-yara"
13+
"github.com/h2non/filetype"
14+
"github.com/hillu/go-yara/v4"
1515
)
1616

1717
// FileDescriptor wrap path, filehash and last update into a structure. It is used for performance improvements and avoid reading file if it has not changed
@@ -33,8 +33,14 @@ func FileAnalysis(path string, pQuarantine string, pKill bool, pAggressive bool,
3333
log.Println("[ERROR]", path, err)
3434
}
3535
} else {
36-
if RegisterFileInHistory(f, path, &filescanHistory) {
37-
content, err = ioutil.ReadFile(path)
36+
if RegisterFileInHistory(f, path, &filescanHistory, pVerbose) {
37+
38+
content, err = os.ReadFile(path)
39+
if err != nil && pVerbose {
40+
log.Println("[ERROR]", path, err)
41+
}
42+
43+
filetype, err := filetype.Match(content)
3844
if err != nil && pVerbose {
3945
log.Println("[ERROR]", path, err)
4046
}
@@ -43,12 +49,17 @@ func FileAnalysis(path string, pQuarantine string, pKill bool, pAggressive bool,
4349
log.Println("[INFO] ["+sourceIndex+"] Analyzing", path)
4450
}
4551

46-
// cleaning memory if file size is greater than 1Gb
47-
if len(content) > 1024*1024*1024 {
52+
// cleaning memory if file size is greater than 512Mb
53+
if len(content) > 1024*1024*cleanIfFileSizeGreaterThan {
4854
defer debug.FreeOSMemory()
4955
}
5056

51-
result = PerformYaraScan(&content, rules, pVerbose)
57+
// archive or other file format scan
58+
if StringInSlice(filetype.MIME.Value, archivesFormats) {
59+
result = PerformArchiveYaraScan(path, rules, pVerbose)
60+
} else {
61+
result = PerformYaraScan(&content, rules, pVerbose)
62+
}
5263

5364
if len(result) > 0 {
5465
// windows notifications
@@ -133,7 +144,7 @@ func QuarantineProcess(proc *ProcessInformation, quarantinePath string) (err err
133144

134145
// QuarantineFile dump specified file and cipher them in quarantine folder
135146
func QuarantineFile(path, quarantinePath string) (err error) {
136-
fileContent, err := ioutil.ReadFile(path)
147+
fileContent, err := os.ReadFile(path)
137148
if err != nil {
138149
return err
139150
}
@@ -162,7 +173,7 @@ func quarantineContent(content []byte, filename string, quarantinePath string) (
162173

163174
xPE := make([]byte, len(content))
164175
c.XORKeyStream(xPE, content)
165-
err = ioutil.WriteFile(quarantinePath+"/"+filename+".irma", []byte(b64.StdEncoding.EncodeToString(xPE)), 0644)
176+
err = os.WriteFile(quarantinePath+"/"+filename+".irma", []byte(b64.StdEncoding.EncodeToString(xPE)), 0644)
166177
if err != nil {
167178
return err
168179
}

‎faker.go‎

Lines changed: 5 additions & 10 deletions
Large diffs are not rendered by default.

‎filehelper.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,14 @@ package main
22

33
import (
44
"errors"
5-
"io/ioutil"
65
"log"
76
"os"
87
"path/filepath"
98
"regexp"
109
"strings"
1110
"time"
1211

13-
"github.com/hillu/go-yara"
12+
"github.com/hillu/go-yara/v4"
1413
)
1514

1615
// WindowsFileSystemAnalysisRoutine analyse windows filesystem every 300 seconds
@@ -154,7 +153,7 @@ func RetrivesFilesFromUserPath(path string, listFiles bool, includeFileExtension
154153
p = append(p, path)
155154
} else {
156155
if !recursive {
157-
files, err := ioutil.ReadDir(path)
156+
files, err := os.ReadDir(path)
158157
if err != nil {
159158
return []string{}, err
160159
}

