44 lines
1.2 KiB
Python
44 lines
1.2 KiB
Python
#region Imports
|
|
import os, yara, tomllib
|
|
from utils.Logger import Log
|
|
#endregion
|
|
|
|
#region Variables
|
|
scanned_files_map = set()
|
|
ignored_files = {}
|
|
ignored_directories = {}
|
|
|
|
with open("./config.toml", "rb") as f:
|
|
data = tomllib.load(f)
|
|
#endregion
|
|
|
|
#region scanfile
|
|
|
|
def scan(src):
|
|
"""
|
|
Scan a file with YARA rules and return the matches.
|
|
|
|
Args:
|
|
file_path (str): The path to the file to be scanned.
|
|
|
|
Returns:
|
|
matches[filename], error_message
|
|
"""
|
|
matches = {}
|
|
error_messages = {}
|
|
|
|
for filename in os.listdir(data['DETECTION']['SignaturePath']):
|
|
if filename.endswith(".yara") or filename.endswith(".yar"): # both are yara extensions ok
|
|
rule_path = os.path.join(data['DETECTION']['SignaturePath'], filename)
|
|
try:
|
|
rules = yara.compile(filepath=rule_path)
|
|
file_matches = rules.match(data=src)
|
|
if file_matches:
|
|
matches[filename] = file_matches
|
|
#for match in file_matches:
|
|
# Log.v(f" - Rule: {match.rule}")
|
|
except yara.Error as e:
|
|
Log.e(e)
|
|
error_messages[filename] = e
|
|
return matches, error_messages
|
|
#endregion |