initial commit

.gitignore

@@ -0,0 +1,59 @@
+### https://raw.github.com/github/gitignore/e2e54ce6be90a3ca9c1da57031dc70bf62ed7921/Go.gitignore
+
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+
+### https://raw.github.com/github/gitignore/e2e54ce6be90a3ca9c1da57031dc70bf62ed7921/Global/VisualStudioCode.gitignore
+
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+*.code-workspace
+
+
+### https://raw.github.com/github/gitignore/e2e54ce6be90a3ca9c1da57031dc70bf62ed7921/Global/macOS.gitignore
+
+# General
+.DS_Store
+.AppleDouble
+.LSOverride
+
+# Icon must end with two \r
+Icon
+
+# Thumbnails
+._*
+
+# Files that might appear in the root of a volume
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+
+# Directories potentially created on remote AFP share
+.AppleDB
+.AppleDesktop
+Network Trash Folder
+Temporary Items
+.apdisk
+
+

LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Matt Blewitt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,2 @@
+build: main.go
+	PKG_CONFIG_PATH="$$(brew --prefix yara)/lib/pkgconfig:$$(brew --prefix [email protected])/lib/pkgconfig" go build .

README.md

@@ -0,0 +1,2 @@
+# Slamhound
+_Go on boy, git!_

go.mod

@@ -0,0 +1,5 @@
+module github.com/mble/slamhound
+
+go 1.13
+
+require github.com/hillu/go-yara v1.1.0

go.sum

@@ -0,0 +1,2 @@
+github.com/hillu/go-yara v1.1.0 h1:pNcmtnTGB89hV84Jh0+8GI/D7KabK8QFQlgUuhkoJUY=
+github.com/hillu/go-yara v1.1.0/go.mod h1:KLxCsvD3F8cgVK866UDHi961qbzP+twKjhNdDsuz/2M=

main.go

@@ -0,0 +1,136 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/hillu/go-yara"
+
+	"errors"
+	"flag"
+	"log"
+	"strconv"
+	"strings"
+)
+
+type rule struct{ namespace, filename string }
+type rules []rule
+
+func (r *rules) Set(arg string) error {
+	if len(arg) == 0 {
+		return errors.New("empty rule specification")
+	}
+	a := strings.SplitN(arg, ":", 2)
+	switch len(a) {
+	case 1:
+		*r = append(*r, rule{filename: a[0]})
+	case 2:
+		*r = append(*r, rule{namespace: a[0], filename: a[1]})
+	}
+	return nil
+}
+
+func (r *rules) String() string {
+	var s string
+	for _, rule := range *r {
+		if len(s) > 0 {
+			s += " "
+		}
+		if rule.namespace != "" {
+			s += rule.namespace + ":"
+		}
+		s += rule.filename
+	}
+	return s
+}
+
+func printMatches(m []yara.MatchRule, err error) {
+	if err == nil {
+		if len(m) > 0 {
+			for _, match := range m {
+				log.Printf("[+] %s.%s", match.Namespace, match.Rule)
+			}
+		} else {
+			log.Print("no matches.")
+		}
+	} else {
+		log.Printf("error: %s.", err)
+	}
+}
+
+func main() {
+	var (
+		ruleDir     string
+		rules       rules
+		processScan bool
+		pids        []int
+	)
+	flag.BoolVar(&processScan, "processes", false, "scan processes instead of files")
+	flag.Var(&rules, "rule", "add rule")
+	flag.StringVar(&ruleDir, "directory", "", "compile rules from directory")
+	flag.Parse()
+
+	if len(rules) == 0 && ruleDir == "" {
+		log.Fatal("no rules or rule directory specified")
+	}
+
+	args := flag.Args()
+	if len(args) == 0 {
+		log.Fatal("no files or processes specified")
+	}
+
+	if processScan {
+		for _, arg := range args {
+			if pid, err := strconv.Atoi(arg); err != nil {
+				log.Fatalf("Could not parse %s ad number", arg)
+			} else {
+				pids = append(pids, pid)
+			}
+		}
+	}
+
+	c, err := yara.NewCompiler()
+	if err != nil {
+		log.Fatalf("Failed to initialize YARA compiler: %s", err)
+	}
+
+	if ruleDir != "" {
+		err := filepath.Walk(ruleDir, func(path string, info os.FileInfo, err error) error {
+			if err != nil {
+				log.Printf("prevent panic by handling failure accessing a path %q: %v\n", path, err)
+				return err
+			}
+			if filepath.Ext(path) == ".yara" || filepath.Ext(path) == ".yar" {
+				namespace := strings.ReplaceAll(strings.ReplaceAll(path, filepath.Ext(path), ""), "/", ".")
+				ruleFile, err := os.Open(path)
+				if err != nil {
+					log.Fatalf("could not open rule file %s: %s", path, err)
+				}
+				c.AddFile(ruleFile, namespace)
+			}
+			return nil
+		})
+		if err != nil {
+			log.Fatalf("Could not open rule directory %s: %s", ruleDir, err)
+		}
+	}
+
+	r, err := c.GetRules()
+	if err != nil {
+		log.Fatalf("Failed to compile rules: %s", err)
+	}
+
+	if processScan {
+		for _, pid := range pids {
+			log.Printf("Scanning process %d...", pid)
+			m, err := r.ScanProc(pid, 0, 0)
+			printMatches(m, err)
+		}
+	} else {
+		for _, filename := range args {
+			log.Printf("Scanning file %s... ", filename)
+			m, err := r.ScanFile(filename, 0, 0)
+			printMatches(m, err)
+		}
+	}
+}

rules/test.yara

@@ -0,0 +1,9 @@
+rule badthing
+{
+    meta:
+        date = "2020-01-30"
+    strings:
+        $1 = "bad thing"
+    condition:
+        all of them
+}

rules/test2.yara

@@ -0,0 +1,9 @@
+rule badthing
+{
+    meta:
+        date = "2020-01-30"
+    strings:
+        $1 = "bad thing"
+    condition:
+        all of them
+}

test.txt

@@ -0,0 +1 @@
+bad thing

test.yara

@@ -0,0 +1,9 @@
+rule badthing
+{
+    meta:
+        date = "2020-01-30"
+    strings:
+        $1 = "bad thing"
+    condition:
+        all of them
+}