anti-abuse/utils/Scanner.py

#region Imports
import os, yara, tomllib
from utils.Logger import Log
#endregion

#region Variables
scanned_files_map = set()
ignored_files = {}
ignored_directories = {}

with open("./config.toml", "rb") as f:
    data = tomllib.load(f)
#endregion

#region scanfile

def scan(src):
    """
    Scan a file with YARA rules and return the matches.

    Args:
     file_path (str): The path to the file to be scanned.

    Returns:
     matches[filename], error_message
    """
    matches = {}
    error_messages = {}

    for filename in os.listdir(data['DETECTION']['SignaturePath']):
        if filename.endswith(".yara") or filename.endswith(".yar"): # both are yara extensions ok
            rule_path = os.path.join(data['DETECTION']['SignaturePath'], filename)
            try:
                rules = yara.compile(filepath=rule_path)
                file_matches = rules.match(data=src)
                if file_matches:
                    matches[filename] = file_matches
                    #for match in file_matches:
                    #     Log.v(f"  - Rule: {match.rule}")
            except yara.Error as e:
                Log.e(e)
                error_messages[filename] = e
    return matches, error_messages
#endregion