pescanner.py 文件源码

def check_yara(self, data):
        ret = []
        if self.rules:
            yarahits = self.rules.match(data=data)
            if yarahits:
              for hit in yarahits:
                ret.append("YARA: %s" % hit.rule)
                #for key, val in hit.strings.iteritems():
                for (key,stringname,val) in hit.strings:
                    makehex = False
                    for char in val:
                        if char not in string.printable:
                            makehex = True
                            break
                    if makehex == True:
                        ret.append("   %s => %s" % (hex(key), binascii.hexlify(val)))
                    else:
                        ret.append("   %s => %s" % (hex(key), val))
        return '\n'.join(ret)