Fix the whitelist generation

1 files changed, 8 insertions, 14 deletions

diff --git a/php-malware-finder/generate_whitelist.py b/php-malware-finder/generate_whitelist.py
index a8ed8f8..af6be27 100755
--- a/php-malware-finder/generate_whitelist.py
+++ b/php-malware-finder/generate_whitelist.py
@@ -11,11 +11,6 @@ except ImportError:
     print('Please install python-yara')
     sys.exit(1)
 
-print("/!\\ THIS SCRIPT IS BROKEN AND SHOULD NOT BE USED /!\\")
-print("IF YOU WANT ANYWAY, EDIT IT TO REMOVE THIS WARNING")
-sys.exit(0)
-
-
 if len(sys.argv) != 3:
     print('Usage: %s name_of_the_rule_and_version folder_to_scan' % sys.argv[0])
     sys.exit(1)
@@ -28,19 +23,18 @@ rules = yara.compile('./php.yar', includes=True, error_on_warning=True)
 
 output_list = list()
 
-for cpt, (root, dirnames, filenames) in enumerate(os.walk(sys.argv[2])):
+for curdir, dirnames, filenames in os.walk(sys.argv[2]):
     for filename in fnmatch.filter(filenames, '*.ph*'):
-        fname = os.path.join(root, filename)
-        if os.stat(fname).st_size:
-            matches = rules.match(os.path.join(root, filename), fast=True)
+        fname = os.path.join(curdir, filename)
+        if 0 < os.stat(fname).st_size < 5 * 1024 * 1024:
+            matches = rules.match(fname, fast=True)
             if matches:
-                hasher = hashlib.sha1()
-                with open(fname, 'rb') as ifile:
-                    hasher.update(ifile.read())
-                output_list.append('hash.sha1(0, filesize) == "%s" or // %s' % (hasher.hexdigest(), fname))
+                with open(fname, 'rb') as f:
+                    digest = hashlib.sha1(f.read()).hexdigest()
+                output_list.append('hash.sha1(0, filesize) == "%s" or // %s' % (digest, fname))
 
 
-output_rule = 'import "hash"\n\nprivate rule %s\n{\n\tcondition:\n\t\t/* %s */\n\t\t' % (sys.argv[1].split(' ')[0], sys.argv[1])
+output_rule = 'import "hash"\n\nrule %s\n{\n\tcondition:\n\t\t/* %s */\n\t\t' % (sys.argv[1].split(' ')[0], sys.argv[1])
 output_list.append(output_list.pop().replace(' or ', '    '))
 output_rule += '\n\t\t'.join(output_list)
 output_rule += '\n}'