diff options
| -rw-r--r-- | php-malware-finder/generate_whitelist.py | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/php-malware-finder/generate_whitelist.py b/php-malware-finder/generate_whitelist.py index 4a8a6c5..04bcc91 100644 --- a/php-malware-finder/generate_whitelist.py +++ b/php-malware-finder/generate_whitelist.py | |||
| @@ -8,15 +8,15 @@ import sys | |||
| 8 | try: | 8 | try: |
| 9 | import yara | 9 | import yara |
| 10 | except ImportError: | 10 | except ImportError: |
| 11 | print 'Please install python-yara' | 11 | print('Please install python-yara') |
| 12 | sys.exit(1) | 12 | sys.exit(1) |
| 13 | 13 | ||
| 14 | if len(sys.argv) != 3: | 14 | if len(sys.argv) != 3: |
| 15 | print 'Usage: %s name_of_the_rule_and_version folder_to_scan' % sys.argv[0] | 15 | print('Usage: %s name_of_the_rule_and_version folder_to_scan' % sys.argv[0]) |
| 16 | sys.exit(1) | 16 | sys.exit(1) |
| 17 | 17 | ||
| 18 | if not os.path.isdir(sys.argv[2]): | 18 | if not os.path.isdir(sys.argv[2]): |
| 19 | print '%s is not a folder !' % sys.argv[2] | 19 | print('%s is not a folder !' % sys.argv[2]) |
| 20 | sys.exit(1) | 20 | sys.exit(1) |
| 21 | 21 | ||
| 22 | rules = yara.compile('./php.yar', includes=True, error_on_warning=True) | 22 | rules = yara.compile('./php.yar', includes=True, error_on_warning=True) |
| @@ -30,11 +30,11 @@ for cpt, (root, dirnames, filenames) in enumerate(os.walk(sys.argv[2])): | |||
| 30 | matches = rules.match(os.path.join(root, filename), fast=True) | 30 | matches = rules.match(os.path.join(root, filename), fast=True) |
| 31 | if matches: | 31 | if matches: |
| 32 | matches = matches.pop() # only one match, since we're scaning files | 32 | matches = matches.pop() # only one match, since we're scaning files |
| 33 | output_list.append('hash.sha1(0, filename) == %s or // %s' % (hashlib.sha1(fname).hexdigest(), fname)) | 33 | output_list.append('hash.sha1(0, filename) == %s or // %s' % (hashlib.sha1(fname.encode('utf-8')).hexdigest(), fname)) |
| 34 | 34 | ||
| 35 | 35 | ||
| 36 | output_rule = 'private rule %s\n{\n\tcondition:\n\t\t/* %s */\n\t\t' % (sys.argv[1].split(' ')[0], sys.argv[1]) | 36 | output_rule = 'private rule %s\n{\n\tcondition:\n\t\t/* %s */\n\t\t' % (sys.argv[1].split(' ')[0], sys.argv[1]) |
| 37 | output_list.append(output_list.pop().replace(' or ', ' ')) | 37 | output_list.append(output_list.pop().replace(' or ', ' ')) |
| 38 | output_rule += '\n\t\t'.join(output_list) | 38 | output_rule += '\n\t\t'.join(output_list) |
| 39 | output_rule += '\n}' | 39 | output_rule += '\n}' |
| 40 | print output_rule | 40 | print(output_rule) |
