Displaying 20 results from an estimated 37 matches for "internal_yara_scan".
2017 Apr 24
0
[PATCH v8 6/8] New API: internal_yara_scan
The internal_yara_scan runs the Yara engine with the previously loaded
rules against the given file.
For each rule matching against the scanned file, a struct containing
the file name and the rule identifier is returned.
The gathered list of yara_detection structs is serialised into XDR format
and written to a file.
S...
2017 Apr 06
0
[PATCH v6 5/7] New API: internal_yara_scan
The internal_yara_scan runs the Yara engine with the previously loaded
rules against the given file.
For each rule matching against the scanned file, a struct containing
the file name and the rule identifier is returned.
The gathered list of yara_detection structs is serialised into XDR format
and written to a file.
S...
2017 Apr 04
0
[PATCH v5 5/7] New API: internal_yara_scan
The internal_yara_scan runs the Yara engine with the previously loaded
rules against the given file.
For each rule matching against the scanned file, a struct containing
the file name and the rule identifier is returned.
The gathered list of yara_detection structs is serialised into XDR format
and written to a file.
S...
2016 Nov 22
0
Re: [PATCH v2 4/6] New API: internal_yara_scan
Ok on most of the comments, only few notes on the last one.
On 22/11/16 11:04, Pino Toscano wrote:
> On Wednesday, 9 November 2016 22:38:55 CET Matteo Cafasso wrote:
>> The internal_yara_scan runs the Yara engine with the previously loaded
>> rules against the given file.
>>
>> For each rule matching against the scanned file, a struct containing
>> the file name and the rule identifier is returned.
>>
>> The gathered list of yara_detection structs is...
2016 Nov 09
0
[PATCH v2 4/6] New API: internal_yara_scan
The internal_yara_scan runs the Yara engine with the previously loaded
rules against the given file.
For each rule matching against the scanned file, a struct containing
the file name and the rule identifier is returned.
The gathered list of yara_detection structs is serialised into XDR format
and written to a file.
S...
2016 Nov 24
1
Re: [PATCH v2 4/6] New API: internal_yara_scan
On Tuesday, 22 November 2016 19:41:10 CET noxdafox wrote:
> > yara_load supports loading rules already compiled, which could have a
> > namespace set -- I guess it should be reported here as well.
> The namespace is accessible via the YR_RULE struct:
> https://github.com/VirusTotal/yara/blob/master/libyara/include/yara/types.h#L242
>
> Yet is nowere to be found in the C
2016 Nov 22
2
Re: [PATCH v2 4/6] New API: internal_yara_scan
On Wednesday, 9 November 2016 22:38:55 CET Matteo Cafasso wrote:
> The internal_yara_scan runs the Yara engine with the previously loaded
> rules against the given file.
>
> For each rule matching against the scanned file, a struct containing
> the file name and the rule identifier is returned.
>
> The gathered list of yara_detection structs is serialised into XDR fo...
2017 Jul 29
5
[PATCH 1/1] New partition API: part_resize
...em
+afterwards, but when shrinking, you need to shrink the filesystem
+before the partition." };
+
]
diff --git a/generator/proc_nr.ml b/generator/proc_nr.ml
index dec02f5fa..7895063b6 100644
--- a/generator/proc_nr.ml
+++ b/generator/proc_nr.ml
@@ -484,6 +484,7 @@ let proc_nr = [
474, "internal_yara_scan";
475, "file_architecture";
476, "list_filesystems";
+477, "part_resize";
]
(* End of list. If adding a new entry, add it at the end of the list
diff --git a/lib/MAX_PROC_NR b/lib/MAX_PROC_NR
index b86395733..bf2c10d23 100644
--- a/lib/MAX_PROC_NR
+++ b/lib...
2016 Nov 09
9
[PATCH v2 0/6] Feature: Yara file scanning
...yara initialization and finalization
- Import CLEANUP_FCLOSE
- Add custom CLEANUP_DESTROY_YARA_COMPILER
- Add rules compilation error callback
- Other small fixes according to comments
Matteo Cafasso (6):
appliance: add yara dependency
New API: yara_load
New API: yara_destroy
New API: internal_yara_scan
New API: yara_scan
yara_scan: added API tests
appliance/packagelist.in | 4 +
configure.ac | 1 +
daemon/Makefile.am | 4 +-
daemon/cleanups.c | 28 +++
daemon/cleanups.h |...
2017 Apr 23
11
[PATCH v7 0/7] Feature: Yara file scanning
v7:
- Fixes according to comments
- Rebase on top of 1.37.12
Matteo Cafasso (7):
daemon: expose file upload logic
appliance: add yara dependency
New API: yara_load
New API: yara_destroy
New API: internal_yara_scan
New API: yara_scan
yara_scan: added API tests
appliance/packagelist.in | 4 +
configure.ac | 1 +
daemon/Makefile.am | 4 +-
daemon/cleanups.c | 9 +
daemon/cleanups.h | 2...
2017 Apr 25
8
[PATCH v9 0/7] Feature: Yara file scanning
v9:
- fixes according to comments
Matteo Cafasso (7):
daemon: expose file upload logic
appliance: add yara dependency
New API: yara_load
New API: yara_destroy
New API: internal_yara_scan
New API: yara_scan
yara_scan: added API tests
appliance/packagelist.in | 4 +
configure.ac | 1 +
daemon/Makefile.am | 4 +-
daemon/cleanups.c | 9 +
daemon/cleanups.h | 2...