‎go.mod‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
module github.com/codeyourweb/irma
2+
3+
go 1.16
4+
5+
require (
6+
github.com/akamensky/argparse v1.2.2
7+
github.com/gen2brain/beeep v0.0.0-20200526185328-e9c15c258e28
8+
github.com/gen2brain/go-unarr v0.1.1
9+
github.com/go-ole/go-ole v1.2.5
10+
github.com/google/gopacket v1.1.19
11+
github.com/h2non/filetype v1.1.1
12+
github.com/hillu/go-yara/v4 v4.0.4
13+
github.com/olekukonko/tablewriter v0.0.5 // indirect
14+
github.com/parsiya/golnk v0.0.0-20200515071614-5db3107130ce
15+
golang.org/x/sys v0.0.0-20210309074719-68d13333faf2
16+
)

‎go.sum‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
github.com/akamensky/argparse v1.2.2 h1:P17T0ZjlUNJuWTPPJ2A5dM1wxarHgHqfYH+AZTo2xQA=
2+
github.com/akamensky/argparse v1.2.2/go.mod h1:S5kwC7IuDcEr5VeXtGPRVZ5o/FdhcMlQz4IZQuw64xA=
3+
github.com/gen2brain/beeep v0.0.0-20200526185328-e9c15c258e28 h1:M2Zt3G2w6Q57GZndOYk42p7RvMeO8izO8yKTfIxGqxA=
4+
github.com/gen2brain/beeep v0.0.0-20200526185328-e9c15c258e28/go.mod h1:ElSskYZe3oM8kThaHGJ+kiN2yyUMVXMZ7WxF9QqLDS8=
5+
github.com/gen2brain/go-unarr v0.1.1 h1:wZl53oYzEN1PEIA/dPa/FjBq9rRqPmS/Gzul8BdKYK4=
6+
github.com/gen2brain/go-unarr v0.1.1/go.mod h1:P05CsEe8jVEXhxqXqp9mFKUKFV0BKpFmtgNWf8Mcoos=
7+
github.com/go-ole/go-ole v1.2.5 h1:t4MGB5xEDZvXI+0rMjjsfBsD7yAgp/s9ZDkL1JndXwY=
8+
github.com/go-ole/go-ole v1.2.5/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
9+
github.com/go-toast/toast v0.0.0-20190211030409-01e6764cf0a4 h1:qZNfIGkIANxGv/OqtnntR4DfOY2+BgwR60cAcu/i3SE=
10+
github.com/go-toast/toast v0.0.0-20190211030409-01e6764cf0a4/go.mod h1:kW3HQ4UdaAyrUCSSDR4xUzBKW6O2iA4uHhk7AtyYp10=
11+
github.com/godbus/dbus/v5 v5.0.3 h1:ZqHaoEF7TBzh4jzPmqVhE/5A1z9of6orkAe5uHoAeME=
12+
github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
13+
github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
14+
github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
15+
github.com/gopherjs/gopherjs v0.0.0-20180825215210-0210a2f0f73c h1:16eHWuMGvCjSfgRJKqIzapE78onvvTbdi1rMkU00lZw=
16+
github.com/gopherjs/gopherjs v0.0.0-20180825215210-0210a2f0f73c/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
17+
github.com/gopherjs/gopherwasm v1.1.0 h1:fA2uLoctU5+T3OhOn2vYP0DVT6pxc7xhTlBB1paATqQ=
18+
github.com/gopherjs/gopherwasm v1.1.0/go.mod h1:SkZ8z7CWBz5VXbhJel8TxCmAcsQqzgWGR/8nMhyhZSI=
19+
github.com/h2non/filetype v1.1.1 h1:xvOwnXKAckvtLWsN398qS9QhlxlnVXBjXBydK2/UFB4=
20+
github.com/h2non/filetype v1.1.1/go.mod h1:319b3zT68BvV+WRj7cwy856M2ehB3HqNOt6sy1HndBY=
21+
github.com/hillu/go-yara/v4 v4.0.4 h1:DxKUyCwk6BG2SONtvkpeuYOdjmHMZ5ybqLdaH2POLRw=
22+
github.com/hillu/go-yara/v4 v4.0.4/go.mod h1:rkb/gSAoO8qcmj+pv6fDZN4tOa3N7R+qqGlEkzT4iys=
23+
github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
24+
github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
25+
github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d h1:VhgPp6v9qf9Agr/56bj7Y/xa04UccTW04VP0Qed4vnQ=
26+
github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d/go.mod h1:YUTz3bUH2ZwIWBy3CJBeOBEugqcmXREj14T+iG/4k4U=
27+
github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
28+
github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
29+
github.com/parsiya/golnk v0.0.0-20200515071614-5db3107130ce h1:A8XpVS2Jz5/aVqmDh5lyeQA6V8d5IfjXTcDyFWj+JsY=
30+
github.com/parsiya/golnk v0.0.0-20200515071614-5db3107130ce/go.mod h1:K81/KqyRQt+tqXkg+ENusP67AeIrzJRa2uVlrCYwF5Y=
31+
github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af h1:6yITBqGTE2lEeTPG04SN9W+iWHCRyHqlVYILiSXziwk=
32+
github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af/go.mod h1:4F09kP5F+am0jAwlQLddpoMDM+iewkxxt6nxUQ5nq5o=
33+
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
34+
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
35+
golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
36+
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
37+
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
38+
golang.org/x/net v0.0.0-20190620200207-3b0461eec859 h1:R/3boaszxrf1GEUWTVDzSKVwLmSJpwZ1yqXm8j0v2QI=
39+
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
40+
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
41+
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
42+
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
43+
golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
44+
golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
45+
golang.org/x/sys v0.0.0-20210309074719-68d13333faf2 h1:46ULzRKLh1CwgRq2dC5SlBzEqqNCi8rreOZnNrbqcIY=
46+
golang.org/x/sys v0.0.0-20210309074719-68d13333faf2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
47+
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
48+
golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
49+
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎main.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,10 @@ var (
2323
exit = make(chan bool)
2424
)
2525

