Spaces:
Sleeping
Sleeping
Add yara endpoint
Browse files
app.py
CHANGED
|
@@ -305,4 +305,45 @@ async def analyse_bin(file_name: str):
|
|
| 305 |
)
|
| 306 |
finally:
|
| 307 |
if os.path.exists(temp_image):
|
| 308 |
-
os.remove(temp_image)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 305 |
)
|
| 306 |
finally:
|
| 307 |
if os.path.exists(temp_image):
|
| 308 |
+
os.remove(temp_image)
|
| 309 |
+
|
| 310 |
+
@app.get("/analyse/yara/{file_name}", response_model=List[Dict])
|
| 311 |
+
async def analyse_yara(file_name: str):
|
| 312 |
+
"""Analyze file using YARA rules from the GitHub repository"""
|
| 313 |
+
sanitized_name = Path(file_name).name
|
| 314 |
+
file_path = os.path.join(UPLOAD_DIR, sanitized_name)
|
| 315 |
+
|
| 316 |
+
if not os.path.exists(file_path):
|
| 317 |
+
raise HTTPException(
|
| 318 |
+
status_code=status.HTTP_404_NOT_FOUND,
|
| 319 |
+
detail="File not found"
|
| 320 |
+
)
|
| 321 |
+
|
| 322 |
+
if not app.state.yara_rules:
|
| 323 |
+
raise HTTPException(
|
| 324 |
+
status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
|
| 325 |
+
detail="YARA rules not available"
|
| 326 |
+
)
|
| 327 |
+
|
| 328 |
+
try:
|
| 329 |
+
matches = await run_in_threadpool(
|
| 330 |
+
app.state.yara_rules.match,
|
| 331 |
+
file_path
|
| 332 |
+
)
|
| 333 |
+
return [{
|
| 334 |
+
"rule": match.rule,
|
| 335 |
+
"namespace": match.namespace,
|
| 336 |
+
"tags": match.tags,
|
| 337 |
+
"meta": match.meta,
|
| 338 |
+
"strings": [{
|
| 339 |
+
"offset": s[0],
|
| 340 |
+
"identifier": s[1],
|
| 341 |
+
"data": s[2].decode('utf-8', errors='replace')
|
| 342 |
+
} for s in match.strings]
|
| 343 |
+
} for match in matches]
|
| 344 |
+
except Exception as e:
|
| 345 |
+
logger.error(f"YARA analysis failed: {str(e)}")
|
| 346 |
+
raise HTTPException(
|
| 347 |
+
status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
|
| 348 |
+
detail="YARA analysis failed"
|
| 349 |
+
)
|