Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
A
Autopsy
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Iterations
Requirements
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Locked files
Build
Pipelines
Jobs
Pipeline schedules
Test cases
Artifacts
Deploy
Releases
Package registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Code review analytics
Issue analytics
Insights
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
IRT
Autopsy
Commits
6becccaf
Commit
6becccaf
authored
4 years ago
by
Kelly Kelly
Browse files
Options
Downloads
Patches
Plain Diff
Added support for TSK_RULE
parent
09d0c6e5
No related branches found
No related tags found
No related merge requests found
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
.gitignore
+1
-0
1 addition, 0 deletions
.gitignore
Core/src/org/sleuthkit/autopsy/modules/yara/YaraIngestHelper.java
+4
-2
4 additions, 2 deletions
.../org/sleuthkit/autopsy/modules/yara/YaraIngestHelper.java
thirdparty/yara/ReadMe.txt
+3
-2
3 additions, 2 deletions
thirdparty/yara/ReadMe.txt
with
8 additions
and
4 deletions
.gitignore
+
1
−
0
View file @
6becccaf
...
...
@@ -99,3 +99,4 @@ hs_err_pid*.log
/thirdparty/yara/YaraJNIWrapper/dist/
/thirdparty/yara/YaraJNIWrapper/build/
/thirdparty/yara/YaraJNIWrapper/nbproject/private/
thirdparty/yara/yarabridge/.vs/
This diff is collapsed.
Click to expand it.
Core/src/org/sleuthkit/autopsy/modules/yara/YaraIngestHelper.java
+
4
−
2
View file @
6becccaf
...
...
@@ -23,6 +23,8 @@
import
org.sleuthkit.datamodel.AbstractFile
;
import
org.sleuthkit.datamodel.BlackboardArtifact
;
import
static
org
.
sleuthkit
.
datamodel
.
BlackboardArtifact
.
ARTIFACT_TYPE
.
TSK_YARA_HIT
;
import
static
org
.
sleuthkit
.
datamodel
.
BlackboardAttribute
.
ATTRIBUTE_TYPE
.
TSK_SET_NAME
;
import
static
org
.
sleuthkit
.
datamodel
.
BlackboardAttribute
.
ATTRIBUTE_TYPE
.
TSK_RULE
;
import
org.sleuthkit.datamodel.BlackboardAttribute
;
import
org.sleuthkit.datamodel.TskCoreException
;
...
...
@@ -136,8 +138,8 @@ private static List<BlackboardArtifact> createArtifact(AbstractFile abstractFile
BlackboardArtifact
artifact
=
abstractFile
.
newArtifact
(
TSK_YARA_HIT
);
List
<
BlackboardAttribute
>
attributes
=
new
ArrayList
<>();
attributes
.
add
(
new
BlackboardAttribute
(
BlackboardAttribute
.
ATTRIBUTE_TYPE
.
TSK_SET_NAME
,
MODULE_NAME
,
ruleSetName
));
attributes
.
add
(
new
BlackboardAttribute
(
BlackboardAttribute
.
ATTRIBUTE_TYPE
.
TSK_CATEGORY
,
MODULE_NAME
,
rule
));
attributes
.
add
(
new
BlackboardAttribute
(
TSK_SET_NAME
,
MODULE_NAME
,
ruleSetName
));
attributes
.
add
(
new
BlackboardAttribute
(
TSK_RULE
,
MODULE_NAME
,
rule
));
artifact
.
addAttributes
(
attributes
);
artifacts
.
add
(
artifact
);
...
...
This diff is collapsed.
Click to expand it.
thirdparty/yara/ReadMe.txt
+
3
−
2
View file @
6becccaf
This folder contains the projects you need for building and testing the yarabridge.dll and YaraJNIWrapper.jar.
bin:
Contains the built
dll
and jar.
Contains the built
jar
and jar
ac64.exe. jarac64.exe is used to by the ingest module to compile the rule files
.
yarabridge:
VS project to create the dll that wraps the the libyara library.
...
...
@@ -18,7 +18,8 @@ Steps for building yarabridge, YaraJNIWrapper and YaraWrapperTest.
- Build Release x64.
3. Open the yarabridge project and build Release x64.
-If you have link issues, make sure you build release x64 in the previous step.
-This project will automatically copy the built dll to the bin folder.
-This project will automatically copy the built dll into the YaraJNIWrapper src\org\sleuthkit\autopsy\yara folder.
- This is where is needs to be so that its included into the jar file.
4. Build YaraJNIWrapper
- Open in netbeans and select Build.
- Manually move the newly build jar file to the bin folder. After building the jar file can be found in
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment