Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/undo-ransomware/ransomware_detection.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthias Held <ilovemilk@wusa.io>2018-09-13 19:29:51 +0300
committerMatthias Held <ilovemilk@wusa.io>2018-09-13 19:29:51 +0300
commit4a1cff97b588e6047168f6d91de92cc6a0d9534f (patch)
tree55961261abf4fb3eb517700d2064750b0e0312c2
parent638143177e906a90ce87fe3f15570f72bd61d7f7 (diff)
Add text file signature exception
Signed-off-by: Matthias Held <matthias.held@uni-konstanz.de>
-rw-r--r--lib/Analyzer/FileCorruptionAnalyzer.php6
-rw-r--r--lib/FileSignatures.php1
-rw-r--r--tests/Unit/Analyzer/FileCorruptionAnalyzerTest.php1
3 files changed, 8 insertions, 0 deletions
diff --git a/lib/Analyzer/FileCorruptionAnalyzer.php b/lib/Analyzer/FileCorruptionAnalyzer.php
index 4e1192c..d5bf092 100644
--- a/lib/Analyzer/FileCorruptionAnalyzer.php
+++ b/lib/Analyzer/FileCorruptionAnalyzer.php
@@ -82,6 +82,12 @@ class FileCorruptionAnalyzer
foreach ($signatures as $signature) {
$isFileCorrupted = true;
if (in_array(strtolower($pathInfo['extension']), $signature['extensions'])) {
+ // txt file extension has no signature, but is not corrupted
+ if (array_key_exists('exists', $signature['signature'])) {
+ if ($signature['signature']['exists'] === false) {
+ return new FileCorruptionResult(false);
+ }
+ }
// starting byte sequence
if (array_key_exists('starting', $signature['signature'])) {
foreach ($signature['signature']['starting']['bytes'] as $bytes) {
diff --git a/lib/FileSignatures.php b/lib/FileSignatures.php
index 5ac2c37..9065677 100644
--- a/lib/FileSignatures.php
+++ b/lib/FileSignatures.php
@@ -76,6 +76,7 @@ class FileSignatures
['mimeType' => '', 'extensions' => ['rtf'], 'signature' => ['starting' => ['offset' => 0, 'bytes' => ['/7b5c72746631/']]]],
['mimeType' => '', 'extensions' => ['mpg', 'mpeg'], 'signature' => ['starting' => ['offset' => 0, 'bytes' => ['/000001ba/', '/47/', '/000001b3/']]]],
['mimeType' => '', 'extensions' => ['mp4'], 'signature' => ['starting' => ['offset' => 0, 'bytes' => ['/00000018667479706d703432/']]]],
+ ['mimeType' => '', 'extensions' => ['txt'], 'signature' => ['exists' => false]]],
];
/**
diff --git a/tests/Unit/Analyzer/FileCorruptionAnalyzerTest.php b/tests/Unit/Analyzer/FileCorruptionAnalyzerTest.php
index 0bc0f40..b5d97a1 100644
--- a/tests/Unit/Analyzer/FileCorruptionAnalyzerTest.php
+++ b/tests/Unit/Analyzer/FileCorruptionAnalyzerTest.php
@@ -103,6 +103,7 @@ class FileCorruptionAnalyzerTest extends TestCase
['data' => 'ffd8ffe000104a46494600ffff', 'extension' => 'jpg', 'result' => true],
['data' => '25504446ff0d2525454f460d', 'extension' => 'pdf', 'result' => false],
['data' => 'ffff', 'extension' => 'jpg', 'result' => true],
+ ['data' => 'iamgroot', 'extension' => 'txt', 'result' => false],
];
}