Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Some changes to fix PE analyzer on master.

Browse source
This commit is contained in:
Vlad Grigorescu 2015-04-07 14:45:15 -07:00
parent 010cd80f2f
commit b4498a4142
3 changed files with 16 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/files/pe/main.bro
View file

@ -82,9 +82,9 @@ event file_state_remove(f: fa_file)
Log::write(LOG, f$pe);
}
event file_new(f: fa_file)
event file_mime_type(f: fa_file, mime_type: string)
{
if ( f?$mime_type && f$mime_type == /application\/x-dosexec.*/ )
if ( mime_type == /application\/x-dosexec.*/ )
{
Files::add_analyzer(f, Files::ANALYZER_PE);
}

33
src/file_analysis/analyzer/pe/Plugin.cc
View file

@ -1,29 +1,24 @@
// See the file in the main distribution directory for copyright.
#include "plugin/Plugin.h"
#include "file_analysis/Component.h"
#include "PE.h"
namespace plugin { namespace Bro_PE {
namespace plugin {
namespace Bro_PE {
class Plugin : public plugin::Plugin {
protected:
void InitPreScript()
public:
plugin::Configuration Configure()
{
SetName("Bro::PE");
SetVersion(-1);
SetAPIVersion(BRO_PLUGIN_API_VERSION);
SetDynamicPlugin(false);
AddComponent(new ::file_analysis::Component("PE", ::file_analysis::PE::Instantiate));
SetDescription("Portable Executable analyzer");
AddComponent(new ::file_analysis::Component("PE",
::file_analysis::PE::Instantiate));
extern std::list<std::pair<const char*, int> > __bif_events_init();
AddBifInitFunction(&__bif_events_init);
plugin::Configuration config;
config.name = "Bro::PE";
config.description = "Portable Executable analyzer";
return config;
}
};
} plugin;
Plugin __plugin;
} }
}
}

16
src/types.bif
View file

@ -168,22 +168,6 @@ type PE::FileHeader: record;
type PE::OptionalHeader: record;
type PE::SectionHeader: record;
module Log;
enum Writer %{
WRITER_DEFAULT,
WRITER_NONE,
WRITER_ASCII,
WRITER_DATASERIES,
WRITER_SQLITE,
WRITER_ELASTICSEARCH,
%}
enum ID %{
Unknown,
%}
module Tunnel;
enum Type %{
NONE,