Skip to content

Commit

Permalink
plugins/crypto_hints: Use analysis.PluginV0
Browse files Browse the repository at this point in the history
  • Loading branch information
maringuu committed Jun 15, 2023
1 parent 4449548 commit 6f3cd87
Showing 1 changed file with 30 additions and 7 deletions.
37 changes: 30 additions & 7 deletions src/plugins/analysis/crypto_hints/code/crypto_hints.py
Original file line number Diff line number Diff line change
@@ -1,10 +1,33 @@
from analysis.YaraPluginBase import YaraBasePlugin
import io

import pydantic

class AnalysisPlugin(YaraBasePlugin):
import plugins.analysis.compat
from plugins import analysis
from plugins.analysis import addons

NAME = 'crypto_hints'
DESCRIPTION = 'find indicators of specific crypto algorithms'
DEPENDENCIES = []
VERSION = '0.1.1'
FILE = __file__

class AnalysisPlugin(analysis.PluginV0, analysis.compat.AnalysisBasePluginAdapterMixin):
class Schema(pydantic.BaseModel):
matches: list[dict]

def __init__(self):
metadata = analysis.PluginV0.MetaData(
name='crypto_hints',
description='find indicators of specific crypto algorithms',
version='0.2.0',
Schema=AnalysisPlugin.Schema,
)
super().__init__(metadata=metadata)

self._yara = addons.Yara(plugin=self)

def summarize(self, result):
del result
return []

def analyze(self, file_handle: io.FileIO, virtual_file_path: str, analyses: dict) -> Schema:
del virtual_file_path, analyses
return AnalysisPlugin.Schema(
matches=[analysis.compat.yara_match_to_dict(m) for m in self._yara.match(file_handle)],
)

0 comments on commit 6f3cd87

Please sign in to comment.