file_analysis: Implement AnalyzerViolation() for file_analysis/Analyzer

Add a test parsing a malformed PE file showing that analyzer_violation_info
is raised with the fa_file object set.

It could be interesting to pass through an optional connection if one
exists, but access is provided through f$conns, too.
This commit is contained in:
Arne Welzel 2022-08-31 18:07:18 +02:00
parent bc8fd5a4c6
commit d5cd023dff
10 changed files with 145 additions and 6 deletions

View file

@ -30,6 +30,7 @@ bool PE::DeliverStream(const u_char* data, uint64_t len)
}
catch ( const binpac::Exception& e )
{
AnalyzerViolation(util::fmt("Binpac exception: %s", e.c_msg()));
return false;
}