Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Updated PE analyzer to work with changes in master.

Browse source
This commit is contained in:
Vlad Grigorescu 2014-06-21 13:30:14 -04:00
parent b91b0646b8
commit 8ffa81f390
3 changed files with 3 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/files/pe/main.bro
View file

@ -79,7 +79,7 @@ event file_new(f: fa_file)
if ( f?$mime_type && f$mime_type == /application\/x-dosexec.*/ ) if ( f?$mime_type && f$mime_type == /application\/x-dosexec.*/ )
{ {
#print "found a windows executable"; #print "found a windows executable";
FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_PE]); Files::add_analyzer(f, Files::ANALYZER_PE);
#FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_EXTRACT, #FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_EXTRACT,
# $extract_filename=fmt("exe-%d", ++blah_counter)]); # $extract_filename=fmt("exe-%d", ++blah_counter)]);
} }

12
src/file_analysis/analyzer/pe/PE.cc
View file

@ -1,14 +1,10 @@
#include <string>
#include "PE.h" #include "PE.h"
#include "pe_pac.h" #include "file_analysis/Manager.h"
#include "util.h"
#include "Event.h"
using namespace file_analysis; using namespace file_analysis;
PE::PE(RecordVal* args, File* file) PE::PE(RecordVal* args, File* file)
: file_analysis::Analyzer(args, file) : file_analysis::Analyzer(file_mgr->GetComponentTag("PE"), args, file)
{ {
conn = new binpac::PE::MockConnection(this); conn = new binpac::PE::MockConnection(this);
interp = new binpac::PE::File(conn); interp = new binpac::PE::File(conn);
@ -26,10 +22,6 @@ bool PE::DeliverStream(const u_char* data, uint64 len)
{ {
interp->NewData(data, data + len); interp->NewData(data, data + len);
} }
catch ( const binpac::HaltParser &e )
{
return false;
}
catch ( const binpac::Exception& e ) catch ( const binpac::Exception& e )
{ {
printf("Binpac exception: %s\n", e.c_msg()); printf("Binpac exception: %s\n", e.c_msg());

2
src/file_analysis/analyzer/pe/pe-analyzer.pac
View file

@ -2,7 +2,6 @@
%extern{ %extern{
#include "Event.h" #include "Event.h"
#include "file_analysis/File.h" #include "file_analysis/File.h"
#include "file_analysis.bif.func_h"
#include "events.bif.h" #include "events.bif.h"
%} %}
@ -10,7 +9,6 @@ refine flow File += {
function proc_the_file(): bool function proc_the_file(): bool
%{ %{
throw binpac::HaltParser();
return true; return true;
%} %}