diff --git a/README.md b/README.md index e0b789e..b64c074 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,216 @@ # FireDog -开源跨平台病毒特征匹配引擎。Open source cross-platform virus feature matching engine. +开源跨平台轻量级病毒特征检测引擎。Open source cross-platform lightweight virus signature detection engine. -# 简介 Introduction -正在开发中，使用的是：Visual Studio 2019 - -Under development, using: Visual Studio 2019 +# 语言 Language +C++ 11 # LICENSE 是你们喜欢的：MTI License. +让我们搞起来！ + It's what you like:MTI License. + +Let's do it! + +# 交流 contact us +QQGroup: 337571436 + +Email: mountcloud@outlook.com + +# Code大哥？Code big brother? + +1： + +特征库加载性能调优： + +可以从fireDog->pushFeatureLibrary下手，也可以优化MatcherDataSource数据结构。 + +Performance tuning of feature library loading: + +You can start from fireDog->pushFeatureLibrary, or you can optimize the MatcherDataSource data structure. + +2： + +特征匹配性能调优： + +Matcher->matchBytes或者Matcher->matchByte，目前Matcher是单线程的，按照引擎范围的定义，多线程是交给实际的业务多线程调用引擎进行匹配，你也可以升级match方法，让他具有多线程。你可以优化MatcherDataSource的数据结构让他检索时更快。 + +Performance tuning of feature matcher: + +Matcher->matchBytes or Matcher->matchByte, currently Matcher is single-threaded, according to the definition of the engine range, multi-threading is handed over to the actual business multi-threaded call engine for matching, you can also upgrade the match method to make it multi-threaded . You can optimize the data structure of MatcherDataSource to make retrieval faster. + +3： + +总而言之，尽情发挥。 + +All in all, play as much as you like. + +# 简介 Introduction + +提供一个轻量级的特征检测引擎，支持自定义扩展特征库，等有时间再画引擎架构图。 + +Provide a lightweight feature detection engine, support custom extended feature libraries, and draw engine architecture diagrams when you have time. + +# 使用 Use + +## Step 1: download +``` +git clone https://github.com/MountCloud/FireDog.git +``` +## Step 2: include +``` +include FireDog +``` +## Step 3: Example + +``` +#include +#include + +#include "firedog.h" +#include "featurelibrary.h" +#include "matcher.h" + +#include "stringutil.h" + +using namespace std; +using namespace firedog; + + +void testOutPut() { + string hexstr = "hello"; + cout << StringUtil::textToHexText(hexstr) << endl; +} + +void testMatcher() { + + //test featureLibrary + const char* featureLibraryJson = R"( + { + "name":"Test Feature Library", + "version":"1.0.0", + "author":"MountCloud", + "createTime":"2021-09-23 00:58:00", + "hexItems":[ + { + "name":"hello world hex", + "describe":"content is [hello] hex", + "content":"68656C6C6F" + } + ], + "md5Items":[ + { + "name":"hello world md5", + "describe":"content is [hello] md5", + "content":"5d41402abc4b2a76b9719d911017c592" + } + ], + "textItems":[ + { + "name":"hello world text", + "describe":"content is [world] md5", + "content":"world" + } + ] + } + )"; + + //bytes + const string bytes = "fire dog hello world."; + + int ecode = NO_ERROR; + + //step1: init feature library + FeatureLibrary featureLibrary = FeatureLibrary::createByJson(featureLibraryJson, &ecode); + + if (ecode != NO_ERROR) { + cout << "feature library load faild"; + return; + } + + //step2: push to firedog datasource + FireDog* fireDog = new FireDog(); + ecode = fireDog->pushFeatureLibrary(featureLibrary); + if (ecode != NO_ERROR) { + cout << "push feature library faild"; + return; + } + + //step3: create match，One matcher per file! + Matcher* matcher = fireDog->createNewMatcher(); + if (matcher == NULL) { + cout << "create matcher faild"; + return; + } + + //step4: matcher bytes + int length = bytes.length(); + MatcherFeature* mf = NULL; + + //test md5 + //mf = matcher->matchMd5("5d41402abc4b2a76b9719d911017c592");//found it + //mf = matcher->matchMd5("11111111111111111111111111111111");//not found + + //test match bytes + mf = matcher->matchBytes(bytes.c_str(), length);//found it + //mf = matcher->matchBytes("zzz", strlen("zzz"));//not found + + //test match byte + //for (int i = 0; i < length; i++) { + // char byte = bytes.at(i); + // mf = matcher->matchByte(byte); + // //found it + // if (mf != NULL) { + // break; + // } + //} + + if (mf != NULL) { + cout << "found it:" << mf->name << endl; + } + else { + cout << "not found." << endl; + } +} + +int main() +{ + testMatcher(); + + return 0; +} +``` + +# 特征库格式 Feature Library Formate + +``` +{ + "name":"Test Feature Library", + "version":"1.0.0", + "author":"MountCloud", + "createTime":"2021-09-23 00:58:00", + "hexItems":[ + { + "name":"hello world hex", + "describe":"content is [hello] hex", + "content":"68656C6C6F" + } + ], + "md5Items":[ + { + "name":"hello world md5", + "describe":"content is [hello] md5", + "content":"5d41402abc4b2a76b9719d911017c592" + } + ], + "textItems":[ + { + "name":"hello world text", + "describe":"content is [world] md5", + "content":"world" + } + ] +} +``` \ No newline at end of file diff --git a/TestLinux/main.cpp b/TestLinux/main.cpp index 1a73fb2..22ef920 100644 --- a/TestLinux/main.cpp +++ b/TestLinux/main.cpp @@ -62,7 +62,7 @@ void testMatcher() { return; } - //steap2: push to firedog datasource + //step2: push to firedog datasource FireDog* fireDog = new FireDog(); ecode = fireDog->pushFeatureLibrary(featureLibrary); if (ecode != NO_ERROR) { @@ -78,7 +78,6 @@ void testMatcher() { } //step4: matcher bytes - int length = bytes.length(); MatcherFeature* mf = NULL; diff --git a/TestWindows/TestWindows.cpp b/TestWindows/TestWindows.cpp index 940b87c..d5fe050 100644 --- a/TestWindows/TestWindows.cpp +++ b/TestWindows/TestWindows.cpp @@ -65,7 +65,7 @@ void testMatcher() { return; } - //steap2: push to firedog datasource + //step2: push to firedog datasource FireDog* fireDog = new FireDog(); ecode = fireDog->pushFeatureLibrary(featureLibrary); if (ecode != NO_ERROR) { @@ -81,7 +81,6 @@ void testMatcher() { } //step4: matcher bytes - int length = bytes.length(); MatcherFeature* mf = NULL;