<s> """<STR_LIT>""" <EOL> import os <EOL> import sys <EOL> import errno <EOL> import logging <EOL> import argparse <EOL> import binascii <EOL> import yara <EOL> class ProcessorException ( Exception ) : <EOL> pass <EOL> class Processor ( object ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self , rule_files , processing_mode = '<STR_LIT>' , <EOL> compiled = False , ** kwargs ) : <EOL> """<STR_LIT>""" <EOL> self . logger = logging . getLogger ( '<STR_LIT>' ) <EOL> for f in rule_files : <EOL> if os . path . isfile ( f ) : <EOL> try : <EOL> with open ( f ) : <EOL> pass <EOL> except IOError : <EOL> raise IOError ( ( errno . EACCES , '<STR_LIT>' , f ) ) <EOL> else : <EOL> raise IOError ( ( errno . ENOENT , '<STR_LIT>' , f ) ) <EOL> if not compiled : <EOL> self . _rule_files = self . _prepare_rules ( rule_files ) <EOL> try : <EOL> self . _rules = yara . compile ( filepaths = self . _rule_files ) <EOL> except yara . SyntaxError as e : <EOL> err = ( '<STR_LIT>' <EOL> '<STR_LIT>' % e ) <EOL> raise ProcessorException ( err ) <EOL> except yara . Error : <EOL> raise <EOL> else : <EOL> try : <EOL> assert ( len ( rule_files ) == <NUM_LIT:1> ) <EOL> except AssertionError : <EOL> err = ( '<STR_LIT>' <EOL> '<STR_LIT>' ) <EOL> raise ProcessorException ( err ) <EOL> self . _rule_files = rule_files [ <NUM_LIT:0> ] <EOL> try : <EOL> self . _rules = yara . load ( self . _rule_files ) <EOL> except yara . Error as e : <EOL> err = ( '<STR_LIT>' <EOL> '<STR_LIT>' % e ) <EOL> raise ProcessorException ( err ) <EOL> self . _allowed_modes = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> if not processing_mode . lower ( ) in self . _allowed_modes : <EOL> raise ProcessorException ( "<STR_LIT>" % processing_mode ) <EOL> self . _processing_mode = processing_mode <EOL> self . _buffer_size = kwargs . get ( '<STR_LIT>' , <NUM_LIT> ) <EOL> self . _window_step = kwargs . get ( '<STR_LIT>' , <NUM_LIT:1> ) <EOL> if self . _processing_mode == '<STR_LIT>' : <EOL> self . _window_step = self . _buffer_size <EOL> self . _raw_results = [ ] <EOL> self . _formatted_results = [ ] <EOL> self . data = '<STR_LIT>' <EOL> self . _current = '<STR_LIT>' <EOL> self . _next = None <EOL> self . _window_index = <NUM_LIT:0> <EOL> self . _offset = <NUM_LIT:0> <EOL> def __str__ ( self ) : <EOL> """<STR_LIT>""" <EOL> s = '<STR_LIT>' + __name__ <EOL> if self . _rule_files : <EOL> s += '<STR_LIT>' + '<STR_LIT:U+0020>' . join ( self . _rule_files . values ( ) ) <EOL> return s <EOL> def _prepare_rules ( self , rules ) : <EOL> """<STR_LIT>""" <EOL> results = { } <EOL> for i , fn in enumerate ( rules ) : <EOL> results [ '<STR_LIT>' % i ] = fn <EOL> return results <EOL> def _window ( self , sequence , size = <NUM_LIT:2> , step = <NUM_LIT:1> ) : <EOL> """<STR_LIT>""" <EOL> i = <NUM_LIT:0> <EOL> while True : <EOL> result = sequence [ i : i + size ] <EOL> if not result : <EOL> break <EOL> else : <EOL> i = i + step <EOL> yield result <EOL> def analyze ( self , data = None ) : <EOL> """<STR_LIT>""" <EOL> if not data : <EOL> data = self . data <EOL> for r in self . _rules . match ( data = data ) : <EOL> result = { '<STR_LIT:result>' : r . rule , <EOL> '<STR_LIT>' : [ ] , <EOL> '<STR_LIT>' : '<STR_LIT>' } <EOL> for s in r . strings : <EOL> result [ '<STR_LIT>' ] . append ( { '<STR_LIT>' : self . _offset + s [ <NUM_LIT:0> ] , <EOL> '<STR_LIT>' : s [ <NUM_LIT:1> ] , <EOL> '<STR_LIT:string>' : binascii . hexlify ( s [ <NUM_LIT:2> ] ) } ) <EOL> self . _raw_results . append ( r ) <EOL> self . _formatted_results . append ( result ) <EOL> if self . _processing_mode == '<STR_LIT>' : <EOL> self . _offset += len ( data ) <EOL> return self . results <EOL> @ property <EOL> def results ( self ) : <EOL> """<STR_LIT>""" <EOL> return self . _formatted_results <EOL> def clear_results ( self ) : <EOL> """<STR_LIT>""" <EOL> self . _raw_results = [ ] <EOL> self . _formatted_results = [ ] <EOL> @ property <EOL> def data ( self ) : <EOL> """<STR_LIT>""" <EOL> return self . _current <EOL> @ data . setter <EOL> def data ( self , value ) : <EOL> """<STR_LIT>""" <EOL> self . _current = value <EOL> if self . _processing_mode != '<STR_LIT>' : <EOL> if self . _current and len ( self . _current [ self . _window_index : ] ) >= self . _buffer_size : <EOL> for chunk in self . _window ( self . _current [ self . _window_index : ] , <EOL> size = self . _buffer_size , <EOL> step = self . _window_step ) : <EOL> self . analyze ( '<STR_LIT>' . join ( chunk ) ) <EOL> if self . _processing_mode == '<STR_LIT>' : <EOL> self . _offset += len ( chunk ) <EOL> elif self . _processing_mode == '<STR_LIT>' : <EOL> self . _offset += self . _window_step <EOL> self . _window_index = len ( self . _current ) <EOL> if __name__ == '<STR_LIT:__main__>' : <EOL> """<STR_LIT>""" <EOL> logger = logging . getLogger ( '<STR_LIT>' ) <EOL> logger . setLevel ( logging . DEBUG ) <EOL> consoleHandler = logging . StreamHandler ( stream = sys . stdout ) <EOL> consoleHandler . setFormatter ( logging . Formatter ( <EOL> '<STR_LIT>' ) ) <EOL> logger . addHandler ( consoleHandler ) <EOL> parser = argparse . ArgumentParser ( description = "<STR_LIT>" ) <EOL> parser . add_argument ( <EOL> '<STR_LIT>' , <EOL> choices = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] , <EOL> default = '<STR_LIT>' , <EOL> help = '<STR_LIT>' ) <EOL> parser . add_argument ( <EOL> '<STR_LIT>' , <EOL> nargs = '<STR_LIT:?>' , <EOL> type = argparse . FileType ( '<STR_LIT:r>' ) , <EOL> required = True , <EOL> help = '<STR_LIT>' ) <EOL> parser . add_argument ( <EOL> '<STR_LIT>' , <EOL> nargs = '<STR_LIT:*>' , <EOL> required = True , <EOL> help = '<STR_LIT>' ) <EOL> parser . add_argument ( <EOL> '<STR_LIT>' , <EOL> action = '<STR_LIT:store_true>' , <EOL> help = '<STR_LIT>' <EOL> ) <EOL> parser . add_argument ( <EOL> '<STR_LIT>' , <EOL> type = int , <EOL> default = <NUM_LIT:5> , <EOL> help = '<STR_LIT>' ) <EOL> parser . add_argument ( <EOL> '<STR_LIT>' , <EOL> type = int , <EOL> default = <NUM_LIT:1> , <EOL> help = '<STR_LIT>' ) <EOL> args = parser . parse_args ( ) <EOL> data = args . input . read ( ) <EOL> logger . debug ( '<STR_LIT>' ) <EOL> for i , each in enumerate ( args . rules ) : <EOL> logger . debug ( '<STR_LIT>' % ( i , each ) ) <EOL> if args . compiled : <EOL> logger . debug ( '<STR_LIT>' ) <EOL> logger . debug ( '<STR_LIT>' % args . mode ) <EOL> if args . mode != '<STR_LIT>' : <EOL> logger . debug ( '<STR_LIT>' % args . size ) <EOL> logger . debug ( '<STR_LIT>' % args . step ) <EOL> p = Processor ( args . rules , processing_mode = args . mode , <EOL> compiled = args . compiled , buffer_size = args . size , <EOL> window_step = args . step ) <EOL> p . data += data <EOL> else : <EOL> p = Processor ( args . rules , compiled = args . compiled ) <EOL> p . data += data <EOL> results = p . analyze ( ) <EOL> if p . results : <EOL> for match in p . results : <EOL> logger . debug ( '<STR_LIT>' , match ) </s>
