# Path: malwareconfig/yarascanner.py
# class YaraScanner:
#     def __init__(self):
#         # Create the list of rules
#         try:
#             yara_path = os.path.join(os.path.dirname(__file__), 'yaraRules')
#             self.yara_rules = os.listdir(yara_path)
#             self.rule_file = os.path.join(yara_path, 'yaraRules.yar')
#             self.compiled_rules = yara.compile(self.rule_file)
#             self.rule_list = []
#         except yara.SyntaxError as e:
#             print("Unable to compile rules. Do you have dotnet enabled")
# 
#     # Yara Scanner Returns the Rule Name
#     def yara_scan(self, raw_data):
#         matches = self.compiled_rules.match(data=raw_data)
#         rule_list = []
# 
#         for match in matches:
#             rule_list.append(match.rule)
#         self.rule_list = rule_list
# 
# Path: malwareconfig/common.py
# class PreProcessor(object):
#     preprocessor_name = ""
#     preprocessor_version = 1
#     preprocessor_author = ""
#     preprocessor_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def pre_process(self):
#         pass


import os
import subprocess
from malwareconfig.yarascanner import YaraScanner
from malwareconfig.common import PreProcessor
from tempfile import NamedTemporaryFile

    def pre_process(self):
        '''
        This is the main entry
        :return:
        '''

        file_data = self.file_info.file_data

        f = NamedTemporaryFile(delete=False)
        f.write(file_data)
        f.close()

        try:
            # Run UPX to unpack on the command line
            with open(os.devnull, 'w') as devnull:
                # this will also redirect stderr to /dev/null as well
                subprocess.run(['upx', '-d', f.name], stdout=devnull, stderr=devnull)

            # Read the new file
            new_data = open(f.name, 'rb').read()

            # Remove the UPX temp file
            os.unlink(f.name)

            # Set the file data to the new data
            self.file_info.file_data = new_data

            # Scan with yara
            print("    [-] Rescanning File")

# Path: malwareconfig/yarascanner.py
# class YaraScanner:
#     def __init__(self):
#         # Create the list of rules
#         try:
#             yara_path = os.path.join(os.path.dirname(__file__), 'yaraRules')
#             self.yara_rules = os.listdir(yara_path)
#             self.rule_file = os.path.join(yara_path, 'yaraRules.yar')
#             self.compiled_rules = yara.compile(self.rule_file)
#             self.rule_list = []
#         except yara.SyntaxError as e:
#             print("Unable to compile rules. Do you have dotnet enabled")
# 
#     # Yara Scanner Returns the Rule Name
#     def yara_scan(self, raw_data):
#         matches = self.compiled_rules.match(data=raw_data)
#         rule_list = []
# 
#         for match in matches:
#             rule_list.append(match.rule)
#         self.rule_list = rule_list
# 
# Path: malwareconfig/common.py
# class PreProcessor(object):
#     preprocessor_name = ""
#     preprocessor_version = 1
#     preprocessor_author = ""
#     preprocessor_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def pre_process(self):
#         pass


# Path: malwareconfig/preprocessors/upx.py
import os
import subprocess
from malwareconfig.yarascanner import YaraScanner
from malwareconfig.common import PreProcessor
from tempfile import NamedTemporaryFile


    def pre_process(self):
        '''
        This is the main entry
        :return:
        '''

        file_data = self.file_info.file_data

        f = NamedTemporaryFile(delete=False)
        f.write(file_data)
        f.close()

        try:
            # Run UPX to unpack on the command line
            with open(os.devnull, 'w') as devnull:
                # this will also redirect stderr to /dev/null as well
                subprocess.run(['upx', '-d', f.name], stdout=devnull, stderr=devnull)

            # Read the new file
            new_data = open(f.name, 'rb').read()

            # Remove the UPX temp file
            os.unlink(f.name)

            # Set the file data to the new data
            self.file_info.file_data = new_data

            # Scan with yara
            print("    [-] Rescanning File")

            scanner = YaraScanner()