循环遍历.yar文件进行恶意软件分析的问题
循环遍历.yar文件进行恶意软件分析的问题
提问于 2021-12-08 22:32:53
我将存储库中的一些yara规则克隆到了/home/student/Downloads/yara-forensics/file目录中。下面显示了多个.yar文件。我还有一个名为sample.file的伪造恶意软件文件位于/home/student/Downloads中。我想循环遍历每个.yar文件，只返回与sample.file匹配的.yar文件。
student@desktop:~/Downloads/yara-forensics/file$ ls -l
total 96
-rw-rw-r-- 1 student student 1138 Dec 8 21:18 apple.yar
-rw-rw-r-- 1 student student 6494 Dec 8 21:18 audio.yar
-rw-rw-r-- 1 student student 846 Dec 8 21:18 compressed.yar
-rw-rw-r-- 1 student student 903 Dec 8 21:18 crypto.yar
-rw-rw-r-- 1 student student 178 Dec 8 21:18 dex.yar
-rw-rw-r-- 1 student student 563 Dec 8 21:18 executables.yar
-rw-rw-r-- 1 student student 596 Dec 8 21:18 gif.yar
-rw-rw-r-- 1 student student 344 Dec 8 21:18 gps.yar
-rw-rw-r-- 1 student student 1183 Dec 8 21:18 jpeg.yar
-rw-rw-r-- 1 student student 580 Dec 8 21:18 mem_dumps.yar
-rw-rw-r-- 1 student student 1096 Dec 8 21:18 office.yar
-rw-rw-r-- 1 student student 458 Dec 8 21:18 pdf.yar
-rw-rw-r-- 1 student student 780 Dec 8 21:18 png.yar
-rw-rw-r-- 1 student student 315 Dec 8 21:18 skype.yar
-rw-rw-r-- 1 student student 689 Dec 8 21:18 sqlite.yar
-rw-rw-r-- 1 student student 474 Dec 8 21:18 telegram.yar
-rw-rw-r-- 1 student student 332 Dec 8 21:18 vcard.yar
-rw-rw-r-- 1 student student 8878 Dec 8 21:18 vector.yar
-rw-rw-r-- 1 student student 3636 Dec 8 21:18 video.yar
-rw-rw-r-- 1 student student 1036 Dec 8 21:18 vmware.yar
-rw-rw-r-- 1 student student 491 Dec 8 21:18 win_reg.yar下面是我的剧本。
#!/bin/bash
for file in $(find /home/student/Downloads/yara-forensics/file -name '*.yar');
do test $(yara -c ${file} /home/student/Downloads/sample.file) -gt 0 && echo $file;
done 2>/dev/null问题是它只返回如下所示的一个结果。它至少应该返回6个结果(compressed, executables, crypto, office, vector, and vmware)。我的剧本怎么了？
student@desktop:/dev$ bash yarbash
/home/student/Downloads/yara-forensics/file/executables.yar回答 1
Stack Overflow用户
发布于 2021-12-09 02:23:28
您的命令yara对于除executables.yar之外的所有人都是成功的。如果像这样运行它，就会得到更详细的输出：
#!/bin/bash
prefix=/home/student/Downloads
for file in $prefix/yara-forensics/file/*.yar
do
[ -e "$file" ] || break
echo -n "$file: "
yara -c "$file" "$prefix/sample.file" &&\
echo "success" ||\
echo "failure"
done页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/70282533
复制相关文章
相似问题
腾讯云开发者
