Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Updated PE analyzer to work with changes in master.

Browse source
This commit is contained in:
Vlad Grigorescu 2014-06-21 13:30:14 -04:00
parent b91b0646b8
commit 8ffa81f390
3 changed files with 3 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/file_analysis/analyzer/pe/PE.cc
View file

@ -1,14 +1,10 @@
#include <string>
#include "PE.h"
#include "pe_pac.h"
#include "util.h"
#include "Event.h"
#include "file_analysis/Manager.h"
using namespace file_analysis;
PE::PE(RecordVal* args, File* file)
: file_analysis::Analyzer(args, file)
: file_analysis::Analyzer(file_mgr->GetComponentTag("PE"), args, file)
{
conn = new binpac::PE::MockConnection(this);
interp = new binpac::PE::File(conn);
@ -26,10 +22,6 @@ bool PE::DeliverStream(const u_char* data, uint64 len)
{
interp->NewData(data, data + len);
}
catch ( const binpac::HaltParser &e )
{
return false;
}
catch ( const binpac::Exception& e )
{
printf("Binpac exception: %s\n", e.c_msg());

2
src/file_analysis/analyzer/pe/pe-analyzer.pac
View file

@ -2,7 +2,6 @@
%extern{
#include "Event.h"
#include "file_analysis/File.h"
#include "file_analysis.bif.func_h"
#include "events.bif.h"
%}
@ -10,7 +9,6 @@ refine flow File += {
function proc_the_file(): bool
%{
throw binpac::HaltParser();
return true;
%}