# -*- coding:utf-8 -*-
# Made by Kei Choi(hanul93@gmail.com)

import os # ÆÄÀÏ »èÁ¦¸¦ À§ÇØ import
import hashlib # MD5 ÇØ½Ã¸¦ À§ÇØ import
import mmap
import kernel

#---------------------------------------------------------------------
# KavMain Å¬·¡½º
# Å°ÄÞ¹é½Å ¿£Áø ¸ðµâÀÓÀ» ³ªÅ¸³»´Â Å¬·¡½ºÀÌ´Ù.
# ÀÌ Å¬·¡½º°¡ ¾øÀ¸¸é ¹é½Å ¿£Áø Ä¿³Î ¸ðµâ¿¡¼­ ·ÎµùÇÏÁö ¾Ê´Â´Ù.
#---------------------------------------------------------------------
class KavMain :
    #-----------------------------------------------------------------
    # scan(self, filehandle, filename)
    # ¾Ç¼ºÄÚµå¸¦ °Ë»çÇÑ´Ù.
    # ÀÎÀÚ°ª : mmhandle         - ÆÄÀÏ mmap ÇÚµé
    #        : scan_file_struct - ÆÄÀÏ ±¸Á¶Ã¼
    #        : format           - ¹Ì¸® ºÐ¼®µÈ ÆÄÀÏ Æ÷¸Ë
    # ¸®ÅÏ°ª : (¾Ç¼ºÄÚµå ¹ß°ß ¿©ºÎ, ¾Ç¼ºÄÚµå ÀÌ¸§, ¾Ç¼ºÄÚµå ID) µîµî
    #-----------------------------------------------------------------
    def scan(self, mmhandle, scan_file_struct, format) :
        ret_value = {}
        ret_value['result']     = False # ¹ÙÀÌ·¯½º ¹ß°ß ¿©ºÎ
        ret_value['virus_name'] = ''    # ¹ÙÀÌ·¯½º ÀÌ¸§
        ret_value['scan_state'] = kernel.NOT_FOUND # 0:¾øÀ½, 1:°¨¿°, 2:ÀÇ½É, 3:°æ°í
        ret_value['virus_id']   = -1    # ¹ÙÀÌ·¯½º ID

        try : # ¹é½Å ¿£ÁøÀÇ ¿À·ù¸¦ ¹æÁöÇÏ±â À§ÇØ ¿¹¿Ü Ã³¸®¸¦ ¼±¾ð 
            mm = mmhandle # ÆÄÀÏ mmap ÇÚµéÀ» mm¿¡ ÀúÀå

            buf = mm[0:68] # ÆÄÀÏ Ã³À½ºÎÅÍ 68 Byte¸¦ ÀÐÀ½

            if len(buf) == 68 : # buf¿¡ 68 Byte°¡ ÀÐÇû³ª?
                md5 = hashlib.md5() # MD5 ÇØ½Ã¸¦ ±¸ÇÔ
                md5.update(buf)
                f_md5 = md5.hexdigest()

                eicar_pattern = '44d88612fea8a8f36de82e1278abb02f'

                if f_md5 == eicar_pattern :  # ÆÐÅÏÀÌ °°ÀºÁö¸¦ ºñ±³
                    # ¸Â´Ù¸é °Ë»ç °á°ú¿Í ÀÌ¸§, ID¸¦ ¸®ÅÏ
                    ret_value['result']     = True             # ¹ÙÀÌ·¯½º ¹ß°ß ¿©ºÎ
                    ret_value['virus_name'] = 'EICAR-Test-File (not a virus)' # ¹ÙÀÌ·¯½º ÀÌ¸§
                    ret_value['scan_state'] = kernel.INFECTED # 0:¾øÀ½, 1:°¨¿°, 2:ÀÇ½É, 3:°æ°í
                    ret_value['virus_id']   = 0                # ¹ÙÀÌ·¯½º ID
                    return ret_value
        except : # ¸ðµç ¿¹¿Ü»çÇ×À» Ã³¸®
            pass
        
        return ret_value

    #-----------------------------------------------------------------
    # disinfect(self, filename, malwareID)
    # ¾Ç¼ºÄÚµå¸¦ Ä¡·áÇÑ´Ù.
    # ÀÎÀÚ°ª : filename   - ