Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/undo-ransomware/ransomware_detection.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthias Held <ilovemilk@wusa.io>2018-09-07 23:25:53 +0300
committerMatthias Held <ilovemilk@wusa.io>2018-09-07 23:25:53 +0300
commit205d04733ca6317898650f41974b791788807bf9 (patch)
tree691e9fa90ca4dd429ac10765d3e32acd44dd14dd /lib/Analyzer
parentbfa5a705db67855b7f640dd0ac4289e1614ffb96 (diff)
Fix logical union of starting and trailing signature
Diffstat (limited to 'lib/Analyzer')
-rw-r--r--lib/Analyzer/FileCorruptionAnalyzer.php21
1 files changed, 11 insertions, 10 deletions
diff --git a/lib/Analyzer/FileCorruptionAnalyzer.php b/lib/Analyzer/FileCorruptionAnalyzer.php
index d1075ba..4e1192c 100644
--- a/lib/Analyzer/FileCorruptionAnalyzer.php
+++ b/lib/Analyzer/FileCorruptionAnalyzer.php
@@ -80,28 +80,29 @@ class FileCorruptionAnalyzer
$data = $node->getContent();
$pathInfo = pathinfo($node->getPath());
foreach ($signatures as $signature) {
- $isSignatureMatching = true;
+ $isFileCorrupted = true;
if (in_array(strtolower($pathInfo['extension']), $signature['extensions'])) {
// starting byte sequence
if (array_key_exists('starting', $signature['signature'])) {
foreach ($signature['signature']['starting']['bytes'] as $bytes) {
- if (strtolower($bytes) ===
- strtolower(bin2hex(substr($data, $signature['signature']['starting']['offset'], strlen($bytes) / 2)))) {
- $isSignatureMatching = false;
- }
+ if (preg_match($bytes, strtolower(bin2hex(substr($data, $signature['signature']['starting']['offset'], strlen($bytes) / 2))))) {
+ $isFileCorrupted = false;
+ }
}
}
// trailing byte sequence
if (array_key_exists('trailing', $signature['signature'])) {
+ $trailingIsNotMatching = true;
foreach ($signature['signature']['trailing']['bytes'] as $bytes) {
$trailingOffset = strlen($data) - $signature['signature']['trailing']['offset'] - strlen($bytes) / 2;
- if (strtolower($bytes) !==
- strtolower(bin2hex(substr($data, $trailingOffset, strlen($bytes) / 2)))) {
- $isSignatureMatching = true;
- }
+ if (preg_match($bytes, strtolower(bin2hex(substr($data, $trailingOffset, strlen($bytes) / 2))))) {
+ $trailingIsNotMatching = false;
+ }
}
+ $isFileCorrupted = $isFileCorrupted || $trailingIsNotMatching;
+ return new FileCorruptionResult($isFileCorrupted);
}
- return new FileCorruptionResult($isSignatureMatching);
+ return new FileCorruptionResult($isFileCorrupted);
}
}