132 lines
4.8 KiB
ReStructuredText
132 lines
4.8 KiB
ReStructuredText
:tocdepth: 3
|
|
|
|
base/files/pe/main.zeek
|
|
=======================
|
|
.. zeek:namespace:: PE
|
|
|
|
|
|
:Namespace: PE
|
|
:Imports: :doc:`base/files/pe/consts.zeek </scripts/base/files/pe/consts.zeek>`
|
|
|
|
Summary
|
|
~~~~~~~
|
|
Types
|
|
#####
|
|
========================================== =
|
|
:zeek:type:`PE::Info`: :zeek:type:`record`
|
|
========================================== =
|
|
|
|
Redefinitions
|
|
#############
|
|
============================================================= ==================================================
|
|
:zeek:type:`Log::ID`: :zeek:type:`enum`
|
|
|
|
* :zeek:enum:`PE::LOG`
|
|
:zeek:type:`fa_file`: :zeek:type:`record` :zeek:attr:`&redef`
|
|
|
|
:New Fields: :zeek:type:`fa_file`
|
|
|
|
pe: :zeek:type:`PE::Info` :zeek:attr:`&optional`
|
|
============================================================= ==================================================
|
|
|
|
Events
|
|
######
|
|
========================================= ===================================
|
|
:zeek:id:`PE::log_pe`: :zeek:type:`event` Event for accessing logged records.
|
|
========================================= ===================================
|
|
|
|
Hooks
|
|
#####
|
|
======================================================= ====================================================
|
|
:zeek:id:`PE::log_policy`: :zeek:type:`Log::PolicyHook`
|
|
:zeek:id:`PE::set_file`: :zeek:type:`hook` A hook that gets called when we first see a PE file.
|
|
======================================================= ====================================================
|
|
|
|
|
|
Detailed Interface
|
|
~~~~~~~~~~~~~~~~~~
|
|
Types
|
|
#####
|
|
.. zeek:type:: PE::Info
|
|
:source-code: base/files/pe/main.zeek 10 45
|
|
|
|
:Type: :zeek:type:`record`
|
|
|
|
ts: :zeek:type:`time` :zeek:attr:`&log`
|
|
Current timestamp.
|
|
|
|
id: :zeek:type:`string` :zeek:attr:`&log`
|
|
File id of this portable executable file.
|
|
|
|
machine: :zeek:type:`string` :zeek:attr:`&log` :zeek:attr:`&optional`
|
|
The target machine that the file was compiled for.
|
|
|
|
compile_ts: :zeek:type:`time` :zeek:attr:`&log` :zeek:attr:`&optional`
|
|
The time that the file was created at.
|
|
|
|
os: :zeek:type:`string` :zeek:attr:`&log` :zeek:attr:`&optional`
|
|
The required operating system.
|
|
|
|
subsystem: :zeek:type:`string` :zeek:attr:`&log` :zeek:attr:`&optional`
|
|
The subsystem that is required to run this file.
|
|
|
|
is_exe: :zeek:type:`bool` :zeek:attr:`&log` :zeek:attr:`&default` = ``T`` :zeek:attr:`&optional`
|
|
Is the file an executable, or just an object file?
|
|
|
|
is_64bit: :zeek:type:`bool` :zeek:attr:`&log` :zeek:attr:`&default` = ``T`` :zeek:attr:`&optional`
|
|
Is the file a 64-bit executable?
|
|
|
|
uses_aslr: :zeek:type:`bool` :zeek:attr:`&log` :zeek:attr:`&default` = ``F`` :zeek:attr:`&optional`
|
|
Does the file support Address Space Layout Randomization?
|
|
|
|
uses_dep: :zeek:type:`bool` :zeek:attr:`&log` :zeek:attr:`&default` = ``F`` :zeek:attr:`&optional`
|
|
Does the file support Data Execution Prevention?
|
|
|
|
uses_code_integrity: :zeek:type:`bool` :zeek:attr:`&log` :zeek:attr:`&default` = ``F`` :zeek:attr:`&optional`
|
|
Does the file enforce code integrity checks?
|
|
|
|
uses_seh: :zeek:type:`bool` :zeek:attr:`&log` :zeek:attr:`&default` = ``T`` :zeek:attr:`&optional`
|
|
Does the file use structured exception handing?
|
|
|
|
has_import_table: :zeek:type:`bool` :zeek:attr:`&log` :zeek:attr:`&optional`
|
|
Does the file have an import table?
|
|
|
|
has_export_table: :zeek:type:`bool` :zeek:attr:`&log` :zeek:attr:`&optional`
|
|
Does the file have an export table?
|
|
|
|
has_cert_table: :zeek:type:`bool` :zeek:attr:`&log` :zeek:attr:`&optional`
|
|
Does the file have an attribute certificate table?
|
|
|
|
has_debug_data: :zeek:type:`bool` :zeek:attr:`&log` :zeek:attr:`&optional`
|
|
Does the file have a debug table?
|
|
|
|
section_names: :zeek:type:`vector` of :zeek:type:`string` :zeek:attr:`&log` :zeek:attr:`&optional`
|
|
The names of the sections, in order.
|
|
|
|
|
|
Events
|
|
######
|
|
.. zeek:id:: PE::log_pe
|
|
:source-code: base/files/pe/main.zeek 48 48
|
|
|
|
:Type: :zeek:type:`event` (rec: :zeek:type:`PE::Info`)
|
|
|
|
Event for accessing logged records.
|
|
|
|
Hooks
|
|
#####
|
|
.. zeek:id:: PE::log_policy
|
|
:source-code: base/files/pe/main.zeek 8 8
|
|
|
|
:Type: :zeek:type:`Log::PolicyHook`
|
|
|
|
|
|
.. zeek:id:: PE::set_file
|
|
:source-code: base/files/pe/main.zeek 66 70
|
|
|
|
:Type: :zeek:type:`hook` (f: :zeek:type:`fa_file`) : :zeek:type:`bool`
|
|
|
|
A hook that gets called when we first see a PE file.
|
|
|
|
|