search

NextronSystems / thor-lite

Fast IOC and YARA Scanner
74 stars 7 forks source link

Slow console printing on Windows #5

Closed ruppde closed 3 years ago

ruppde commented 3 years ago

.\thor64-lite.exe --fsonly -p C:\malware Best of three runs: Info: Report Scan took 0 hours 0 mins 22 secs Notice: Report Thor Scan finished TIME: Sat Jan 23 22:39:44 2021 ALERTS: 11 WARNINGS: 248 NOTICES: 11 ERRORS: 0 (2265 lines of logging on the screen)

Making it unbuffered by piping through find " " is nearly twice as fast: .\thor64-lite.exe --fsonly -p C:\malware | find " " Info: Report Scan took 0 hours 0 mins 12 secs

Strangely using --cmdjson (put all data in 1 line instead of 7) doesn't improve the speed, something must be really unbuffered :)

Another example: .\thor64-lite.exe --nofilesystem --noprocs Info: Report Scan took 0 hours 1 mins 11 secs

.\thor64-lite.exe --nofilesystem --noprocs|find " " Info: Report Scan took 0 hours 0 mins 58 secs

This is only a windows problem, on linux it doesn't even make much difference to use --printall.

secDre4mer commented 3 years ago

Thanks for the report. I've found the "unbuffered" part you theorized and performance should be significantly improved on the next release, especially on Windows 10 since it uses a newer terminal that is now better utilized.

ruppde commented 3 years ago

great. let's close this