diff options
| -rw-r--r-- | php-malware-finder/generate_whitelist.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/php-malware-finder/generate_whitelist.py b/php-malware-finder/generate_whitelist.py index 791bab9..6c2e03e 100644 --- a/php-malware-finder/generate_whitelist.py +++ b/php-malware-finder/generate_whitelist.py | |||
| @@ -24,12 +24,12 @@ for cpt, (root, dirnames, filenames) in enumerate(os.walk(sys.argv[2])): | |||
| 24 | if os.stat(fname).st_size: | 24 | if os.stat(fname).st_size: |
| 25 | matches = rules.match(os.path.join(root, filename), fast=True) | 25 | matches = rules.match(os.path.join(root, filename), fast=True) |
| 26 | if matches: | 26 | if matches: |
| 27 | matches = matches.pop() # only one match, since we're scaning files | 27 | matches = matches.pop() # only one match, since we're scaning files |
| 28 | output_list.append('hash.sha1(0, filename) == %s or // %s' % (hashlib.sha1(fname).hexdigest(), fname)) | 28 | output_list.append('hash.sha1(0, filename) == %s or // %s' % (hashlib.sha1(fname).hexdigest(), fname)) |
| 29 | 29 | ||
| 30 | 30 | ||
| 31 | output_rule = 'private rule %s\n{\n\tcondition:\n\t\t/* %s */\n\t\t' % (sys.argv[1].split(' ')[0], sys.argv[1]) | 31 | output_rule = 'private rule %s\n{\n\tcondition:\n\t\t/* %s */\n\t\t' % (sys.argv[1].split(' ')[0], sys.argv[1]) |
| 32 | output_list.append(output_list.pop().replace(' or ', ' ')) | 32 | output_list.append(output_list.pop().replace(' or ', ' ')) |
| 33 | output_rule += '\n\t\t'.join(output_list) | 33 | output_rule += '\n\t\t'.join(output_list) |
| 34 | output_rule +='\n}' | 34 | output_rule += '\n}' |
| 35 | print output_rule | 35 | print output_rule |
