Skip to content

Commit 936e6ec

Browse files
committed
small bugfixes and readme update
1 parent d0b63c6 commit 936e6ec

File tree

2 files changed

+25
-20
lines changed

2 files changed

+25
-20
lines changed

README.md

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -81,13 +81,16 @@ advancedparameters:
8181
maxScanFilesize: 2048 # ignore files up to maxScanFileSize Mb (default: 2048)
8282
cleanMemoryIfFileGreaterThanSize: 512 # clean fastfinder internal memory after heavy file scan (default: 512Mb)
8383
```
84-
### Note for input path:
85-
* '?' for simple char and '\\*' (eg. powershe??.exe) for multiple chars (eg. \\*.exe) wildcards are available for simple string
86-
* environment variables are also available (eg. %TEMP%\\\*.exe)
87-
* regular expression are allowed , they should be enclosed by /<regex>/
84+
### Search everywhere or in specified paths:
85+
* use '?' in paths for simple char wildcard (eg. powershe??.exe)
86+
* use '\\*' in paths for multiple chars wildcard (eg. \\*.exe)
87+
* regular expressions are also available , just enclose paths with slashes (eg. /[0-9]{8}\\.exe/)
88+
* environment variables can also be used (eg. %TEMP%\\myfile.exe)
89+
90+
### Important notes
8891
* input path are always case INSENSITIVE
89-
* input content grep strings are always case SENSITIVE
90-
* backslashes haven't to be escaped on simple string pattern
92+
* content search on string (grep) are always case SENSITIVE
93+
* backslashes SHOULD NOT be escaped (except with regular expressions)
9194
For more informations, take a look at the [examples](./examples)
9295

9396
## About this project

finder.go

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -77,22 +77,24 @@ func FindInFilesContent(files *[]string, patterns []string, rules *yara.Rules, h
7777
}
7878

7979
// yara scan on file content
80-
yaraResult, err := PerformYaraScan(&b, rules)
81-
if err != nil {
82-
LogMessage(LOG_ERROR, "(ERROR)", "Error performing yara scan on", path, err)
83-
continue
84-
}
80+
if rules != nil && len(rules.GetRules()) > 0 {
81+
yaraResult, err := PerformYaraScan(&b, rules)
82+
if err != nil {
83+
LogMessage(LOG_ERROR, "(ERROR)", "Error performing yara scan on", path, err)
84+
continue
85+
}
8586

86-
if len(yaraResult) > 0 && !Contains(matchingFiles, path) {
87-
matchingFiles = append(matchingFiles, path)
88-
}
87+
if len(yaraResult) > 0 && !Contains(matchingFiles, path) {
88+
matchingFiles = append(matchingFiles, path)
89+
}
8990

90-
// output yara match results
91-
for i := 0; i < len(yaraResult); i++ {
92-
LogMessage(LOG_ALERT, "(ALERT)", "YARA match:")
93-
LogMessage(LOG_ALERT, " | path:", path)
94-
LogMessage(LOG_ALERT, " | rule namespace:", yaraResult[i].Namespace)
95-
LogMessage(LOG_ALERT, " | rule name:", yaraResult[i].Rule)
91+
// output yara match results
92+
for i := 0; i < len(yaraResult); i++ {
93+
LogMessage(LOG_ALERT, "(ALERT)", "YARA match:")
94+
LogMessage(LOG_ALERT, " | path:", path)
95+
LogMessage(LOG_ALERT, " | rule namespace:", yaraResult[i].Namespace)
96+
LogMessage(LOG_ALERT, " | rule name:", yaraResult[i].Rule)
97+
}
9698
}
9799

98100
// if file type is an archive, extract and calculate checksum for every file inside

0 commit comments

Comments
 (0)