int entrypoint ()
{
int i;
int32_t type, obj, objarr, objit, arrlen, strlen;
char str[STR_MAXLEN];
/* check is json is available, alerts on inactive (optional) */
if (!json_is_active()) {
return -1;
}
/* acquire array of internal contained objects */
objarr = json_get_object("ContainedObjects", 16, 0);
type = json_get_type(objarr);
/* debug print uint (no '\n' or prepended message */
debug_print_uint(type);
if (type != JSON_TYPE_ARRAY) {
return -1;
}
/* check array length for iteration over elements */
arrlen = json_get_array_length(objarr);
for (i = 0; i < arrlen; ++i) {
/* acquire json object @ idx i */
objit = json_get_array_idx(i, objarr);
if (objit <= 0) continue;
/* acquire FileType object of the array element @ idx i */
obj = json_get_object("FileType", 8, objit);
if (obj <= 0) continue;
/* acquire and check type */
type = json_get_type(obj);
if (type == JSON_TYPE_STRING) {
/* acquire string length, note +1 is for the NULL terminator */
strlen = json_get_string_length(obj)+1;
/* prevent buffer overflow */
if (strlen > STR_MAXLEN)
strlen = STR_MAXLEN;
/* acquire string data, note strlen includes NULL terminator */
if (json_get_string(str, strlen, obj)) {
/* debug print str (with '\n' and prepended message */
debug_print_str(str,strlen);
/* check the contained object's type */
if (strlen == 14 && !memcmp(str, "CL_TYPE_MSEXE", 14)) {
//if (!strcmp(str, strlen, "CL_TYPE_MSEXE", strlen)) {
/* alert for submission */
foundVirus("EmbedPE");
return 0;
}
}
}
}
return 0;
}
static void print_json_prefix(struct JSON *node, char * prefix)
{
char new_prefix[256];
char *keyword, *type;
struct JSON *child, *next;
keyword = json_get_keyword(node);
type = json_get_type(node);
child = json_get_data_object(node);
next = json_get_next(node);
printf("%s",prefix);
if(keyword!=NULL){
printf("\"%s\": ", keyword);
if((strcmp(type,"object")==0 || strcmp(type,"array")==0) && child!=NULL){
/*printf("\n%s",prefix);*/
}
}
else{
printf("<null>");
}
if(strcmp(type,"string")==0){
printf("\"%s\"",json_get_data_string(node));
}
else if(strcmp(type,"number")==0){
if(node->is_integer){
printf("%lld",node->integer);
}
else{
printf("%f",json_get_data_number(node));
}
}
else if(strcmp(type,"boolean")==0){
printf("%s",json_get_data_boolean(node)?"true":"false");
}
else if(strcmp(type,"null")==0){
printf("null");
}
else if(strcmp(type,"object")==0){
snprintf(new_prefix, sizeof(new_prefix), "%s ", prefix);
if(child!=NULL){
printf("{\n");
print_json_prefix(child, new_prefix);
printf("%s}",prefix);
}
else {
printf("{}");
}
}
else if(strcmp(node->type,"array")==0){
if(child!=NULL){
snprintf(new_prefix, sizeof(new_prefix), "%s ", prefix);
printf("[\n");
print_json_prefix(child, new_prefix);
printf("%s]",prefix);
}
else {
printf("[]");
}
}
if(next){
printf(",\n");
print_json_prefix(next,prefix);
}
else{
printf("\n");
}
}
