Class: Dorothy::Loadmalw

Inherits:
Object
  • Object
show all
Defined in:
lib/dorothy2/do-utils.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(file) ⇒ Loadmalw

Returns a new instance of Loadmalw.



243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
 
# File 'lib/dorothy2/do-utils.rb', line 243

def initialize(file)

  fm = FileMagic.new
  sha = Digest::SHA2.new
  md5 = Digest::MD5.new
  @binpath = file
  @filename = File.basename file
  @extension = File.extname file

  File.open(file, 'rb') do |fh1|
    while buffer1 = fh1.read(1024)
      @sha = sha << buffer1
      @md5 = md5 << buffer1
    end
  end

  @sha = @sha.to_s
  @md5 = @md5.to_s.rstrip
  @sourceinfo = nil

  timetmp = File.ctime(file)
  @ctime= timetmp.strftime("%m/%d/%y %H:%M:%S")
  @type = fm.file(file)

  if @extension.empty?    #no extension, trying to put the right one..
    case @type
      when /^PE32/ then
        @extension = (@type =~ /DLL/ ? ".dll" : ".exe")
      when /^MS-DOS/ then
        @extension = ".bat"
      when /^HTML/ then
        @extension = ".html"
      else
        @extension = nil
    end
  end


  @size = File.size(file)
end

Instance Attribute Details

#binpath ⇒ Object (readonly)

Returns the value of attribute binpath.



229
230
231
 
# File 'lib/dorothy2/do-utils.rb', line 229

def binpath
  @binpath
end

#ctime ⇒ Object (readonly)

Returns the value of attribute ctime.



231
232
233
 
# File 'lib/dorothy2/do-utils.rb', line 231

def ctime
  @ctime
end

#dbtype ⇒ Object (readonly)

Returns the value of attribute dbtype.



226
227
228
 
# File 'lib/dorothy2/do-utils.rb', line 226

def dbtype
  @dbtype
end

#dir_bin ⇒ Object

Returns the value of attribute dir_bin.



239
240
241
 
# File 'lib/dorothy2/do-utils.rb', line 239

def dir_bin
  @dir_bin
end

#dir_downloads ⇒ Object

Returns the value of attribute dir_downloads.



241
242
243
 
# File 'lib/dorothy2/do-utils.rb', line 241

def dir_downloads
  @dir_downloads
end

#dir_pcap ⇒ Object

attr_accessor :dir_home



238
239
240
 
# File 'lib/dorothy2/do-utils.rb', line 238

def dir_pcap
  @dir_pcap
end

#dir_screens ⇒ Object

Returns the value of attribute dir_screens.



240
241
242
 
# File 'lib/dorothy2/do-utils.rb', line 240

def dir_screens
  @dir_screens
end

#extension ⇒ Object (readonly)

Returns the value of attribute extension.



234
235
236
 
# File 'lib/dorothy2/do-utils.rb', line 234

def extension
  @extension
end

#filename ⇒ Object (readonly)

Returns the value of attribute filename.



230
231
232
 
# File 'lib/dorothy2/do-utils.rb', line 230

def filename
  @filename
end

#md5 ⇒ Object (readonly)

Returns the value of attribute md5.



228
229
230
 
# File 'lib/dorothy2/do-utils.rb', line 228

def md5
  @md5
end

#pcaprid ⇒ Object (readonly)

Returns the value of attribute pcaprid.



224
225
226
 
# File 'lib/dorothy2/do-utils.rb', line 224

def pcaprid
  @pcaprid
end

#pcapsize ⇒ Object (readonly)

Returns the value of attribute pcapsize.



233
234
235
 
# File 'lib/dorothy2/do-utils.rb', line 233

def pcapsize
  @pcapsize
end

#sha ⇒ Object

Returns the value of attribute sha.



227
228
229
 
# File 'lib/dorothy2/do-utils.rb', line 227

def sha
  @sha
end

#size ⇒ Object (readonly)

Returns the value of attribute size.



232
233
234
 
# File 'lib/dorothy2/do-utils.rb', line 232

def size
  @size
end

#sourceinfo ⇒ Object

used for storing info about where the binary come from (if needed)



235
236
237
 
# File 'lib/dorothy2/do-utils.rb', line 235

def sourceinfo
  @sourceinfo
end

#type ⇒ Object (readonly)

Returns the value of attribute type.



225
226
227
 
# File 'lib/dorothy2/do-utils.rb', line 225

def type
  @type
end

Class Method Details

.calc_pcaprid(file, size) ⇒ Object 



286
287
288
289
290
291
292
 
# File 'lib/dorothy2/do-utils.rb', line 286

def self.calc_pcaprid(file, size)
  #t = file.split('/')
  #dumpname = t[t.length - 1]
  @pcaprid = Digest::MD5.new
  @pcaprid << "#{file}:#{size}"
  @pcaprid = @pcaprid.dup.to_s.rstrip
end