Neo23x0 / Raccine

A Simple Ransomware Vaccine
The Unlicense
944 stars 122 forks source link

Create handle wrapper #31

Closed Eran-YT closed 3 years ago

Neo23x0 commented 3 years ago

We noticed that Raccine as Window application has some serious disadvantages. I'll add some screenshots made on a different machine. John also made some changes to support YARA rules and sent it to me as a ZIP archive. I merged these changes manually into a yara-matching branch that forks from the last master.

We now have two feature branches.

The Window Application was a nice idea, but it causes too many problems in the field. I tried it on a machine and it broke some scripts and tools, since it invokes another window for a command originally sent to the command line.

Screenshot 2020-10-19 200300

Screenshot 2020-10-19 200020

Neo23x0 commented 3 years ago

The reason, why we switched to a Window Application was the idea to show an alert message to the user.

Screenshot 2020-10-19 122222

I had the idea to keep it a Console Application but provide another "Notification" binary that just displays the alert message.

Neo23x0 commented 3 years ago

I'd say we should stop all feature development until the code has been cleaned up. Otherwise we would always get these merge problems, as we experience them now.

Eran-YT commented 3 years ago

This whole PR is code cleanups, should I change it so it will be based on the main branch?

Neo23x0 commented 3 years ago

I am very sorry, but yes. It would be better to cleanup the master branch's code. We'll then see if we can merge the yara-matching branch into the master branch, when you're done.

Omodaka9375 commented 3 years ago

We noticed that Raccine as Window application has some serious disadvantages. I'll add some screenshots made on a different machine. John also made some changes to support YARA rules and sent it to me as a ZIP archive. I merged these changes manually into a yara-matching branch that forks from the last master.

We now have two feature branches.

* `gui`

* `yara-matching`

The Window Application was a nice idea, but it causes too many problems in the field. I tried it on a machine and it broke some scripts and tools, since it invokes another window for a command originally sent to the command line.

Screenshot 2020-10-19 200300

Screenshot 2020-10-19 200020

We don't need it to be Windows app to notify the user. We can make a small message or popup.exe that will receive the message, and just pipe it to the user independently that way. And leave all dependencies to popup.exe. This has been done before for similar reasons.

Eran-YT commented 3 years ago

I created a new PR for this code for the main branch