Skip to content

Commit 666e19d

Browse files
committed
Add new analyzer NetworkActivityAnalyzer
1 parent e232b93 commit 666e19d

File tree

10 files changed

+448
-35
lines changed

10 files changed

+448
-35
lines changed

src/Safeturned.FileChecker.Service/Program.cs

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
using Safeturned.FileChecker;
22
using dnlib.DotNet;
33

4+
using FeatureResult = Safeturned.FileChecker.FeatureResult;
5+
46
var builder = WebApplication.CreateBuilder(args);
57

68
builder.Services.AddEndpointsApiExplorer();
@@ -35,10 +37,8 @@
3537

3638
return Results.Ok(new AnalyzeResponse(
3739
result.Score,
38-
result.Message,
39-
result.Checked,
4040
Checker.Version,
41-
result.GetAnalysisResults(),
41+
result.Features.ToArray(),
4242
metadata
4343
));
4444
}
@@ -136,10 +136,8 @@ static AssemblyMetadata ExtractMetadata(Stream fileStream)
136136

137137
public record AnalyzeResponse(
138138
float Score,
139-
string? Message,
140-
bool Checked,
141139
string Version,
142-
object Results,
140+
FeatureResult[] Features,
143141
AssemblyMetadata Metadata
144142
);
145143

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"profiles": {
3+
"Safeturned.FileChecker.Service": {
4+
"commandName": "Project",
5+
"launchBrowser": true,
6+
"environmentVariables": {
7+
"ASPNETCORE_ENVIRONMENT": "Development"
8+
},
9+
"applicationUrl": "https://localhost:55054;http://localhost:55055"
10+
}
11+
}
12+
}
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
namespace Safeturned.FileChecker;
2+
3+
public enum AnalyzerFeature
4+
{
5+
BlacklistedCommands,
6+
NetworkActivity
7+
}

src/Safeturned.FileChecker/Analyzers/BlacklistedCommandAnalyzer.cs

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
using dnlib.DotNet.Emit;
1+
using dnlib.DotNet.Emit;
22
using Safeturned.FileChecker.Modules;
33

44
namespace Safeturned.FileChecker.Analyzers;
@@ -14,8 +14,13 @@ internal class BlacklistedCommandAnalyzer : IModuleAnalyzer
1414
("ban", 20),
1515
];
1616

17-
public void Analyze(ModuleProcessingContext context)
17+
public string FeatureName => "BlacklistedCommands";
18+
19+
public FeatureResult Analyze(ModuleProcessingContext context)
1820
{
21+
float score = 0;
22+
var messages = new List<FeatureMessage>();
23+
1924
foreach (var typeDef in context.Module.GetTypes())
2025
foreach (var typeDefMethod in typeDef.Methods)
2126
{
@@ -32,15 +37,22 @@ public void Analyze(ModuleProcessingContext context)
3237
instruction = typeDefMethod.Body.Instructions[i + 2];
3338
if (instruction.OpCode != OpCodes.Ldstr)
3439
continue;
35-
foreach (var (command, score) in BlacklistedCommands)
40+
foreach (var (command, commandScore) in BlacklistedCommands)
3641
{
3742
if (instruction.Operand.ToString()!.Contains(command, StringComparison.CurrentCultureIgnoreCase))
3843
{
39-
context.Score += score;
40-
context.Message += $"Blacklisted command {command} found in {typeDefMethod.FullName}";
44+
score += commandScore;
45+
messages.Add(new FeatureMessage { Text = $"Blacklisted command {command} found in {typeDefMethod.FullName}" });
4146
}
4247
}
4348
}
4449
}
50+
51+
return new FeatureResult
52+
{
53+
Name = FeatureName,
54+
Score = score,
55+
Messages = messages.Count > 0 ? messages : null
56+
};
4557
}
4658
}

0 commit comments

Comments
 (0)