Initial commit.

.gitignore

@@ -0,0 +1,2 @@
+*.txt
+*.elf

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Zane Gittins
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

analysis/yara.go

@@ -0,0 +1,130 @@
+package analysis
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/Velocidex/go-yara"
+	getter "github.com/hashicorp/go-getter"
+)
+
+// YaraScanner - struct that holds compiler and rules.
+type YaraScanner struct {
+	Compiler  *yara.Compiler
+	Rules     *yara.Rules
+	RulesPath string
+}
+
+func (y *YaraScanner) AddRule(rule string) bool {
+	f, err := os.Open(rule)
+	defer f.Close()
+	if err == nil {
+		// Test rule is valid by using a test compiler.
+		tempCompiler, err := yara.NewCompiler()
+		if err != nil {
+			return false
+		}
+		err = tempCompiler.AddFile(f, "all")
+		if err == nil {
+			f2, err := os.Open(rule)
+			defer f2.Close()
+			err = y.Compiler.AddFile(f2, "all")
+			if err == nil {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// LoadRules - Loads YARA rules into compiler.
+func (y *YaraScanner) LoadRules() {
+	rules := []string{}
+
+	err := filepath.Walk(y.RulesPath,
+		func(path string, info os.FileInfo, err error) error {
+			if strings.Contains(path, ".yar") {
+				rules = append(rules, path)
+			}
+			return nil
+		})
+	if err != nil {
+		fmt.Println(err)
+	}
+
+	y.Compiler, err = yara.NewCompiler()
+	if err != nil {
+		fmt.Printf("Failed to initialize yara compiler: %s\n", err)
+		os.Exit(-1)
+	}
+
+	numIgnored := 0
+	for _, rule := range rules {
+		added := y.AddRule(rule)
+		if added == false {
+			numIgnored++
+		}
+	}
+
+	if numIgnored > 0 {
+		fmt.Printf("Failed to load %d yara rules.\n", numIgnored)
+	}
+
+	y.Rules, err = y.Compiler.GetRules()
+	if err != nil {
+		fmt.Printf("Failed to compile rules: %s", err)
+		os.Exit(-1)
+	}
+}
+
+// DownloadLatestRules - Downloads the latest yara rules from a url.
+func (y *YaraScanner) DownloadLatestRules(url string) {
+	var mode getter.ClientMode
+	mode = getter.ClientModeDir
+
+	// Get the wd
+	pwd, err := os.Getwd()
+	if err != nil {
+		fmt.Printf("Error getting working directory: %s", err)
+		os.Exit(-1)
+	}
+
+	yaraRulesPath := y.RulesPath
+
+	ctx, _ := context.WithCancel(context.Background())
+	opts := []getter.ClientOption{}
+
+	// Build the client
+	client := &getter.Client{
+		Ctx:     ctx,
+		Src:     url,
+		Dst:     yaraRulesPath,
+		Pwd:     pwd,
+		Mode:    mode,
+		Options: opts,
+	}
+
+	if err := client.Get(); err != nil {
+		fmt.Println(err)
+		os.Exit(-1)
+	} else {
+		fmt.Printf("Updated to latest YARA ruleset from %s\n", url)
+	}
+}
+
+// AnalyzeYARAFile - Gets data from file and passes to AnalyzeYARA.
+func (y *YaraScanner) AnalyzeYARAFile(filepath string) []yara.MatchRule {
+
+	b, err := ioutil.ReadFile(filepath)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(-1)
+	}
+	m, _ := y.Rules.ScanMem(b, 0, 0)
+	return m
+}

go.mod

@@ -0,0 +1,56 @@
+module github.com/zaneGittins/minidump
+
+go 1.18
+
+require (
+	github.com/Velocidex/go-yara v1.1.9
+	github.com/hashicorp/go-getter v1.7.1
+	github.com/jedib0t/go-pretty/v6 v6.4.6
+	github.com/kaitai-io/kaitai_struct_go_runtime v0.10.0
+	github.com/pterm/pterm v0.12.62
+	golang.org/x/text v0.11.0
+)
+
+require (
+	atomicgo.dev/cursor v0.1.1 // indirect
+	atomicgo.dev/keyboard v0.2.9 // indirect
+	atomicgo.dev/schedule v0.0.2 // indirect
+	cloud.google.com/go v0.104.0 // indirect
+	cloud.google.com/go/compute v1.10.0 // indirect
+	cloud.google.com/go/iam v0.5.0 // indirect
+	cloud.google.com/go/storage v1.27.0 // indirect
+	github.com/alecthomas/kong v0.8.0 // indirect
+	github.com/aws/aws-sdk-go v1.44.122 // indirect
+	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
+	github.com/containerd/console v1.0.3 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.6.0 // indirect
+	github.com/gookit/color v1.5.3 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-safetemp v1.0.0 // indirect
+	github.com/hashicorp/go-version v1.6.0 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/klauspost/compress v1.15.11 // indirect
+	github.com/lithammer/fuzzysearch v1.1.8 // indirect
+	github.com/mattn/go-runewidth v0.0.14 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
+	github.com/rivo/uniseg v0.4.4 // indirect
+	github.com/ulikunitz/xz v0.5.10 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	go.opencensus.io v0.23.0 // indirect
+	golang.org/x/net v0.6.0 // indirect
+	golang.org/x/oauth2 v0.1.0 // indirect
+	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/term v0.8.0 // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+	google.golang.org/api v0.100.0 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/genproto v0.0.0-20221025140454-527a21cfbd71 // indirect
+	google.golang.org/grpc v1.50.1 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
+)