Neo23x0 / Raccine

A Simple Ransomware Vaccine
The Unlicense
945 stars 122 forks source link

altenative source server for yara files #115

Open nobur opened 3 years ago

nobur commented 3 years ago

Hi,

By default, most of our servers are disallowed to connect to internet. In that case, Yara rules update can't take place as required.

Could it be possible to include a fall back solution like the folling one to make the updater to point to an internal server:

static public void Main(String[] args)
        {
            var contentsUrl = $"https://api.github.com/repos/Neo23x0/Raccine/contents/yara?ref=main";
            if(args.Length > 0)
            {
                contentsUrl = args[0];
            }
            SyncContentFromUrl(contentsUrl, "");
        }

This will allow us to specify an alternative URL directly on the command line

Probalbly an adaptation of the installation script will be required to ask for a value if required.

A better option will probably to rely on a config file with something like this :

if (File.Exists(appDir + @"\update.url"))
            {
                contentsUrl = File.ReadAllLines(appDir + @"\update.url")[0];
            }

This file could then simply included in the folder while deploying.