Sign in to follow this  
Followers 0
IchBistTod

Finding a string in a binary file

2 posts in this topic

Okay I'm making a simple AV scanner for the registry and startup dir to detect certain viruses.

The problem is I cant properly identify a string in a string it always returns false.

here is how I make the signitures

$file = FileOpen("C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe", 8)
$data = binary(FileRead($file))
$length = StringLen($data)
$start = random(0, $length/Random(2,4,1), 1)
$sig = StringMid($data, $start, 500)
FileWrite("DB.mwi", $sig&",")

Give a DB like

050D24B004CD24B0048D24B0050CD4B0040D24B003CD24B004CCD4B0034D24B0030D24B002CD24B0028D24B0024D24B0020D24B001CD24B00D8B74B0018D24B008C8F4B0048CD4B0014D24B0010D24B000CD24B0008D24B0044CD4B0000D24B00FCD14B0040CD4B00F8D14B003CCD4B00F0D14B0038CD4B0034CD4B0030CD4B00E8D14B00E4D14B00E0D14B002CCD4B00DCD14B00D8D14B00D4D14B00D0D14B00CCD14B00C8D14B0084AE4B00C4D14B00C0D14B00C0864B00BCD14B0028CD4B0024CD4B00B0D14B00ACD14B00A8D14B0020CD4B00A4D14B001CCD4B00A0D14B0018CD4B0014CD4B0010CD4B000CCD4B0098D14B0008CD4B0094D,03F8B4DF4C7070F000000E926FFFFFFA90000FF0074168B7E040FBE573F8BC8C1E910884C3A4C8B4E04FE413F8B4DF4A900FF000074198B7E040FBE573F8BC8C1E908884C3A4C8B4E04FE413F8B4DF48B56040FBE7A3F8844174C8B46048B7D0CFE403FC7070F000000E9C7FEFFFF0FB7500233DB6685D20F94C34B83E31081C3D9000000EB120FB750026685D20F848A010000BBE800000033D2668950028B55E8B800010000663942067558817DDC710A0000754F03C8518B0D24724C00E87D17010084C0743A8B4DE88B7DF833C0668941028BC3C1E0100D00E800000BD88B45EC2B4608D1F8483B7DF00F83C600000081FBFF00000076458,

Pretty Clean so far, however when I go to scan using this code

func _checkdb($string)
    $strings = FileRead(@scriptfullpath&"\DB.mwi")
    $strings = StringSplit($strings, ",")
    if $strings[0] > 0 Then
        $file = FileOpen($string, 8)
        $data = binary(FileRead($file))
        for $i = 1 to $strings[0]
if StringInStr($data, $strings[$i]) then
    $ret += 1
    ConsoleWrite($ret&"*"&@CRLF)
EndIf
next
EndIf

EndFunc

I get nothing.


[center][/center][center]=][u][/u][/center][center][/center]

Share this post


Link to post
Share on other sites



Fixed


[center][/center][center]=][u][/u][/center][center][/center]

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0