26-
var defaultScannedFileExtensions = []string{".txt", ".csv", ".htm", ".html", ".flv", ".f4v", ".avi", ".3gp", ".3g2", ".3gp2", ".3p2", ".divx", ".mp4", ".mkv", ".mov", ".qt", ".asf", ".wmv", ".rm", ".rmvb", ".vob", ".dat", ".mpg", ".mpeg", ".bik", ".fcs", ".mp3", ".mpeg3", ".flac", ".ape", ".ogg", ".aac", ".m4a", ".wma", ".ac3", ".wav", ".mka", ".rm", ".ra", ".ravb", ".mid", ".midi", ".cda", ".jpg", ".jpe", ".jpeg", ".jff", ".gif", ".png", ".bmp", ".tif", ".tiff", ".emf", ".wmf", ".eps", ".psd", ".cdr", ".swf", ".exe", ".lnk", ".dll", ".ps1", ".scr", ".ocx", ".com", ".sys", ".class", ".o", ".so", ".elf", ".prx", ".vb", ".vbs", ".js", ".bat", ".cmd", ".msi", ".msp", ".deb", ".rpm", ".sh", ".pl", ".dylib", ".doc", ".dot", ".docx", ".dotx", ".docm", ".dotm", ".xsl", ".xls", ".xlsx", ".xltx", ".xlsm", ".xltm", ".xlam", ".xlsb", ".ppt", ".pot", ".pps", ".pptx", ".potx", ".pptm", ".potm", ".ppsx", ".ppsm", ".rtf", ".pdf", ".msg", ".eml", ".vsd", ".vss", ".vst", ".vdx", ".vsx", ".vtx", ".xps", ".oxps", ".one", ".onepkg", ".xsn", ".odt", ".ods", ".odp", ".sxw", ".pub", ".mdb", ".accdb", ".accde", ".accdr", ".accdc", ".chm", ".mht", ".zip", ".7z", ".7-z", ".rar", ".iso", ".cab", ".jar", ".bz", ".bz2", ".tbz", ".tbz2", ".gz", ".tgz", ".arj", ".dmg", ".smi", ".img", ".xar"}
26+
var defaultScannedFileExtensions = []string{".txt", ".csv", ".htm", ".html", ".flv", ".f4v", ".avi", ".3gp", ".3g2", ".3gp2", ".3p2", ".divx", ".mp4", ".mkv", ".mov", ".qt", ".asf", ".wmv", ".rm", ".rmvb", ".vob", ".dat", ".mpg", ".mpeg", ".bik", ".fcs", ".mp3", ".mpeg3", ".flac", ".ape", ".ogg", ".aac", ".m4a", ".wma", ".ac3", ".wav", ".mka", ".rm", ".ra", ".ravb", ".mid", ".midi", ".cda", ".jpg", ".jpe", ".jpeg", ".jff", ".gif", ".png", ".bmp", ".tif", ".tiff", ".emf", ".wmf", ".eps", ".psd", ".cdr", ".swf", ".exe", ".lnk", ".dll", ".ps1", ".scr", ".ocx", ".com", ".sys", ".class", ".o", ".so", ".elf", ".prx", ".vb", ".vbs", ".js", ".bat", ".cmd", ".msi", ".msp", ".deb", ".rpm", ".sh", ".pl", ".dylib", ".doc", ".dot", ".docx", ".dotx", ".docm", ".dotm", ".xsl", ".xls", ".xlsx", ".xltx", ".xlsm", ".xltm", ".xlam", ".xlsb", ".ppt", ".pot", ".pps", ".pptx", ".potx", ".pptm", ".potm", ".ppsx", ".ppsm", ".rtf", ".pdf", ".msg", ".eml", ".vsd", ".vss", ".vst", ".vdx", ".vsx", ".vtx", ".xps", ".oxps", ".one", ".onepkg", ".xsn", ".odt", ".ods", ".odp", ".sxw", ".pub", ".mdb", ".accdb", ".accde", ".accdr", ".accdc", ".chm", ".mht", ".zip", ".7z", ".7-z", ".rar", ".iso", ".cab", ".jar", ".arj", ".dmg", ".smi", ".img", ".xar"}
27+
var archivesFormats = []string{"application/x-7z-compressed", "application/zip", "application/vnd.rar"}
28+
var maxFilesizeScan = 1024
29+
var cleanIfFileSizeGreaterThan = 512
2730

