search for: error_success

...ot;upload" function in daemon/upload.c: int upload_to_fd (int fd) With the above, upload_rules_file could not be needed anymore, and the logic to open a temporary fd could be moved directly at the beginning of do_yara_load. > +/* Compile source code rules and load them. > + * Return ERROR_SUCCESS on success, Yara error code type on error. > + */ > +static int > +compile_rules_file (const char *rules_path) > +{ > + int ret = 0; > + CLEANUP_FCLOSE FILE *rule_file = NULL; > + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; > + > + ret = yr_compiler_cr...

...c int write_callback (void *, const void *, size_t); + +/* Has one FileIn parameter. */ +int +do_yara_load (void) +{ + int ret = 0; + char tmpfile[] = "/tmp/yaraXXXXXX"; + + ret = upload_rules_file (tmpfile); + if (ret < 0) + return -1; + + ret = yr_initialize (); + if (ret != ERROR_SUCCESS) { + reply_with_error ("failed initializing yara"); + unlink (tmpfile); + return -1; + } + + /* Destroy previously loaded rules. */ + if (rules != NULL) { + yr_rules_destroy (rules); + rules = NULL; + } + + /* Try to load the rules as compiled. + * If their are in so...

...tly at the beginning > of do_yara_load. Just one question: shall the changes in upload.c be in a separate commit "expose XYZ"? What is the preferred way? This question applies also for the notes in PATCH 5. > >> +/* Compile source code rules and load them. >> + * Return ERROR_SUCCESS on success, Yara error code type on error. >> + */ >> +static int >> +compile_rules_file (const char *rules_path) >> +{ >> + int ret = 0; >> + CLEANUP_FCLOSE FILE *rule_file = NULL; >> + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; >&gt...

...one FileIn parameter. */ +int +do_yara_load (void) +{ + int ret = 0; + char tmpfile[] = "/tmp/yaraXXXXXX"; + + ret = upload_rules_file (tmpfile); + if (ret < 0) + return -1; + + /* Initialize yara only once. */ + if (!initialized) { + ret = yr_initialize (); + if (ret != ERROR_SUCCESS) { + reply_with_error ("failed initializing yara"); + return -1; + } + + initialized = true; + } + + /* Destroy previously loaded rules. */ + if (rules != NULL) { + yr_rules_destroy (rules); + rules = NULL; + } + + /* Try to load the rules as compiled. + * If...

Yara is a rule based scanning engine aimed to help malware analysts in finding and classifying interesting samples. https://github.com/VirusTotal/yara This series adds Yara support to Libguestfs allowing to upload sets of rules and scanning files against them. Currently provided APIs: - yara_load: loads a set of rules - yara_destroy: free resources allocated by loaded rules - yara_scan:

...p (tmpfile); + if (fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + ret = upload_to_fd (fd); + if (ret < 0) { + unlink (tmpfile); + return -1; + } + + /* Initialize yara only once. */ + if (!initialized) { + ret = yr_initialize (); + if (ret != ERROR_SUCCESS) { + reply_with_error ("failed initializing yara"); + unlink (tmpfile); + return -1; + } + + initialized = true; + } + + /* Clear namespace if no optional parameter is given. */ + if (!(optargs_bitmask & GUESTFS_YARA_LOAD_NAMESPACE_BITMASK)) + namespace = NU...

v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:

Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

...p (tmpfile); + if (fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + ret = upload_to_fd (fd); + if (ret < 0) { + unlink (tmpfile); + return -1; + } + + /* Initialize yara only once. */ + if (!initialized) { + ret = yr_initialize (); + if (ret != ERROR_SUCCESS) { + reply_with_error ("failed initializing yara"); + unlink (tmpfile); + return -1; + } + + initialized = true; + } + + /* Destroy previously loaded rules. */ + if (rules != NULL) { + yr_rules_destroy (rules); + rules = NULL; + } + + /* Try to load the rul...

...p (tmpfile); + if (fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + r = upload_to_fd (fd, tmpfile); + if (r == -1) { + unlink (tmpfile); + return -1; + } + + /* Initialize yara only once. */ + if (!initialized) { + r = yr_initialize (); + if (r != ERROR_SUCCESS) { + reply_with_error ("failed initializing yara"); + unlink (tmpfile); + return -1; + } + + initialized = true; + } + + /* Destroy previously loaded rules. */ + if (rules != NULL) { + yr_rules_destroy (rules); + rules = NULL; + } + + /* Try to load the rul...

