types

Documentation

Overview

Package types contain main types used in the API + some minimal logic. They have been gathered here to avoid cyclic dependencies in other parts of the code

Index

• Constants
• func FileDataGetHelp()
• func OperatorFind(name string) (*util.Function, bool)
• func OperatorHelp()
• func OperatorRegister(name string, fun interface{}) error
• type Action
• type Analysis
• type Configuration
  • func (c Configuration) HasPermission(p Permission) bool
  • func (c *Configuration) SetPermission(p Permission, val bool)
• type Env
  • func NewEnv(m *Molly) *Env
  • func (e *Env) Create(name string) (*os.File, *FileData, error)
  • func (e *Env) CreateLog(name string) (*os.File, error)
  • func (e Env) GetFile() string
  • func (e Env) GetSize() uint64
  • func (e Env) HasPermission(p Permission) bool
  • func (e *Env) Mkdir(path string) (*FileData, error)
  • func (e *Env) New(name string, islog bool) (*FileData, error)
  • func (e *Env) PopRule()
  • func (e *Env) PushRule(newrule *Rule)
  • func (e *Env) SetInput(r io.ReadSeeker, d *FileData)
  • func (e *Env) StartRule(rule *Rule)
  • func (e Env) String() string
• type Expression
• type FileData
  • func NewFileData(filename string, parent *FileData) *FileData
  • func (fd FileData) Empty() bool
  • func (fd FileData) Get(name string) (interface{}, bool)
  • func (fd *FileData) GetTime() time.Time
  • func (fd *FileData) RegisterAnalysis(name string, data interface{}, err error)
  • func (fd *FileData) RegisterError(err error)
  • func (fd *FileData) RegisterErrorf(format string, v ...interface{})
  • func (fd *FileData) RegisterWarning(format string, v ...interface{})
  • func (fd *FileData) SetTime(t time.Time)
• type FlatMatch
• type Match
  • func (me *Match) Walk(visitor func(*Match) bool) bool
• type Molly
  • func NewMolly() *Molly
  • func (m *Molly) CreateDir(parent *FileData, name string) (data *FileData, err error)
  • func (m *Molly) CreateFile(parent *FileData, name string, islog bool) (file *os.File, data *FileData, err error)
  • func (m *Molly) New(parent *FileData, name string, isdir, islog bool) (*FileData, error)
• type Permission
• type Report
• type Rule
  • func NewRule(id string) *Rule
• type RuleSet
  • func NewRuleSet() *RuleSet
• type Scope
  • func NewScope(rule *Rule, parent *Scope) *Scope
  • func (s Scope) Get(id string) (Expression, bool)
  • func (s Scope) GetAll() map[string]Expression
  • func (s *Scope) Set(id string, e Expression)

Constants

const (
	ActionModeNormal = 0
	ActionModeIgnore = 1
	ActionModeExit   = 2
	RulePassMin      = 0
	RulePassMax      = 2
)

Functions

func FileDataGetHelp

func FileDataGetHelp()

FileDataGetHelp dump help about the special variables such as $time

func OperatorFind

func OperatorFind(name string) (*util.Function, bool)

OperatorFind finds among registered functions

func OperatorHelp

func OperatorHelp()

OperatorHelp print information about all known operators

func OperatorRegister

func OperatorRegister(name string, fun interface{}) error

OperatorRegister registers a new operator in molly

Types

type Action

type Action struct {
	Mode   int
	Action Expression
}

type Analysis

type Analysis struct {
	Name   string
	Result interface{}
	Error  error
}

Analysis represents results of an analysis performed on a file

type Configuration

type Configuration struct {
	OutDir      string
	MaxDepth    int
	Verbose     bool
	Permissions Permission
	OnMatchRule func(file *FileData, match *Match)
	OnMatchTag  func(file *FileData, tag string)
}

Configuration contains all runtime parameters used by molly

func (Configuration) HasPermission

func (c Configuration) HasPermission(p Permission) bool

HasPermission checks if a permission is set

func (*Configuration) SetPermission

func (c *Configuration) SetPermission(p Permission, val bool)

SetPermission sets or clears a Permission

type Env

type Env struct {

	// Input is valid while we are scanning a file
	Reader  io.ReadSeeker
	Current *FileData

	// Scope is valid while we are scanning a file and a rule
	Scope *Scope
	// contains filtered or unexported fields
}

Env is the current environment during scanning

func NewEnv

func NewEnv(m *Molly) *Env

func (*Env) Create

func (e *Env) Create(name string) (*os.File, *FileData, error)

func (*Env) CreateLog

func (e *Env) CreateLog(name string) (*os.File, error)

