Skip to content

Commit

Permalink
Added one more page to the developper documentation.
Browse files Browse the repository at this point in the history
Fixed the PDF detection rule: the "%PDF" header may be located anywhere in the first kilobyte.
The resources plugin is now more resistant to polyglot files.
  • Loading branch information
JusticeRage committed Dec 21, 2015
1 parent 07f28d7 commit a424e66
Show file tree
Hide file tree
Showing 9 changed files with 83 additions and 28,472 deletions.
2 changes: 1 addition & 1 deletion bin/yara_rules/magic.yara
Original file line number Diff line number Diff line change
Expand Up @@ -512,7 +512,7 @@ rule PDF_Document
$a = { 25 50 44 46 }
condition:
$a at 0
$a in (0..1024)
}
rule Word_Document
{
Expand Down
12 changes: 10 additions & 2 deletions docs/before-contributing.rst
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ All code contributions should make every effort to match Manalyze's coding style

// ----------------------------------------------------------------------------

* Indent your code. You can use either tabluations of 4 spaces blocks.
* Indent your code. You can use either tabluations or blocks of 4 spaces.
* Also indent preprocessor directives::

#ifdef BOOST_WINDOWS_API
Expand Down Expand Up @@ -86,7 +86,7 @@ All code contributions should make every effort to match Manalyze's coding style

if (flag)
{
perform_first_action(); // Frowned upon.
perform_action(); // Frowned upon.
}


Expand All @@ -97,3 +97,11 @@ All code contributions should make every effort to match Manalyze's coding style
* The ``goto`` keyword may be tolerated if it prevents code duplication and does not overly complicate the program flow. In particular, ``goto END;`` constructs can be used to go directly to the cleanup of a function before returning.
* In order to prevent memory leaks, memory should not be managed manually. Use smart pointers.
* For better encapsulation, prefer non-member non-friend functions `when adequate <http://cpptips.com/nmemfunc_encap>`_.

Getting Help
============

Here is how you can request some assistance for problems encountered while trying to contribute to the project:

* If you find a bug, or feel that the current API is not exhaustive enough for a something you're trying to do, create an issue on `GitHub <https://github.com/JusticeRage/Manalyze/issues>`_.
* If you find this documentation lacking and don't know how where to begin in order to work on a feature you have in mind, contact the project's maintainer directly over `e-mail <mailto:justicerage(at)manalyzer(dot)org>`_. If the volume gets out of hand, and IRC channel and/or mailing list will be created.
50 changes: 50 additions & 0 deletions docs/code-organization.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
*************************
How the code is organized
*************************

This project currently has over 8000 lines of code and it may be hard at first to find what you're looking for. This page contains an overview of how the code is organized and will help you figure out where the implementations you need to find are located.

The root folder
===============

Let's start at the root folder of the project. It only contains one important file: ``CMakeLists.txt``, which is CMake's configuration file. If you add new sources in your contribution (as opposed to only modifying existing ones), you will need to edit its contents in order to let the build system know about them. Apart from that, Manalyze's README and its license can be found here.

The ``bin`` folder
==================

This is where generated binaries are put - but it contains a few files even if you haven't compiled the project yet:

* ``manalyze.conf`` is a configuration file for the program, pre-filled with default values.
* The ``yara_rules`` folder contains `Yara <https://github.com/plusvic/yara>`_ rules used by the different plugins. You will also find a Python script which generates ClamAV rules by downloading the latest signatures from the official website and converting them to the right format.

The ``external`` folder
=======================

This directory should be mostly empty before you run CMake. It contains the third-party libraries that Manalyze is built against. Those libraries are checked out from GitHub during the compilation process. At the moment, there are two of them:

* `Hash Library <https://github.com/JusticeRage/hash-library>`_, a set of hashing algorithm implementations authored by `Stephan Brumme <http://create.stephan-brumme.com/hash-library/>`_.
* `Yara <https://github.com/JusticeRage/yara>`_, the well known pattern matching tool from `plusvic <https://github.com/plusvic/yara.git>`_. A few modifications have been made to this project, which justifies maintaining our own fork:

* The code has been stripped down to a library (the command-line tool has been removed).
* This version is built with CMake instead of the original Makefile.
* A C++ wrapper was added to facilitate Yara's manipulation and integration with Manalyze.
* All modules have been disabled, and a new one was written so Yara can receive information from Manalyze. In particular, their PE module was replaced since Manalyze already contains a powerful PE parser.

Source folders
==============

The code of the project is spread out in the following folders:

* ``src``: contains Manalyze's "engine". The entry point of the application is located there (in ``main.cpp``), as well as all the functions tasked with validating the arguments, loading the configuration and the plugins, and of course launching the analysis for each target file.
* ``manacommons``: a small library which contains functionnality shared between the core and the plugins, for instance what a plugin result or an analysis report should look like, or how to print text in color.
* ``manape``: all the code related to PE parsing is located in this library.
* ``plugins``: as you might expect, this folder contains Manalyze's plugins. Some of them are fairly simple and fit in a single .cpp file; others are bigger and are subsequently put in a separate folder.
* ``include``: in this directory, you will find the headers of all the source files contained in the folders described above. If you want to understand the program's API quickly, it is recommended that you have a look at the files located here: function declarations are thoroughly commented and will give you a good idea of each class' capabilities.

Other folders
=============

* Inside ``docs``, you will find the reStructured Text which is used to generate this documentation!
* The ``resources`` folder contains some useful documentation, like the PE format specification.


3 changes: 3 additions & 0 deletions docs/developer.rst
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,10 @@ Developer documentation
Welcome to the developer documentation! This section serves as a reference for people willing to contribute to the project.
First of all, thank you for wanting to make Manalyze better! During the course of this chapter, we will discuss considerations which should be taken into account before submitting code. Then we'll look at how the code is organized and formatted in the project. Finally, we'll look at the two ways this project can be extended: by writing a plugin to add analysis capabilities and by improving the core of the tool.

In this chapter, it is assumed that you have obtained a copy of the program's source code and know how to build it. If it is not the case, please refer to the :doc:`obtaining the tool </obtaining-manalyze>` page.

.. toctree::
:maxdepth: 3

before-contributing
code-organization
32 changes: 0 additions & 32 deletions external/yara_rules/custom.yara

This file was deleted.

0 comments on commit a424e66

Please sign in to comment.