...p (tmpfile); + if (fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + ret = upload_to_fd (fd); + if (ret < 0) { + unlink (tmpfile); + return -1; + } + + /* Initialize yara only once. */ + if (!initialized) { + ret = yr_initialize (); + if (ret != ERROR_SUCCESS) { + reply_with_error ("failed initializing yara"); + unlink (tmpfile); + return -1; + } + + initialized = true; + } + + /* Clear namespace if no optional parameter is given. */ + if (!(optargs_bitmask & GUESTFS_YARA_LOAD_NAMESPACE_BITMASK)) + namespace = NU...

...registry OutputDebugString("from reg:"); char DLLlocation[MAX_PATH]; LONG rc; HKEY hkey; DWORD keytype = REG_SZ; DWORD cbData = sizeof (DLLlocation); rc = RegOpenKeyEx (HKEY_LOCAL_MACHINE, "Software\\R-core\\R", 0, KEY_READ, &hkey); if (rc == ERROR_SUCCESS) { rc = RegQueryValueEx (hkey, "InstallPath", 0, &keytype, (LPBYTE)DLLlocation, &cbData); RegCloseKey (hkey); } if (rc == ERROR_SUCCESS) { // set R_HOME char *buf; buf = (char *) malloc ((strlen (DLLlocation) + 8) *...

v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests

Hi all, Tim Uckun reported, and I''ve confirmed, that you can''t write to the Windows PowerShell event source for some reason. Tim thought it might be because of the space in the name, but my attempt to quote it did not seem to help. In order to follow along, install PowerShell, create the foo.dll using the foo.mc file in the ''test'' directory, and try the

v8: - Ignore returned value in daemon/upload.c - Report serialization errors in lib/yara.c Matteo Cafasso (8): daemon: ignore unused return value in upload function daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

...+++ generator/proc_nr.ml | 1 + lib/MAX_PROC_NR | 2 +- 4 files changed, 24 insertions(+), 1 deletion(-) diff --git a/daemon/yara.c b/daemon/yara.c index 0d33d83cd..186a330c1 100644 --- a/daemon/yara.c +++ b/daemon/yara.c @@ -107,6 +107,20 @@ do_yara_load (void) return (ret == ERROR_SUCCESS) ? 0 : -1; } +int +do_yara_destroy (void) +{ + if (rules == NULL) { + reply_with_error ("no yara rules loaded"); + return -1; + } + + yr_rules_destroy (rules); + rules = NULL; + + return 0; +} + /* Compile source code rules and load them. * Return ERROR_SUCCESS on success,...

...//This function return True if log policy is set in registry and False otherwise int isLogEnabled() { HKEY hKey; LONG lRes; DWORD dwType, dwSize = 0; int retVal = 0; if((RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\MyCorp", 0, KEY_ALL_ACCESS, &hKey)) == ERROR_SUCCESS) { lRes = RegQueryValueEx(hKey, "SpecialMode", 0, &dwType, NULL, &dwSize ); if(lRes == ERROR_SUCCESS) retVal = 1; RegCloseKey(hKey); } return retVal; } Since I think we don't have registry concept in linux and this funct...

...r_t *szKeyPath, - wchar_t *szValue, - wchar_t *szData, - DWORD *nSize + HKEY hHive, + wchar_t *szKeyPath, + wchar_t *szValue, + wchar_t *szData, + DWORD *nSize ) { - HKEY hKey; - long lSuccess; - - lSuccess = RegOpenKey ( - hHive, - szKeyPath, - &hKey - ); - - if (lSuccess == ERROR_SUCCESS) { - lSuccess = RegQueryValueEx ( - hKey, - szValue, - NULL, - NULL, - (LPBYTE) szData, - nSize - ); - - if (lSuccess == ERROR_SUCCESS) { - return (TRUE); - } - } - - return (FALSE); + HKEY hKey; + long lSuccess; + + lSuccess = RegOpenKey ( + hHive, + szKeyP...

v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-