-
Notifications
You must be signed in to change notification settings - Fork 41
Description
Trying out latest malwarehouse.py on a couple of systems. It appears
that the magic library used in malwarehouse is different than that of
other systems I have. The version on my FreeBSD and OS X don't
implement the magic.Magic class. OpenBSD does.
I notice MHL ran up against this in pescanner.py too. This is how he
handled it there:
-----
def get_filetype(data):
"""There are two versions of python-magic floating around, and
annoyingly, the interface
changed between versions, so we try one method and if it fails,
then we try the other.
NOTE: you may need to alter the magic_file for your system to
point to the magic file."""
if sys.modules.has_key('magic'):
try:
ms = magic.open(magic.MAGIC_NONE)
ms.load()
return ms.buffer(data)
except:
try:
return magic.from_buffer(data)
except magic.MagicException:
magic_custom =
magic.Magic(magic_file='C:\windows\system32\magic')
return magic_custom.from_buffer(data)
return ''