Skip to content

Commit

Permalink
Merge pull request Neo23x0#45 from Neo23x0/master
Browse files Browse the repository at this point in the history
Fix for issue Neo23x0#44
  • Loading branch information
Neo23x0 committed May 13, 2016
2 parents 5c0a180 + 6301fcd commit 671807d
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 6 deletions.
2 changes: 1 addition & 1 deletion .gitmodules
@@ -1,3 +1,3 @@
[submodule "signature-base"]
path = signature-base
url = git://github.com/Neo23x0/signature-base
url = https://github.com/Neo23x0/signature-base
12 changes: 7 additions & 5 deletions loki.py
Expand Up @@ -24,7 +24,7 @@
DISCLAIMER - USE AT YOUR OWN RISK.
"""
__version__ = '0.15.3'
__version__ = '0.15.5'

import os
import argparse
Expand Down Expand Up @@ -327,7 +327,8 @@ def scan_path(self, path):
# Scan the read data
try:
for (score, rule, description, matched_strings) in \
self.scan_data(fileData, fileType, filename, filePath, extension, md5):
self.scan_data(fileData, fileType, removeNonAsciiDrop(filename),
removeNonAscii(filePath), extension, md5):

# Message
message = "Yara Rule MATCH: %s TYPE: %s DESCRIPTION: %s FILE: %s FIRST_BYTES: %s %s " \
Expand Down Expand Up @@ -423,7 +424,7 @@ def check_svchost_owner(self, owner):
windll = ctypes.windll.kernel32
locale = locale.windows_locale[ windll.GetUserDefaultUILanguage() ]
if locale == 'fr_FR':
return (owner.upper().startswith("SERVICE LOCAL") or
return (owner.upper().startswith("SERVICE LOCAL") or
owner.upper().startswith(u"SERVICE RÉSEAU") or
# owner.upper().startswith(u"Système") or ##Not matching
owner == u"Système" or
Expand Down Expand Up @@ -1075,6 +1076,7 @@ def log_to_stdout(self, message, mes_type):
# Prepare Message
#message = removeNonAsciiDrop(message)
codecs.register(lambda message: codecs.lookup('utf-8') if message == 'cp65001' else None)
message = message.encode(sys.stdout.encoding, errors='replace')

if self.csv:
print "{0},{1},{2},{3}".format(getSyslogTimestamp(),self.hostname,mes_type,message)
Expand Down Expand Up @@ -1234,7 +1236,7 @@ def signal_handler(signal_name, frame):
# Remove old log file
if os.path.exists(args.l):
os.remove(args.l)

# Computername
if platform == "linux" or platform == "osx":
t_hostname = os.uname()[1]
Expand Down Expand Up @@ -1302,4 +1304,4 @@ def signal_handler(signal_name, frame):

if not args.dontwait:
print " "
raw_input("Press Enter to exit ...")
raw_input("Press Enter to exit ...")
5 changes: 5 additions & 0 deletions requirements.txt
@@ -0,0 +1,5 @@
netaddr
psutil
pylzma
yara

0 comments on commit 671807d

Please sign in to comment.