retdec
Public Member Functions | Private Types | Private Attributes | List of all members
retdec::fileinfo::PatternDetector Class Reference

#include <pattern_detector.h>

Collaboration diagram for retdec::fileinfo::PatternDetector:
Collaboration graph
[legend]

Public Member Functions

 PatternDetector (const retdec::fileformat::FileFormat *fparser, FileInformation &finfo)
 
Detection methods
void addFilePaths (const std::string &category, const std::set< std::string > &paths)
 
void analyze ()
 

Private Types

using patternCategoriesIterator = std::vector< std::pair< std::string, std::set< std::string > >>::const_iterator
 

Private Member Functions

Iterators
patternCategoriesIterator begin () const
 
patternCategoriesIterator end () const
 
Auxiliary methods
void createPatternFromRule (Pattern &pattern, const yaracpp::YaraRule &rule)
 
void saveCryptoRule (const yaracpp::YaraRule &rule)
 
void saveMalwareRule (const yaracpp::YaraRule &rule)
 
void saveOtherRule (const yaracpp::YaraRule &rule)
 

Private Attributes

const retdec::fileformat::FileFormatfileParser
 parser of input file More...
 
FileInformationfileinfo
 information about input file More...
 
std::vector< std::pair< std::string, std::set< std::string > > > categories
 paths to YARA rules More...
 

Detailed Description

Detector of YARA patterns

Member Typedef Documentation

◆ patternCategoriesIterator

using retdec::fileinfo::PatternDetector::patternCategoriesIterator = std::vector<std::pair<std::string, std::set<std::string> >>::const_iterator
private

Constructor & Destructor Documentation

◆ PatternDetector()

retdec::fileinfo::PatternDetector::PatternDetector ( const retdec::fileformat::FileFormat fparser,
FileInformation finfo 
)

Constructor

Parameters
fparserPointer to file parser
finfoReference to information about input file

Member Function Documentation

◆ addFilePaths()

void retdec::fileinfo::PatternDetector::addFilePaths ( const std::string &  category,
const std::set< std::string > &  paths 
)

Add paths to files with YARA patterns

Parameters
categoryName of YARA patterns category (e.g. malware, crypto)
pathsSet of paths to files and/or directories with YARA pattern files. From directory is taken every file with .yar or .yara extension.

◆ analyze()

void retdec::fileinfo::PatternDetector::analyze ( )

Analyze input file and try to find YARA patterns

◆ begin()

PatternDetector::patternCategoriesIterator retdec::fileinfo::PatternDetector::begin ( ) const
private

Get begin iterator

Returns
Begin iterator

◆ createPatternFromRule()

void retdec::fileinfo::PatternDetector::createPatternFromRule ( Pattern pattern,
const yaracpp::YaraRule rule 
)
private

Create pattern from YARA rule

Parameters
patternInto this parameter is stored resulted pattern
ruleDetected YARA rule

◆ end()

PatternDetector::patternCategoriesIterator retdec::fileinfo::PatternDetector::end ( ) const
private

Get end iterator

Returns
End iterator

◆ saveCryptoRule()

void retdec::fileinfo::PatternDetector::saveCryptoRule ( const yaracpp::YaraRule rule)
private

Save detected cryptography rule

Parameters
ruleDetected cryptography rule

◆ saveMalwareRule()

void retdec::fileinfo::PatternDetector::saveMalwareRule ( const yaracpp::YaraRule rule)
private

Save detected cryptography rule

Parameters
ruleDetected cryptography rule

◆ saveOtherRule()

void retdec::fileinfo::PatternDetector::saveOtherRule ( const yaracpp::YaraRule rule)
private

Save detected cryptography rule

Parameters
ruleDetected cryptography rule

Member Data Documentation

◆ categories

std::vector<std::pair<std::string, std::set<std::string> > > retdec::fileinfo::PatternDetector::categories
private

paths to YARA rules

◆ fileinfo

FileInformation& retdec::fileinfo::PatternDetector::fileinfo
private

information about input file

◆ fileParser

const retdec::fileformat::FileFormat* retdec::fileinfo::PatternDetector::fileParser
private

parser of input file


The documentation for this class was generated from the following files: