Skip to content

Commit ff0bc2e

Browse files
marcocesaratomarcocesarato
committed
feat: add disable-checksum flag
1 parent 0d6f107 commit ff0bc2e

File tree

2 files changed

+106
-68
lines changed

2 files changed

+106
-68
lines changed

‎README.md

+55-54
Original file line numberDiff line numberDiff line change
@@ -169,60 +169,61 @@ Arguments:
169169
170170
Flags:
171171
172-
--auto-clean - Auto clean code (without confirmation, use with caution)
173-
--auto-clean-line - Auto clean line code (without confirmation, use with caution)
174-
--auto-delete - Auto delete infected (without confirmation, use with caution)
175-
--auto-prompt <prompt> - Set auto prompt command .
176-
ex. --auto-prompt="delete" or --auto-prompt="1" (alias of auto-delete)
177-
--auto-quarantine - Auto quarantine
178-
--auto-skip - Auto skip
179-
--auto-whitelist - Auto whitelist (if you sure that source isn't compromised)
180-
--backup|-b - Make a backup of every touched files
181-
--defs - Get default definitions exploit and functions list
182-
--defs-exploits - Get default definitions exploits list
183-
--defs-functions - Get default definitions functions lists
184-
--defs-functions-encoded - Get default definitions functions encoded lists
185-
--disable-cache|--no-cache - Disable Cache
186-
--disable-colors|--no-colors|--no-color - Disable CLI colors
187-
--disable-report|--no-report - Disable Report
188-
--exploits <exploits> - Filter exploits
189-
--filter-paths|--filter-path <paths> - Filter path/s, for multiple value separate with comma.
190-
Wildcards are enabled ex. /path/*/htdocs or /path/*.php
191-
--functions <functions> - Define functions to search
192-
--help|-h|-? - Check only functions and not the exploits
193-
--ignore-paths|--ignore-path <paths> - Ignore path/s, for multiple value separate with comma.
194-
Wildcards are enabled ex. /path/*/cache or /path/*.log
195-
--limit <limit> - Set file mapping limit
196-
--lite|-l - Running on lite mode help to have less false positive on WordPress and others
197-
platforms enabling exploits mode and removing some common exploit pattern
198-
--log <path> - Write a log file on the specified file path
199-
[default: ./scanner.log]
200-
--max-filesize <filesize> - Set max filesize to scan
201-
[default: -1]
202-
--offset <offset> - Set file mapping offset
203-
--only-exploits|-e - Check only exploits and not the functions
204-
--only-functions|-f - Check only functions and not the exploits
205-
--only-signatures|-s - Check only functions and not the exploits.
206-
This is recommended for WordPress or others platforms
207-
--path-backups <path> - Set backups path directory.
208-
Is recommended put files outside the public document path
209-
[default: /scanner-backups/]
210-
--path-logs <path> - Set quarantine log file
211-
[default: ./scanner.log]
212-
--path-quarantine <path> - Set quarantine path directory.
213-
Is recommended put files outside the public document path
214-
[default: ./scanner-quarantine/]
215-
--path-report <path> - Set report log file
216-
[default: ./scanner-report.html]
217-
--path-whitelist <path> - Set whitelist file
218-
[default: ./scanner-whitelist.json]
219-
--report-format <format> - Report format (html|txt)
220-
--report|-r - Report scan only mode without check and remove malware (like --auto-skip).
221-
It also write a report with all malware paths found
222-
--silent - No output and prompt
223-
--update|-u - Update to last version
224-
--version|-v - Get version number
225-
--whitelist-only-path - Check on whitelist only file path and not line number
172+
--auto-clean - Auto clean code (without confirmation, use with caution)
173+
--auto-clean-line - Auto clean line code (without confirmation, use with caution)
174+
--auto-delete - Auto delete infected (without confirmation, use with caution)
175+
--auto-prompt <prompt> - Set auto prompt command .
176+
ex. --auto-prompt="delete" or --auto-prompt="1" (alias of auto-delete)
177+
--auto-quarantine - Auto quarantine
178+
--auto-skip - Auto skip
179+
--auto-whitelist - Auto whitelist (if you sure that source isn't compromised)
180+
--backup|-b - Make a backup of every touched files
181+
--defs - Get default definitions exploit and functions list
182+
--defs-exploits - Get default definitions exploits list
183+
--defs-functions - Get default definitions functions lists
184+
--defs-functions-encoded - Get default definitions functions encoded lists
185+
--disable-cache|--no-cache - Disable Cache
186+
--disable-checksum|--no-checksum|--no-verify - Disable checksum verifying for platforms/framerwoks
187+
--disable-colors|--no-colors|--no-color - Disable CLI colors
188+
--disable-report|--no-report - Disable report generation
189+
--exploits <exploits> - Filter exploits
190+
--filter-paths|--filter-path <paths> - Filter path/s, for multiple value separate with comma.
191+
Wildcards are enabled ex. /path/*/htdocs or /path/*.php
192+
--functions <functions> - Define functions to search
193+
--help|-h|-? - Check only functions and not the exploits
194+
--ignore-paths|--ignore-path <paths> - Ignore path/s, for multiple value separate with comma.
195+
Wildcards are enabled ex. /path/*/cache or /path/*.log
196+
--limit <limit> - Set file mapping limit
197+
--lite|-l - Running on lite mode help to have less false positive on WordPress and others
198+
platforms enabling exploits mode and removing some common exploit pattern
199+
--log <path> - Write a log file on the specified file path
200+
[default: ./scanner.log]
201+
--max-filesize <filesize> - Set max filesize to scan
202+
[default: -1]
203+
--offset <offset> - Set file mapping offset
204+
--only-exploits|-e - Check only exploits and not the functions
205+
--only-functions|-f - Check only functions and not the exploits
206+
--only-signatures|-s - Check only functions and not the exploits.
207+
This is recommended for WordPress or others platforms
208+
--path-backups <path> - Set backups path directory.
209+
Is recommended put files outside the public document path
210+
[default: /scanner-backups/]
211+
--path-logs <path> - Set quarantine log file
212+
[default: ./scanner.log]
213+
--path-quarantine <path> - Set quarantine path directory.
214+
Is recommended put files outside the public document path
215+
[default: ./scanner-quarantine/]
216+
--path-report <path> - Set report log file
217+
[default: ./scanner-report.html]
218+
--path-whitelist <path> - Set whitelist file
219+
[default: ./scanner-whitelist.json]
220+
--report-format <format> - Report format (html|txt)
221+
--report|-r - Report scan only mode without check and remove malware (like --auto-skip).
222+
It also write a report with all malware paths found
223+
--silent - No output and prompt
224+
--update|-u - Update to last version
225+
--version|-v - Get version number
226+
--whitelist-only-path - Check on whitelist only file path and not line number
226227

