Skip to content

Commit

Permalink
improve logic for handling FileSignatures dictionary
Browse files Browse the repository at this point in the history
  • Loading branch information
AndrewRathbun committed Jun 26, 2023
1 parent 367a3d0 commit 0ea02be
Showing 1 changed file with 32 additions and 13 deletions.
45 changes: 32 additions & 13 deletions SigHunter/Program.cs
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,6 @@ static void Main(string[] args)
{
switch (args[i])
{
// ... option parsing code ...

case "-d":
// Get directory path
if (i + 1 < args.Length)
Expand Down Expand Up @@ -59,15 +57,17 @@ static void Main(string[] args)
Console.WriteLine($"Creating output directory {outputPath}");
Directory.CreateDirectory(outputPath);
}

// add else statement here to inform the user which directory is being used for the outputPath
else
{
Console.WriteLine($"Using existing output directory {outputPath}");
}

// Traverse the directory and check file signatures against the dictionary
TraverseDirectory(dirPath, signatures, outputPath, extensions, ignoreCase);
}

static void TraverseDirectory(string dirPath, Dictionary<string, string> signatures, string outputPath,
List<string> extensions, bool ignoreCase)
static void TraverseDirectory(string dirPath, Dictionary<List<string>, List<string>> signatures, string outputPath,
List<string> extensions, bool ignoreCase)
{
try
{
Expand Down Expand Up @@ -95,7 +95,17 @@ static void TraverseDirectory(string dirPath, Dictionary<string, string> signatu
}
else
{
mismatchFiles.Add((result.Item1, result.Item2, result.Item3, result.Item5, signatures[result.Item2]));
string expectedSignatures = string.Empty;
foreach (var entry in signatures)
{
if (entry.Key.Contains(result.Item2))
{
expectedSignatures = string.Join(", ", entry.Value);
break;
}
}

mismatchFiles.Add((result.Item1, result.Item2, result.Item3, result.Item5, expectedSignatures));
}

if (index % 100 == 0)
Expand All @@ -122,7 +132,7 @@ static void TraverseDirectory(string dirPath, Dictionary<string, string> signatu
}
}

static (string, string, string, bool, string) CheckFileSignature(string file, Dictionary<string, string> signatures, List<string> extensions, bool ignoreCase)
static (string file, string extension, string hexSignature, bool matched, string expectedExt) CheckFileSignature(string file, Dictionary<List<string>, List<string>> signatures, List<string> extensions, bool ignoreCase)
{
string extension = Path.GetExtension(file);
string hexSignature = GetFileSignature(file);
Expand All @@ -132,21 +142,30 @@ static void TraverseDirectory(string dirPath, Dictionary<string, string> signatu
hexSignature = hexSignature.ToUpperInvariant();
}

string expectedExt = signatures.FirstOrDefault(s => hexSignature.StartsWith(s.Value, StringComparison.OrdinalIgnoreCase)).Key;
string? expectedExt = signatures.FirstOrDefault(s => s.Key.Any(ext => extension.Equals(ext, StringComparison.OrdinalIgnoreCase)))
.Value.FirstOrDefault(expectedSignature => hexSignature.StartsWith(expectedSignature, StringComparison.OrdinalIgnoreCase));

bool matched = !string.IsNullOrEmpty(expectedExt) && string.Equals(expectedExt, extension, StringComparison.OrdinalIgnoreCase);
bool matched = !string.IsNullOrEmpty(expectedExt);

return (file, extension, hexSignature, matched, expectedExt);
return (file, extension, hexSignature, matched, expectedExt ?? string.Empty);
}

static string GetFileSignature(string filePath)
{
byte[] buffer = new byte[8];
// Determine the longest magic number
int longestMagicNumber = FileSignatures.Signatures.Values
.Max(list => list.Max(s => s.Length)) / 2; // We divide by 2 because each byte is represented by two hex characters

byte[] buffer = new byte[longestMagicNumber];

using (FileStream stream = new FileStream(filePath, FileMode.Open, FileAccess.Read))
{
stream.Read(buffer, 0, buffer.Length);
}
return BitConverter.ToString(buffer);

// Convert bytes to hexadecimal and remove trailing zeros
string hexSignature = BitConverter.ToString(buffer).TrimEnd("-00".ToCharArray());
return hexSignature;
}

static void WriteToCsv(string csvFilePath, IEnumerable<string[]> data, string[] headers)
Expand Down

0 comments on commit 0ea02be

Please sign in to comment.