summaryrefslogtreecommitdiff
path: root/generate_whitelist.py
diff options
context:
space:
mode:
authorJulien "shaddai" Reveret2015-10-08 17:44:47 +0200
committerMathieu Deous2015-10-29 14:55:04 +0100
commitff0c609ce15299fcd0da5f5b471d3519495977ff (patch)
treeb217ff3ed047ad0f63c4e39b8f400eebafa0d1a3 /generate_whitelist.py
parent1b88cf3b85d8e3225fb55526f53cbf4df75d9813 (diff)
reorganized git repo
Diffstat (limited to 'generate_whitelist.py')
-rw-r--r--generate_whitelist.py35
1 files changed, 0 insertions, 35 deletions
diff --git a/generate_whitelist.py b/generate_whitelist.py
deleted file mode 100644
index 791bab9..0000000
--- a/generate_whitelist.py
+++ /dev/null
@@ -1,35 +0,0 @@
1#!/usr/bin/env python
2
3import fnmatch
4import hashlib
5import os
6import sys
7
8try:
9 import yara
10except ImportError:
11 print 'Please install python-yara'
12 sys.exit(0)
13
14if len(sys.argv) != 3:
15 print 'Usage: %s name_of_the_rule_and_version folder_to_scan' % sys.argv[0]
16
17rules = yara.compile('./malwares.yara', includes=True, error_on_warning=True)
18
19output_list = list()
20
21for cpt, (root, dirnames, filenames) in enumerate(os.walk(sys.argv[2])):
22 for filename in fnmatch.filter(filenames, '*.ph*'):
23 fname = os.path.join(root, filename)
24 if os.stat(fname).st_size:
25 matches = rules.match(os.path.join(root, filename), fast=True)
26 if matches:
27 matches = matches.pop() # only one match, since we're scaning files
28 output_list.append('hash.sha1(0, filename) == %s or // %s' % (hashlib.sha1(fname).hexdigest(), fname))
29
30
31output_rule = 'private rule %s\n{\n\tcondition:\n\t\t/* %s */\n\t\t' % (sys.argv[1].split(' ')[0], sys.argv[1])
32output_list.append(output_list.pop().replace(' or ', ' '))
33output_rule += '\n\t\t'.join(output_list)
34output_rule +='\n}'
35print output_rule