search

ufrisk / MemProcFS

MemProcFS
GNU Affero General Public License v3.0
3k stars 371 forks source link

Question: Best way to get findevil results from Rust API #281

Closed kaarposoft closed 6 months ago

kaarposoft commented 6 months ago

I would like to get "findevil" results from the Rust API. I know that the results are available when the memory image is mounted from the commandline, under the forensic directory. Presumably I could use Vmm::vfs_read on forensics/findevil/findevil.txt, but then I would have to parse text which is not very structured. Better yet I could use Vmm::vfs_read on forensics/json/general.json, then I only have to parse json which would be much more reliable than text parsing. But the best would be to get the results directly from the Rust API in structured form. However, I do not see any methods to do that under Vmm: https://docs.rs/memprocfs/5.9.0/memprocfs/struct.Vmm.html Am I missing something here; is there a Rust API I have overlooked? What would you recommend as the best way to get "findevil" results from the Rust API?

ufrisk commented 6 months ago

The Rust API isn't being overlooked.

There is no API for getting FindEvil results other than the VFS API in any of the supported languages.

If you wish to get fairly structured results you could grab the FindEvil CSV or get the files from FindEvil directly.

FindEvil results aren't super structured internally either so it wouldn't make much sense for me to add a separate API for it I think. Grabbing the basic results from the CSV should already be structured enough I hope. If there really is the need to add some kind of API for it, it could be done I guess, but it wouldn't really be more structured than the CSV.

For general questions (i.e. not bugs and improvement suggestions) it may be easier to stop by the Discord Server:

kaarposoft commented 6 months ago

Thank you very much for the answer. I was just looking for a sanity check before going in the wrong direction. I guess I will have to parse the json or csv (thanks for the pointer to the CSV which I had overlooked)

I am not on discord, but I will now sign up - just for following MemProcFs.

ufrisk commented 6 months ago

Awesome, I saw you joined the other day. If you have quick question or wish to discuss somthing just ping me over there and I'll try to answer.

Bugs/issues and more serious improvement suggestions I still prefer here on Github though.

I'm closing this issue since I believe it was resolved.