2016 Dec 18
6
[PATCH v3 0/6] Feature: Yara file scanning
...o load multiple rule files
- added optional namespace parameter to yara_load
- move destructor logic in yara module
- use generic file upload logic
- use generic temporary path function
Matteo Cafasso (6):
appliance: add yara dependency
New API: yara_load
New API: yara_destroy
New API: internal_yara_scan
New API: yara_scan
yara_scan: added API tests
appliance/packagelist.in | 4 +
configure.ac | 1 +
daemon/Makefile.am | 4 +-
daemon/cleanups.c | 9 +
daemon/cleanups.h | 2...
2017 Jul 30
0
Re: [PATCH 1/1] New partition API: part_resize
...to shrink the filesystem
> +before the partition." };
> +
> ]
> diff --git a/generator/proc_nr.ml b/generator/proc_nr.ml
> index dec02f5fa..7895063b6 100644
> --- a/generator/proc_nr.ml
> +++ b/generator/proc_nr.ml
> @@ -484,6 +484,7 @@ let proc_nr = [
> 474, "internal_yara_scan";
> 475, "file_architecture";
> 476, "list_filesystems";
> +477, "part_resize";
> ]
>
> (* End of list. If adding a new entry, add it at the end of the list
> diff --git a/lib/MAX_PROC_NR b/lib/MAX_PROC_NR
> index b86395733..bf2c10d2...
2016 Nov 02
8
[PATCH 0/6] Feature: Yara file scanning
...?)
- yara_scan_inode: use TSK to scan files by inodes allowing to scan deleted or hidden files
Code ready for review, available here:
https://github.com/noxdafox/libguestfs/tree/yara
Matteo Cafasso (6):
appliance: add libyara dependency
New API: yara_load
New API: yara_destroy
New API: internal_yara_scan
New API: yara_scan
yara_scan: added API tests
appliance/packagelist.in | 1 +
configure.ac | 1 +
daemon/Makefile.am | 4 +-
daemon/yara.c | 318 +++++++++++++++++++++++++++++++
generator/action...
2017 Apr 04
13
[PATCH v5 0/7] Feature: Yara file scanning
v5:
- rebase on top of 1.37.9
- add missing actions_yara.* files
Matteo Cafasso (7):
daemon: expose file upload logic
appliance: add yara dependency
New API: yara_load
New API: yara_destroy
New API: internal_yara_scan
New API: yara_scan
yara_scan: added API tests
appliance/packagelist.in | 4 +
configure.ac | 1 +
daemon/Makefile.am | 4 +-
daemon/cleanups.c | 9 +
daemon/cleanups.h | 2...
2017 Apr 24
10
[PATCH v8 0/8] Feature: Yara file scanning
v8:
- Ignore returned value in daemon/upload.c
- Report serialization errors in lib/yara.c
Matteo Cafasso (8):
daemon: ignore unused return value in upload function
daemon: expose file upload logic
appliance: add yara dependency
New API: yara_load
New API: yara_destroy
New API: internal_yara_scan
New API: yara_scan
yara_scan: added API tests
appliance/packagelist.in | 4 +
configure.ac | 1 +
daemon/Makefile.am | 4 +-
daemon/cleanups.c | 9 +
daemon/cleanups.h | 2...
2017 Feb 19
9
[PATCH v3 0/7] Feature: Yara file scanning
Rebase patches on top of 1.35.25.
No changes since last series.
Matteo Cafasso (7):
daemon: expose file upload logic
appliance: add yara dependency
New API: yara_load
New API: yara_destroy
New API: internal_yara_scan
New API: yara_scan
yara_scan: added API tests
appliance/packagelist.in | 4 +
configure.ac | 1 +
daemon/Makefile.am | 4 +-
daemon/cleanups.c | 9 +
daemon/cleanups.h | 2...
2017 Apr 06
14
[PATCH v6 0/7] Feature: Yara file scanning
...to use the yarac tool.
This makes the yara_load API more similar to the yara workflow.
- further small fixes according to the v5 comments
After further
Matteo Cafasso (7):
daemon: expose file upload logic
appliance: add yara dependency
New API: yara_load
New API: yara_destroy
New API: internal_yara_scan
New API: yara_scan
yara_scan: added API tests
appliance/packagelist.in | 4 +
configure.ac | 1 +
daemon/Makefile.am | 4 +-
daemon/cleanups.c | 9 +
daemon/cleanups.h | 2...
2017 Mar 12
8
[PATCH v4 0/7] Feature: Yara file scanning
Rebase patches on top of 1.37.1.
No changes since last series.
Matteo Cafasso (7):
daemon: expose file upload logic
appliance: add yara dependency
New API: yara_load
New API: yara_destroy
New API: internal_yara_scan
New API: yara_scan
yara_scan: added API tests
appliance/packagelist.in | 4 +
configure.ac | 1 +
daemon/Makefile.am | 4 +-
daemon/cleanups.c | 9 +
daemon/cleanups.h | 2...
2016 Nov 09
0
[PATCH v2 5/6] New API: yara_scan
...daemon counterpart
function and returns the list of yara_detection structs to the user.
It writes the daemon's command output on a temporary file and parses it,
deserialising the XDR formatted yara_detection structs.
It returns to the caller the list of yara_detection structs generated by
the internal_yara_scan command.
Signed-off-by: Matteo Cafasso <noxdafox@gmail.com>
---
generator/actions.ml | 25 +++++++++
src/Makefile.am | 1 +
src/yara.c | 140 +++++++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 166 insertions(+)
create mode 100644 src/yara.c
diff --git a...