Documentation
¶
Overview ¶
wrap libmagic for easier use in identify module
Index ¶
Constants ¶
View Source
const DefaultMimeMagicFlags = magicmime.MAGIC_ERROR | magicmime.MAGIC_RAW | magicmime.MAGIC_CONTINUE
View Source
const DefaultMimeTypeFlags = magicmime.MAGIC_MIME_TYPE | magicmime.MAGIC_ERROR | magicmime.MAGIC_RAW | magicmime.MAGIC_CONTINUE
including text formats is ~10x more expensive (uncomment for speed up) //| "magicmime.MAGIC_NO_CHECK_TEXT"
View Source
const MAX_INDICATOR_BUFFERED_BYTES_SIZE = 32000
Max size of the start of the file to buffer for identification (32kB)
View Source
const MAX_YARA_SCAN_TIME_SECONDS = 10
Max number of seconds to allow yara to scan a file for.
View Source
const MIN_POINTS = 15
View Source
const MaxRegen = 100
View Source
const POINTS_STRONG = 15
View Source
const POINTS_WEAK = 1
Variables ¶
View Source
var ErrMismatch = errors.New("failed to match id")
Functions ¶
This section is empty.
Types ¶
type Identified ¶
type Identify ¶
type Identify struct {
Version uint32
Id_Mappings []IdMapping
Id_Mappings_Map map[string]IdMapping
Yara_Scanner *yara.Scanner
Rules []struct {
Id string
Extension string
Magic string
MagicC *regexp.Regexp
Mime string
MimeC *regexp.Regexp
}
Refine_Rules []RefinedRule
Indicators []struct {
Id string
Trigger_On []string
RE_Strong []string
RE_StrongC []*regexp.Regexp
RE_Weak []string
RE_WeakC []*regexp.Regexp
}
Trusted_Mimes map[string]string
RefineRulesMapping map[string]refineFunction
// contains filtered or unexported fields
}
func NewIdentify ¶
type MagicWrap ¶
type MagicWrap struct {
// contains filtered or unexported fields
}
func NewMagicWrap ¶
func NewMagicWrap() *MagicWrap
func (*MagicWrap) CalcMagicsFromBytes ¶
Calculate the file magic from a buffer of bytes.
func (*MagicWrap) CalcMagicsFromPath ¶
Calculate the file magic from a filepath.
func (*MagicWrap) CalcMimesFromBytes ¶
Calculate the mime type from a buffer of bytes.
func (*MagicWrap) CalcMimesFromPath ¶
Calculate the mime type from a file path.
type RefinedRule ¶
type YaraScanCallback ¶
type YaraScanCallback struct {
// contains filtered or unexported fields
}
func (*YaraScanCallback) RuleMatching ¶
func (ysc *YaraScanCallback) RuleMatching(curCtx *yara.ScanContext, rule *yara.Rule) (bool, error)
Click to show internal directories.
Click to hide internal directories.