vtscan

README

virustotalscan

Provides better virustotal.com support to scan and research files and binaries.

---

To use library just register email and get the key!

Example:

	client, err := Register("your_registered@email.here")

	found, err := client.Check(filebuf)

	if found { some alert }

Documentation

Index

• Constants
• Variables
• type ConnChecker
  • func NewDefferedConnChecker(useLocalVThelper bool, conn net.Conn, vtscan *Vtscan, onalert func(), ...) *ConnChecker
  • func (c *ConnChecker) Close() error
  • func (c *ConnChecker) Conn() net.Conn
  • func (c *ConnChecker) Flush() *Flusher
  • func (c *ConnChecker) LocalAddr() net.Addr
  • func (c *ConnChecker) Read(b []byte) (int, error)
  • func (c *ConnChecker) RemoteAddr() net.Addr
  • func (c *ConnChecker) SetDeadline(t time.Time) error
  • func (c *ConnChecker) SetLogAll(b bool)
  • func (c *ConnChecker) SetLogger(log *zipologger.Logger)
  • func (c *ConnChecker) SetReadDeadline(t time.Time) error
  • func (c *ConnChecker) SetWriteDeadline(t time.Time) error
  • func (c *ConnChecker) Write(b []byte) (int, error)
• type Flusher
  • func (f *Flusher) Run()
• type ServerAnswer
• type Vtscan
  • func Register(email string, server_ip string) (*Vtscan, error)
  • func (v *Vtscan) Check(buf []byte) (bool, error)
  • func (v *Vtscan) FastCheck(connId []byte, dir fcConnDir, packetNum int64, data []byte) (bool, []byte, error)
  • func (v *Vtscan) LastError() error
  • func (v *Vtscan) SocketIsConnected() bool
  • func (v *Vtscan) StartSocketSender()
  • func (v *Vtscan) Token() string

Constants

const (
	FC_CONN_READ  = fcConnDir(1) // server <= client
	FC_CONN_WRITE = fcConnDir(2) // server => client
)

direction of data moving

Variables

var GetServerConn = func() func() *serverConn {
	connLog := zipologger.GetLoggerBySuffix("vtlconn.log", "./logs/", 2, 2, 2, false)

	dialer := net.Dialer{
		Timeout:   time.Millisecond * 500,
		KeepAlive: time.Second * 15,
	}

	port := ":89"

	var sconn = &serverConn{}

	go func() {
		for {

			conn, err := dialer.Dial("tcp", port)
			if err != nil {
				connLog.Printf("error: %s", err.Error())
				time.Sleep(2 * time.Second)
				continue
			}

			sconn.setConn(conn)

			for {
				time.Sleep(2 * time.Second)
				if !sconn.pingpong() {
					sconn.Fail()

					break
				}
			}
		}
	}()

	return func() *serverConn {
		return sconn
	}
}()

nil if no good connection

Types

type ConnChecker

type ConnChecker struct {
	// contains filtered or unexported fields
}

func NewDefferedConnChecker

func NewDefferedConnChecker(useLocalVThelper bool, conn net.Conn, vtscan *Vtscan, onalert func(), onerror func(err error)) *ConnChecker

Creates MITM conn, called deffered alert if something found

func (*ConnChecker) Close

func (c *ConnChecker) Close() error

func (*ConnChecker) Conn

func (c *ConnChecker) Conn() net.Conn

net.Conn if needed

func (*ConnChecker) Flush

func (c *ConnChecker) Flush() *Flusher

flushes current checks to server and wait till em ends stop launch for new to continue checking call .Run()

func (*ConnChecker) LocalAddr

func (c *ConnChecker) LocalAddr() net.Addr

func (*ConnChecker) Read

func (c *ConnChecker) Read(b []byte) (int, error)

from conn to buffer

func (*ConnChecker) RemoteAddr

func (c *ConnChecker) RemoteAddr() net.Addr

func (*ConnChecker) SetDeadline

func (c *ConnChecker) SetDeadline(t time.Time) error

func (*ConnChecker) SetLogAll

func (c *ConnChecker) SetLogAll(b bool)

func (*ConnChecker) SetLogger

func (c *ConnChecker) SetLogger(log *zipologger.Logger)

func (*ConnChecker) SetReadDeadline

func (c *ConnChecker) SetReadDeadline(t time.Time) error

func (*ConnChecker) SetWriteDeadline

func (c *ConnChecker) SetWriteDeadline(t time.Time) error

func (*ConnChecker) Write

func (c *ConnChecker) Write(b []byte) (int, error)

to conn

type Flusher

type Flusher struct {
	// contains filtered or unexported fields
}

func (*Flusher) Run

func (f *Flusher) Run()

continue work after flush

type ServerAnswer

type ServerAnswer struct {
	Status  string
	Message string
	Record  struct {
		Token string
	}
}

type Vtscan

type Vtscan struct {
	// contains filtered or unexported fields
}

func Register

func Register(email string, server_ip string) (*Vtscan, error)

Register client instance by email server_ip - only for raw socket data, if paid

func (*Vtscan) Check

func (v *Vtscan) Check(buf []byte) (bool, error)

Sends to the server file or buffer to scan for known signatures.

Based on server answer:

200 OK 		- nothing found

403 EXPIRED - token is expired
403 DENIED  - access denied

200 SUSPICIOUS 	- Suspicious file
200 FOUND 	- Signature found

415 INCORRECTBUFFER - Incorrect buffer (too huge or absent)
500 ERROR 	- Some error on server

Returns:

true if something found with description

func (*Vtscan) FastCheck

func (v *Vtscan) FastCheck(connId []byte, dir fcConnDir, packetNum int64, data []byte) (bool, []byte, error)

Sends to the server file or buffer to scan for known signatures.

Protocol:

[16] connId: google's UUID to determinate unique connection [1] dir: fcConnDir [8] packetNum: counter of sended packets [4] dl bytes: data len [dl]: data to check

Returns:

true if something found with description

func (*Vtscan) LastError

func (v *Vtscan) LastError() error

func (*Vtscan) SocketIsConnected

func (v *Vtscan) SocketIsConnected() bool

func (*Vtscan) StartSocketSender

func (v *Vtscan) StartSocketSender()

start raw socket listener

func (*Vtscan) Token

func (v *Vtscan) Token() string