mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 15:48:19 +00:00
Some changes to fix PE analyzer on master.
This commit is contained in:
parent
010cd80f2f
commit
b4498a4142
3 changed files with 16 additions and 37 deletions
|
@ -82,9 +82,9 @@ event file_state_remove(f: fa_file)
|
||||||
Log::write(LOG, f$pe);
|
Log::write(LOG, f$pe);
|
||||||
}
|
}
|
||||||
|
|
||||||
event file_new(f: fa_file)
|
event file_mime_type(f: fa_file, mime_type: string)
|
||||||
{
|
{
|
||||||
if ( f?$mime_type && f$mime_type == /application\/x-dosexec.*/ )
|
if ( mime_type == /application\/x-dosexec.*/ )
|
||||||
{
|
{
|
||||||
Files::add_analyzer(f, Files::ANALYZER_PE);
|
Files::add_analyzer(f, Files::ANALYZER_PE);
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,29 +1,24 @@
|
||||||
|
// See the file in the main distribution directory for copyright.
|
||||||
|
|
||||||
#include "plugin/Plugin.h"
|
#include "plugin/Plugin.h"
|
||||||
#include "file_analysis/Component.h"
|
|
||||||
|
|
||||||
#include "PE.h"
|
#include "PE.h"
|
||||||
|
|
||||||
namespace plugin { namespace Bro_PE {
|
namespace plugin {
|
||||||
|
namespace Bro_PE {
|
||||||
|
|
||||||
class Plugin : public plugin::Plugin {
|
class Plugin : public plugin::Plugin {
|
||||||
protected:
|
public:
|
||||||
void InitPreScript()
|
plugin::Configuration Configure()
|
||||||
{
|
{
|
||||||
SetName("Bro::PE");
|
AddComponent(new ::file_analysis::Component("PE", ::file_analysis::PE::Instantiate));
|
||||||
SetVersion(-1);
|
|
||||||
SetAPIVersion(BRO_PLUGIN_API_VERSION);
|
|
||||||
SetDynamicPlugin(false);
|
|
||||||
|
|
||||||
SetDescription("Portable Executable analyzer");
|
plugin::Configuration config;
|
||||||
|
config.name = "Bro::PE";
|
||||||
AddComponent(new ::file_analysis::Component("PE",
|
config.description = "Portable Executable analyzer";
|
||||||
::file_analysis::PE::Instantiate));
|
return config;
|
||||||
|
|
||||||
extern std::list<std::pair<const char*, int> > __bif_events_init();
|
|
||||||
AddBifInitFunction(&__bif_events_init);
|
|
||||||
}
|
}
|
||||||
};
|
} plugin;
|
||||||
|
|
||||||
Plugin __plugin;
|
}
|
||||||
|
}
|
||||||
} }
|
|
||||||
|
|
|
@ -168,22 +168,6 @@ type PE::FileHeader: record;
|
||||||
type PE::OptionalHeader: record;
|
type PE::OptionalHeader: record;
|
||||||
type PE::SectionHeader: record;
|
type PE::SectionHeader: record;
|
||||||
|
|
||||||
module Log;
|
|
||||||
|
|
||||||
enum Writer %{
|
|
||||||
WRITER_DEFAULT,
|
|
||||||
WRITER_NONE,
|
|
||||||
WRITER_ASCII,
|
|
||||||
WRITER_DATASERIES,
|
|
||||||
WRITER_SQLITE,
|
|
||||||
WRITER_ELASTICSEARCH,
|
|
||||||
%}
|
|
||||||
|
|
||||||
enum ID %{
|
|
||||||
Unknown,
|
|
||||||
%}
|
|
||||||
|
|
||||||
|
|
||||||
module Tunnel;
|
module Tunnel;
|
||||||
enum Type %{
|
enum Type %{
|
||||||
NONE,
|
NONE,
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue