19 package org.sleuthkit.autopsy.modules.yara;
22 import java.io.IOException;
23 import java.nio.file.Path;
24 import java.nio.file.Paths;
25 import java.util.ArrayList;
26 import java.util.List;
28 import java.util.concurrent.ConcurrentHashMap;
29 import java.util.logging.Level;
30 import org.apache.commons.lang3.RandomStringUtils;
31 import org.openide.util.NbBundle.Messages;
44 import org.
sleuthkit.datamodel.Blackboard.BlackboardException;
63 private static final Map<Long, Path>
pathsByJobId =
new ConcurrentHashMap<>();
81 "YaraIngestModule_windows_error_msg=The YARA ingest module is only available on 64bit Windows.",})
95 Path tempRuleSetDir = Paths.get(tempDir.toString(),
RULESET_DIR);
96 if(!tempRuleSetDir.toFile().exists()) {
97 tempRuleSetDir.toFile().mkdir();
100 if(settings.hasSelectedRuleSets()) {
103 logger.log(Level.INFO,
"YARA ingest module: No rule set was selected for this ingest job.");
112 Path jobPath = pathsByJobId.get(jobId);
113 if (jobPath != null) {
114 jobPath.toFile().delete();
115 pathsByJobId.remove(jobId);
123 if(!settings.hasSelectedRuleSets()) {
128 String extension = file.getNameExtension();
129 if (!extension.equals(
"exe")) {
135 if (file.getSize() == 0 ||
137 file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) {
142 List<BlackboardArtifact> artifacts =
new ArrayList<>();
143 File ruleSetsDir = Paths.get(
getTempDirectory(jobId).toString(), RULESET_DIR).toFile();
148 byte[] fileBuffer =
new byte[(int)file.getSize()];
150 int dataRead = file.read(fileBuffer, 0, file.getSize());
152 artifacts.addAll( YaraIngestHelper.scanFileForMatches(file, ruleSetsDir, fileBuffer, dataRead, YARA_SCAN_TIMEOUT_SEC));
156 artifacts.addAll( YaraIngestHelper.scanFileForMatches(file, ruleSetsDir, tempCopy, YARA_SCAN_TIMEOUT_SEC));
160 if(!artifacts.isEmpty()) {
166 logger.log(Level.SEVERE, String.format(
"YARA ingest module failed to process file id %d", file.getId()), ex);
168 }
catch(IOException ex) {
169 logger.log(Level.SEVERE, String.format(
"YARA ingest module failed to make a local copy of given file id %d", file.getId()), ex);
187 Path jobPath = pathsByJobId.get(jobId);
188 if (jobPath != null) {
196 throw new IngestModuleException(
"Failed to create YARA ingest model temp directory, no open case.", ex);
200 if (!baseDir.toFile().exists()) {
201 baseDir.toFile().mkdirs();
204 String randomDirName = String.format(
"%s_%d", RandomStringUtils.randomAlphabetic(8),
jobId);
205 jobPath = Paths.get(baseDir.toString(), randomDirName);
206 jobPath.toFile().mkdir();
208 pathsByJobId.put(jobId, jobPath);
224 String tempFileName = RandomStringUtils.randomAlphabetic(15) + file.getId() +
".temp";
static final Logger logger
synchronized long decrementAndGet(long jobId)
ProcessResult process(AbstractFile file)
String getTempDirectory()
File createLocalCopy(AbstractFile file)
final YaraIngestJobSettings settings
boolean onlyExecutableFiles
static final String RULESET_DIR
synchronized long incrementAndGet(long jobId)
static< T > long writeToFile(Content content, java.io.File outputFile, ProgressHandle progress, Future< T > worker, boolean source)
void startUp(IngestJobContext context)
static final int FILE_SIZE_THRESHOLD_BYTE
static final IngestModuleReferenceCounter refCounter
SleuthkitCase getSleuthkitCase()
static final Map< Long, Path > pathsByJobId
synchronized Path getTempDirectory(long jobId)
static final String YARA_DIR
static final int FILE_SIZE_THRESHOLD_MB
synchronized static Logger getLogger(String name)
static Case getCurrentCaseThrows()
List< String > getSelectedRuleSetNames()
static final int YARA_SCAN_TIMEOUT_SEC