227228
Usage: amwscan [--lite|-a] [--help|-h|-?] [--log|-l <path>] [--backup|-b] [--offset
228229
<offset>] [--limit <limit>] [--report|-r] [--report-format <format>]

‎src/Scanner.php

+51-14
Original file line numberDiff line numberDiff line change
@@ -318,7 +318,12 @@ public function run($args = null)
318318
CLI::writeLine('Scanning ' . self::$pathScan, 2);
319319

320320
// Mapping files
321-
CLI::writeLine('Mapping and retrieving checksums, please wait...', 2);
321+
if (self::isVerifierEnabled()) {
322+
CLI::writeLine('Mapping and retrieving checksums, please wait...', 2);
323+
} else {
324+
CLI::writeLine('Mapping, please wait...', 2);
325+
}
326+
322327
$iterator = $this->mapping();
323328

324329
// Counting files
@@ -401,7 +406,8 @@ private function arguments($args = null)
401406
self::$argv->addFlag('path-report', ['default' => self::$pathReport, 'has_value' => true, 'value_name' => 'path', 'help' => 'Set report log file']);
402407
self::$argv->addFlag('disable-colors', ['alias' => ['--no-colors', '--no-color'], 'default' => false, 'help' => 'Disable CLI colors']);
403408
self::$argv->addFlag('disable-cache', ['alias' => '--no-cache', 'default' => false, 'help' => 'Disable Cache']);
404-
self::$argv->addFlag('disable-report', ['alias' => '--no-report', 'default' => false, 'help' => 'Disable Report']);
409+
self::$argv->addFlag('disable-report', ['alias' => '--no-report', 'default' => false, 'help' => 'Disable report generation']);
410+
self::$argv->addFlag('disable-checksum', ['alias' => ['--no-checksum', '--no-verify'], 'default' => false, 'help' => 'Disable checksum verifying for platforms/framerwoks']);
405411
//self::$argv->addFlag('deobfuscate', ['default' => false, 'help' => 'Deobfuscate directory']);
406412
self::$argv->addArgument('path', ['var_args' => true, 'default' => self::currentDirectory(), 'help' => 'Define the path of the file or directory to scan']);
407413
self::$argv->parse($args);
@@ -462,6 +468,9 @@ private function arguments($args = null)
462468
// Cache
463469
self::setCache(!self::$argv['disable-cache']);
464470

471+
// Verifier
472+
self::setVerifier(!self::$argv['disable-checksum']);
473+
465474
// Max filesize
466475
if (isset(self::$argv['max-filesize']) && is_numeric(self::$argv['max-filesize'])) {
467476
self::setMaxFilesize(self::$argv['max-filesize']);
@@ -767,7 +776,9 @@ public function mapping()
767776

768777
if (!$ignore &&
769778
$cur->isDir()) {
770-
Modules::init($cur->getPath());
779+
if (self::isVerifierEnabled()) {
780+
Modules::init($cur->getPath());
781+
}
771782

772783
return false;
773784
}
@@ -782,21 +793,29 @@ public function mapping()
782793
$mapped = 0;
783794
$count = iterator_count($filtered);
784795

785-
CLI::writeBreak(1);
786-
CLI::writeLine('Verifying files checksum...', 2);
796+
$iterator = $filtered;
797+
798+
if (self::isVerifierEnabled()) {
799+
unset($iterator);
800+
801+
CLI::writeBreak(1);
802+
CLI::writeLine('Verifying files checksum...', 2);
787803

788-
foreach ($filtered as $cur) {
789-
CLI::progress($mapped++, $count);
790-
if ($cur->isFile() && !Modules::isVerified($cur->getPathname())) {
791-
$mapping[] = $cur;
804+
foreach ($filtered as $cur) {
805+
CLI::progress($mapped++, $count);
806+
if ($cur->isFile() && !Modules::isVerified($cur->getPathname())) {
807+
$mapping[] = $cur;
808+
}
809+
CLI::progress($mapped, $count);
792810
}
793-
CLI::progress($mapped, $count);
794-
}
795-
$iterator = new ArrayObject($mapping);
796811

797-
CLI::writeBreak(1);
812+
$object = new ArrayObject($mapping);
813+
$iterator = $object->getIterator();
814+
815+
CLI::writeBreak(1);
816+
}
798817

799-
return $iterator->getIterator();
818+
return $iterator;
800819
}
801820

802821
$file = new SplFileInfo(self::$pathScan);
@@ -1682,6 +1701,24 @@ public static function isSilentMode()
16821701
return isset(self::$settings['silent']) ? self::$settings['silent'] : false;
16831702
}
16841703

1704+
/**
1705+
* @return self
1706+
*/
1707+
public static function setVerifier($mode = true)
1708+
{
1709+
self::$settings['verifier'] = $mode;
1710+
1711+
return new static();
1712+
}
1713+
1714+
/**
1715+
* @return bool
1716+
*/
1717+
public static function isVerifierEnabled()
1718+
{
1719+
return isset(self::$settings['verifier']) ? self::$settings['verifier'] : true;
1720+
}
1721+
16851722
/**
16861723
* @return self
16871724
*/

0 commit comments

Comments
 (0)