public static ScanResults PopulateFileProperties(ScanParameters parameters, char driveLetter, INode node)
{
CancellationToken cancelToken = parameters.CancelToken;
cancelToken.ThrowIfCancellationRequested();
ScanResults results = new ScanResults();
byte[] fileBytes = new byte[0];
if (!node.Streams.Any()) //workaround for no file stream such as with hard links
{
try
{
using (FileStream fsSource = new FileStream(node.FullName,
FileMode.Open, FileAccess.Read))
{
// Read the source file into a byte array.
fileBytes = new byte[fsSource.Length];
int numBytesToRead = (int)fsSource.Length;
int numBytesRead = 0;
while (numBytesToRead > 0)
{
// Read may return anything from 0 to numBytesToRead.
int n = fsSource.Read(fileBytes, numBytesRead, numBytesToRead);
// Break when the end of the file is reached.
if (n == 0)
{
break;
}
numBytesRead += n;
numBytesToRead -= n;
}
numBytesToRead = fileBytes.Length;
}
}
catch
{ }
}
else
{
fileBytes = node.GetBytes().SelectMany(chunk => chunk).ToArray();
cancelToken.ThrowIfCancellationRequested();
}
string yaraIndexFilename = results.PopulateYaraInfo(parameters.YaraParameters);
if (!string.IsNullOrWhiteSpace(yaraIndexFilename))
{
results.YaraDetections = YaraHelper.ScanBytes(fileBytes, yaraIndexFilename);
}
throw new NotImplementedException();
return(results);
}
public string PopulateYaraInfo(List <YaraFilter> yaraFilters)
{
List <string> distinctRulesToRun =
yaraFilters
.SelectMany(yf => yf.ProcessRule(this))
.Distinct()
.OrderBy(s => s)
.ToList();
if (!distinctRulesToRun.Any())
{
distinctRulesToRun =
yaraFilters
.Where(yf => yf.FilterType == YaraFilterType.ElseNoMatch)
.SelectMany(yf => yf.OnMatchRules)
.Distinct()
.ToList();
}
if (!distinctRulesToRun.Any())
{
return(string.Empty);
}
string yaraIndexContents = YaraHelper.MakeYaraIndexFile(distinctRulesToRun);
string indexFileHash = Sha256Helper.GetSha256Hash_Array(Encoding.UTF8.GetBytes(yaraIndexContents));
string yaraIndexFilename = Path.Combine(Path.GetTempPath(), $"{indexFileHash}-index.yar");
if (!File.Exists(yaraIndexFilename))
{
File.WriteAllText(yaraIndexFilename, yaraIndexContents);
}
return(yaraIndexFilename);
}
