Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Another checkpoint

Browse source
This commit is contained in:
Seth Hall 2013-04-25 13:44:12 -04:00
parent d72980828f
commit 317252b5ae
8 changed files with 62 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/file_analysis/AnalyzerSet.cc
View file

@ -4,6 +4,7 @@
#include "Extract.h"
#include "DataEvent.h"
#include "Hash.h"
#include "analyzers/PE.h"
using namespace file_analysis;
@ -14,6 +15,7 @@ static AnalyzerInstantiator analyzer_factory[] = {
file_analysis::SHA1::Instantiate,
file_analysis::SHA256::Instantiate,
file_analysis::DataEvent::Instantiate,
file_analysis::PE::Instantiate,
};
static void analyzer_del_func(void* v)

29
src/file_analysis/analyzers/PE.cc
View file

@ -7,38 +7,29 @@
using namespace file_analysis;
PE_Analyzer::PE_Analyzer(RecordVal* args, File* file)
: Action(args, file)
PE::PE(RecordVal* args, File* file)
: file_analysis::Analyzer(args, file)
{
conn = new binpac::PE::MockConnection(this);
interp = new binpac::PE::File(conn);
done=false;
}
PE_Analyzer::~PE_Analyzer()
PE::~PE()
{
delete interp;
}
Action* PE_Analyzer::Instantiate(RecordVal* args, File* file)
bool PE::DeliverStream(const u_char* data, uint64 len)
{
return new PE_Analyzer(args, file);
}
bool PE_Analyzer::DeliverStream(const u_char* data, uint64 len)
{
printf("deliver stream\n");
if (done)
{
printf("analyzer done\n");
return false;
}
Action::DeliverStream(data, len);
try
{
interp->NewData(data, data + len);
}
catch ( const binpac::HaltParser &e )
{
return false;
}
catch ( const binpac::Exception& e )
{
printf("Binpac exception: %s\n", e.c_msg());
@ -48,9 +39,9 @@ bool PE_Analyzer::DeliverStream(const u_char* data, uint64 len)
return true;
}
bool PE_Analyzer::EndOfFile()
bool PE::EndOfFile()
{
printf("end of file!\n");
done=true;
//throw binpac::HaltParser();
return false;
}

9
src/file_analysis/analyzers/PE.h
View file

@ -12,18 +12,19 @@ namespace file_analysis {
/**
* An action to simply extract files to disk.
*/
class PE_Analyzer : Action {
class PE : public file_analysis::Analyzer {
public:
static Action* Instantiate(RecordVal* args, File* file);
~PE();
~PE_Analyzer();
static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
{ return new PE(args, file); }
virtual bool DeliverStream(const u_char* data, uint64 len);
virtual bool EndOfFile();
protected:
PE_Analyzer(RecordVal* args, File* file);
PE(RecordVal* args, File* file);
binpac::PE::File* interp;
binpac::PE::MockConnection* conn;
bool done;

5
src/file_analysis/analyzers/pe-analyzer.pac
View file

@ -9,10 +9,7 @@ refine flow File += {
function proc_the_file(): bool
%{
printf("ending the flow!\n");
connection()->bro_analyzer()->EndOfFile();
connection()->FlowEOF(true);
connection()->FlowEOF(false);
throw binpac::HaltParser();
return true;
%}

7
src/file_analysis/analyzers/pe-file.pac
View file

@ -6,7 +6,6 @@ type TheFile = record {
sections_table : IMAGE_SECTION_HEADER[] &length=pe_header.file_header.NumberOfSections*40 &transient;
#pad : bytestring &length=offsetof(pe_header.data_directories + pe_header.data_directories[1].virtual_address);
#data_sections : DATA_SECTIONS[pe_header.file_header.NumberOfSections];
#pad : bytestring &restofdata;
} &let {
dos_code_len: uint32 = dos_header.AddressOfNewExeHeader - 64;
} &byteorder=littleendian;
@ -75,9 +74,9 @@ type IMAGE_OPTIONAL_HEADER(len: uint16) = record {
subsystem : uint16;
dll_characteristics : uint16;
mem: case magic of {
0x0b01 -> i32 : MEM_INFO32;
0x0b02 -> i64 : MEM_INFO64;
default -> InvalidPEFile : bytestring &length=0;
0x0b01 -> i32 : MEM_INFO32;
0x0b02 -> i64 : MEM_INFO64;
default -> InvalidPEFile : empty;
};
loader_flags : uint32;
number_of_rva_and_sizes : uint32;