base/files/extract/main.bro

FileExtract

Namespace:FileExtract Imports:base/frameworks/files, base/utils/paths.bro Source File:/scripts/base/files/extract/main.bro

Summary

Runtime Options

FileExtract::default_limit: count &redef

The default max size for extracted files (they won’t exceed this number of bytes).

Redefinable Options

FileExtract::prefix: string &redef

The prefix where files are extracted to.

Redefinitions

Files::AnalyzerArgs: record &redef
Files::Info: record &redef

Functions

FileExtract::set_limit: function

Sets the maximum allowed extracted file size.

Detailed Interface

Runtime Options

FileExtract::default_limit

Type:count Attributes:&redef Default:104857600

The default max size for extracted files (they won’t exceed this number of bytes). A value of zero means unlimited.

Redefinable Options

FileExtract::prefix

Type:string Attributes:&redef Default:"./extract_files/"

The prefix where files are extracted to.

Functions

FileExtract::set_limit

Type:function (f: fa_file, args: Files::AnalyzerArgs, n: count) : bool

Sets the maximum allowed extracted file size.

F:A file that’s being extracted. Args:Arguments that identify a file extraction analyzer. N:Allowed number of bytes to be extracted. Returns:false if a file extraction analyzer wasn’t active for the file, else true.