CreateLog creates a new log

func (Env) GetFile

func (e Env) GetFile() string

func (Env) GetSize

func (e Env) GetSize() uint64

func (Env) HasPermission

func (e Env) HasPermission(p Permission) bool

func (*Env) Mkdir

func (e *Env) Mkdir(path string) (*FileData, error)

func (*Env) New

func (e *Env) New(name string, islog bool) (*FileData, error)

func (*Env) PopRule

func (e *Env) PopRule()

func (*Env) PushRule

func (e *Env) PushRule(newrule *Rule)

func (*Env) SetInput

func (e *Env) SetInput(r io.ReadSeeker, d *FileData)

func (*Env) StartRule

func (e *Env) StartRule(rule *Rule)

func (Env) String

func (e Env) String() string

type Expression

type Expression interface {
	Eval(env *Env) (Expression, error)
	Simplify() (Expression, error)
}

Expression is a node in the AST

type FileData

type FileData struct {
	Parent *FileData

	Filename    string
	FilenameOut string
	Filesize    int64

	Checksum []byte

	// hierarchy
	Depth       int
	Children    []*FileData
	DuplicateOf *FileData

	// These are filled as we scan the file
	Processed bool
	Matches   []*Match
	Errors    []error
	Warnings  []string
	Logs      []string
	Analyses  map[string]*Analysis
	// contains filtered or unexported fields
}

func NewFileData

func NewFileData(filename string, parent *FileData) *FileData

func (FileData) Empty

func (fd FileData) Empty() bool

func (FileData) Get

func (fd FileData) Get(name string) (interface{}, bool)

Get returns variables associated with this file. These can be referensed in rules as $name or in the actions as {name}

func (*FileData) GetTime

func (fd *FileData) GetTime() time.Time

func (*FileData) RegisterAnalysis

func (fd *FileData) RegisterAnalysis(name string, data interface{}, err error)

func (*FileData) RegisterError

func (fd *FileData) RegisterError(err error)

RegisterError registers an error

func (*FileData) RegisterErrorf

func (fd *FileData) RegisterErrorf(format string, v ...interface{})

RegisterErrorf registers an error

func (*FileData) RegisterWarning

func (fd *FileData) RegisterWarning(format string, v ...interface{})

RegisterWarning registers a warning

func (*FileData) SetTime

func (fd *FileData) SetTime(t time.Time)

type FlatMatch

type FlatMatch struct {
	Rule *Rule `json:"-"` // dont need this for the reports
	Name string
	Vars map[string]interface{}
}

FlatMatch is a flatten version of Match

type Match

type Match struct {
	Rule *Rule
	Vars map[string]interface{}

	Children []*Match
	Parent   *Match `json:"-"` // this will avoid circular marshalling

	FailedChildren []*Rule `json:"-"` // this will avoid circular marshalling
}

Match represents a rule match on a file

func (*Match) Walk

func (me *Match) Walk(visitor func(*Match) bool) bool

Walk visits all the nodes in a tree of matches

type Molly

type Molly struct {
	Config *Configuration
	Rules  *RuleSet

	Files map[string]*FileData
	// FilesByHash is mainly need to ignore duplicate files
	FilesByHash map[string]*FileData
}

Molly represents the context of a molly program

func NewMolly

func NewMolly() *Molly

NewMolly creates a new Molly context

func (*Molly) CreateDir

func (m *Molly) CreateDir(parent *FileData, name string) (data *FileData, err error)

func (*Molly) CreateFile

func (m *Molly) CreateFile(parent *FileData, name string, islog bool) (file *os.File, data *FileData, err error)

func (*Molly) New

func (m *Molly) New(parent *FileData, name string, isdir, islog bool) (*FileData, error)

type Permission

type Permission uint32

Permission defines a molly permission such as the ability to create new files

const (
	Create Permission = 1 << iota
	Execute
)

type Report

type Report struct {
	Files []*FileData
}

Report contains all matches for all files

type Rule

type Rule struct {
	ID       string
	Metadata *util.Register
	Parent   *Rule `json:"-"` // this will avoid circular marshalling

	Children   []*Rule
	Conditions []Expression
	Actions    []Action
	Variables  map[string]Expression
}

Rule defines a single rule

func NewRule

func NewRule(id string) *Rule

NewRule creates a new rule with the given ID

type RuleSet

type RuleSet struct {
	Files map[string][]*Rule
	Top   map[string]*Rule
	Flat  map[string]*Rule
}

RuleSet represents a group of rules parsed from one or more file it also includes the rule hierarchy

func NewRuleSet

func NewRuleSet() *RuleSet

NewRuleSet creates a new set of rules, to be populated by a rule scanner

type Scope

type Scope struct {
	Rule   *Rule
	Parent *Scope
	// contains filtered or unexported fields
}

Scope is the current scope while scanning a file for some rule. Since rules are in hierarchy, so does the scope

func NewScope

func NewScope(rule *Rule, parent *Scope) *Scope

NewScope creates a new scope for a rule

func (Scope) Get

func (s Scope) Get(id string) (Expression, bool)

Get reads a variable from scope or parent scope

func (Scope) GetAll

func (s Scope) GetAll() map[string]Expression

GetAll returns all scope variables

func (*Scope) Set

func (s *Scope) Set(id string, e Expression)

Set writes a variable to the scope