Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/undo-ransomware/ransomware_detection.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthias <ilovemilk@wusa.io>2018-12-09 18:17:44 +0300
committerMatthias <ilovemilk@wusa.io>2018-12-09 18:17:44 +0300
commit6c771bd6fc8f18bfeb26eb90aab3d41550cbbc88 (patch)
tree480d1de204432063c46b769e5d2d8ea5ccc55047
parentc80ecc3ba940d848e4e0bc874b455a4b84502449 (diff)
Read data blockwise not everything at once
-rw-r--r--lib/Analyzer/EntropyAnalyzer.php18
-rw-r--r--lib/Analyzer/FileCorruptionAnalyzer.php6
2 files changed, 20 insertions, 4 deletions
diff --git a/lib/Analyzer/EntropyAnalyzer.php b/lib/Analyzer/EntropyAnalyzer.php
index ad913cd..d3c7fdb 100644
--- a/lib/Analyzer/EntropyAnalyzer.php
+++ b/lib/Analyzer/EntropyAnalyzer.php
@@ -169,13 +169,25 @@ class EntropyAnalyzer
*/
protected function calculateEntropyOfFile($node)
{
- $data = $node->getContent();
- if (!$data) {
+ $handle = $node->fopen('r');
+ if (!$handle) {
$this->logger->debug('calculateEntropyOfFile: Getting data failed.', array('app' => Application::APP_ID));
return 0.0;
}
- return $this->entropy->calculateEntropy($data);
+ while (!feof($handle)) {
+ $data = fread($handle, 1024);
+ if (strlen($data) === 1024) {
+ $entropy = $entropy + $this->entropy->calculateEntropy($block);
+ }
+ }
+ fclose($handle);
+
+ if ($entropy >= 0) {
+ return $entopry;
+ } else {
+ return -$entropy;
+ }
}
}
diff --git a/lib/Analyzer/FileCorruptionAnalyzer.php b/lib/Analyzer/FileCorruptionAnalyzer.php
index d5bf092..3f2b3f4 100644
--- a/lib/Analyzer/FileCorruptionAnalyzer.php
+++ b/lib/Analyzer/FileCorruptionAnalyzer.php
@@ -77,7 +77,11 @@ class FileCorruptionAnalyzer
$signatures = FileSignatures::getSignatures();
try {
- $data = $node->getContent();
+ // get the first 1024 bytes
+ $handle = $node->fopen('r');
+ $data = fread($handle, 1024);
+ fclose($handle);
+
$pathInfo = pathinfo($node->getPath());
foreach ($signatures as $signature) {
$isFileCorrupted = true;