Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Moving the PE analyzer to the new plugin structure.

Browse source
This commit is contained in:
Seth Hall 2013-07-27 00:07:47 -04:00
parent 998cedb3b8
commit 1e098bae8d
6 changed files with 13 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

0
src/file_analysis/analyzers/PE.cc → src/file_analysis/analyzer/pe/PE.cc
View file

0
src/file_analysis/analyzers/PE.h → src/file_analysis/analyzer/pe/PE.h
View file

5
src/file_analysis/analyzer/pe/events.bif Normal file
View file

@ -0,0 +1,5 @@
event pe_dos_header%(f: fa_file, h: PE::DOSHeader%);
event pe_dos_code%(f: fa_file, code: string%);
event pe_file_header%(f: fa_file, h: PE::FileHeader%);
event pe_optional_header%(f: fa_file, h: PE::OptionalHeader%);
event pe_section_header%(f: fa_file, h: PE::SectionHeader%);

0
src/file_analysis/analyzers/pe-analyzer.pac → src/file_analysis/analyzer/pe/pe-analyzer.pac
View file

16
src/file_analysis/analyzers/pe-file.pac → src/file_analysis/analyzer/pe/pe-file.pac
View file

@ -1,12 +1,12 @@
type TheFile = record {
dos_header : DOS_Header;
dos_code : DOS_Code(dos_code_len);
pe_header : IMAGE_NT_HEADERS;
sections_table : IMAGE_SECTION_HEADER[] &length=pe_header.file_header.NumberOfSections*40 &transient;
#pad : bytestring &length=offsetof(pe_header.data_directories + pe_header.data_directories[1].virtual_address);
#data_sections : DATA_SECTIONS[pe_header.file_header.NumberOfSections];
data_sections : DATA_SECTIONS[] &length=data_len;
type TheFile(part: uint8) = record {
dos_header : DOS_Header;
dos_code : DOS_Code(dos_code_len);
pe_header : IMAGE_NT_HEADERS;
section_headers : IMAGE_SECTION_HEADER[] &length=pe_header.optional_header.size_of_headers;
#pad : bytestring &length=offsetof(pe_header.data_directories + pe_header.data_directories[1].virtual_address);
#data_sections : DATA_SECTIONS[pe_header.file_header.NumberOfSections];
#data_sections : DATA_SECTIONS[] &length=data_len;
} &let {
dos_code_len: uint32 = dos_header.AddressOfNewExeHeader - 64;
data_len: uint32 = pe_header.optional_header.size_of_init_data;

0
src/file_analysis/analyzers/pe.pac → src/file_analysis/analyzer/pe/pe.pac
View file