2831
func main() {
2932
var err error

‎procsmemory.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,13 @@ import (
44
"bytes"
55
"crypto/md5"
66
"fmt"
7-
"io/ioutil"
87
"log"
98
"os"
109
"strings"
1110
"syscall"
1211
"time"
1312

14-
"github.com/hillu/go-yara"
13+
"github.com/hillu/go-yara/v4"
1514
"golang.org/x/sys/windows"
1615
)
1716

@@ -199,7 +198,7 @@ func WriteProcessMemoryToFile(path string, file string, data []byte) (err error)
199198
}
200199
}
201200

202-
if err := ioutil.WriteFile(path+"/"+file, data, 0644); err != nil {
201+
if err := os.WriteFile(path+"/"+file, data, 0644); err != nil {
203202
return err
204203
}
205204

‎resources/fake_process.exe‎

938 KB
Binary file not shown.

‎utils.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,14 @@ import (
88
)
99

1010
// RegisterFileInHistory check if file is already known and hasn't change in files history return true if file is append to history and false if it is already known as is.
11-
func RegisterFileInHistory(f os.FileInfo, path string, history *[]FileDescriptor) bool {
11+
func RegisterFileInHistory(f os.FileInfo, path string, history *[]FileDescriptor, verbose bool) bool {
12+
if int(f.Size()) > 1024*1024*maxFilesizeScan {
13+
if verbose {
14+
log.Println("[INFO]", path, "skipped - larger than", maxFilesizeScan, "Mb")
15+
}
16+
return true
17+
}
18+
1219
for i, h := range *history {
1320
if h.FilePath == path {
1421
if h.LastModified == f.ModTime() && h.FileSize == f.Size() {

‎windowslnkparser.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66
"os"
77
"time"
88

9-
"github.com/hillu/go-yara"
9+
"github.com/hillu/go-yara/v4"
1010
golnk "github.com/parsiya/golnk"
1111
)
1212

0 commit comments

Comments
 (0)