IchBistTod Posted May 8, 2011 Posted May 8, 2011 Okay I'm making a simple AV scanner for the registry and startup dir to detect certain viruses. The problem is I cant properly identify a string in a string it always returns false. here is how I make the signitures $file = FileOpen("C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe", 8) $data = binary(FileRead($file)) $length = StringLen($data) $start = random(0, $length/Random(2,4,1), 1) $sig = StringMid($data, $start, 500) FileWrite("DB.mwi", $sig&",") Give a DB like 050D24B004CD24B0048D24B0050CD4B0040D24B003CD24B004CCD4B0034D24B0030D24B002CD24B0028D24B0024D24B0020D24B001CD24B00D8B74B0018D24B008C8F4B0048CD4B0014D24B0010D24B000CD24B0008D24B0044CD4B0000D24B00FCD14B0040CD4B00F8D14B003CCD4B00F0D14B0038CD4B0034CD4B0030CD4B00E8D14B00E4D14B00E0D14B002CCD4B00DCD14B00D8D14B00D4D14B00D0D14B00CCD14B00C8D14B0084AE4B00C4D14B00C0D14B00C0864B00BCD14B0028CD4B0024CD4B00B0D14B00ACD14B00A8D14B0020CD4B00A4D14B001CCD4B00A0D14B0018CD4B0014CD4B0010CD4B000CCD4B0098D14B0008CD4B0094D,03F8B4DF4C7070F000000E926FFFFFFA90000FF0074168B7E040FBE573F8BC8C1E910884C3A4C8B4E04FE413F8B4DF4A900FF000074198B7E040FBE573F8BC8C1E908884C3A4C8B4E04FE413F8B4DF48B56040FBE7A3F8844174C8B46048B7D0CFE403FC7070F000000E9C7FEFFFF0FB7500233DB6685D20F94C34B83E31081C3D9000000EB120FB750026685D20F848A010000BBE800000033D2668950028B55E8B800010000663942067558817DDC710A0000754F03C8518B0D24724C00E87D17010084C0743A8B4DE88B7DF833C0668941028BC3C1E0100D00E800000BD88B45EC2B4608D1F8483B7DF00F83C600000081FBFF00000076458, Pretty Clean so far, however when I go to scan using this code func _checkdb($string) $strings = FileRead(@scriptfullpath&"\DB.mwi") $strings = StringSplit($strings, ",") if $strings[0] > 0 Then $file = FileOpen($string, 8) $data = binary(FileRead($file)) for $i = 1 to $strings[0] if StringInStr($data, $strings[$i]) then $ret += 1 ConsoleWrite($ret&"*"&@CRLF) EndIf next EndIf EndFunc I get nothing. [center][/center][center]=][u][/u][/center][center][/center]
IchBistTod Posted May 8, 2011 Author Posted May 8, 2011 Fixed [center][/center][center]=][u][/u][/center][center][/center]
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now