Some changes to fix PE analyzer on master.

This commit is contained in:
Vlad Grigorescu 2015-04-07 14:45:15 -07:00
parent 010cd80f2f
commit b4498a4142
3 changed files with 16 additions and 37 deletions

View file

@ -82,9 +82,9 @@ event file_state_remove(f: fa_file)
Log::write(LOG, f$pe); Log::write(LOG, f$pe);
} }
event file_new(f: fa_file) event file_mime_type(f: fa_file, mime_type: string)
{ {
if ( f?$mime_type && f$mime_type == /application\/x-dosexec.*/ ) if ( mime_type == /application\/x-dosexec.*/ )
{ {
Files::add_analyzer(f, Files::ANALYZER_PE); Files::add_analyzer(f, Files::ANALYZER_PE);
} }

View file

@ -1,29 +1,24 @@
// See the file in the main distribution directory for copyright.
#include "plugin/Plugin.h" #include "plugin/Plugin.h"
#include "file_analysis/Component.h"
#include "PE.h" #include "PE.h"
namespace plugin { namespace Bro_PE { namespace plugin {
namespace Bro_PE {
class Plugin : public plugin::Plugin { class Plugin : public plugin::Plugin {
protected: public:
void InitPreScript() plugin::Configuration Configure()
{ {
SetName("Bro::PE"); AddComponent(new ::file_analysis::Component("PE", ::file_analysis::PE::Instantiate));
SetVersion(-1);
SetAPIVersion(BRO_PLUGIN_API_VERSION);
SetDynamicPlugin(false);
SetDescription("Portable Executable analyzer"); plugin::Configuration config;
config.name = "Bro::PE";
AddComponent(new ::file_analysis::Component("PE", config.description = "Portable Executable analyzer";
::file_analysis::PE::Instantiate)); return config;
extern std::list<std::pair<const char*, int> > __bif_events_init();
AddBifInitFunction(&__bif_events_init);
} }
}; } plugin;
Plugin __plugin; }
}
} }

View file

@ -168,22 +168,6 @@ type PE::FileHeader: record;
type PE::OptionalHeader: record; type PE::OptionalHeader: record;
type PE::SectionHeader: record; type PE::SectionHeader: record;
module Log;
enum Writer %{
WRITER_DEFAULT,
WRITER_NONE,
WRITER_ASCII,
WRITER_DATASERIES,
WRITER_SQLITE,
WRITER_ELASTICSEARCH,
%}
enum ID %{
Unknown,
%}
module Tunnel; module Tunnel;
enum Type %{ enum Type %{
NONE, NONE,