56 lines
1.7 KiB
Go
56 lines
1.7 KiB
Go
package yara
|
|
|
|
import (
|
|
"log/slog"
|
|
"os/exec"
|
|
"path/filepath"
|
|
|
|
"git.jmbit.de/jmb/scanfile/server/internal/store"
|
|
"github.com/spf13/viper"
|
|
)
|
|
|
|
func compileSourcesFromFiles() error {
|
|
root, err := filepath.Abs(viper.GetString("processing.yararules"))
|
|
if err != nil {
|
|
slog.Error("Error getting absolute path for processing.yararules", "error", err)
|
|
return err
|
|
}
|
|
outputPath, err := filepath.Abs(viper.GetString("processing.yaracompiled"))
|
|
if err != nil {
|
|
slog.Error("Error getting absolute path for processing.yaracompiled", "error", err)
|
|
return err
|
|
}
|
|
|
|
cmd := exec.Command("/usr/local/bin/yr", "compile","-path-as-namespace", "--relaxed-re-syntax", "--output", outputPath, root)
|
|
result, err := cmd.Output()
|
|
if err != nil {
|
|
slog.Error("Error compiling yara rules", "error", err, "result", string(result))
|
|
return err
|
|
} else {
|
|
slog.Info("Compiled yara rules", "result", string(result))
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func scanFile(fileName string) ([]string, error) {
|
|
var matched []string
|
|
outputPath, err := filepath.Abs(viper.GetString("processing.yaracompiled"))
|
|
if err != nil {
|
|
slog.Error("Error getting absolute path for processing.yaracompiled", "error", err)
|
|
return matched, err
|
|
}
|
|
fullPath, err := store.AbsPath(fileName)
|
|
if err != nil {
|
|
slog.Error("Error in DiecScan", "file-uuid", fileName, "error", err)
|
|
return matched, err
|
|
}
|
|
cmd := exec.Command("/usr/local/bin/yr", "scan", "--output-format ndjson", "--print-namespace","--compiled-rules", outputPath, fullPath)
|
|
result, err := cmd.Output()
|
|
if err != nil {
|
|
slog.Error("Error scanning file with yara", "error", err, "file-uuid", fileName,"result", string(result))
|
|
return matched, err
|
|
}
|
|
|
|
return matched, nil
|
|
}
|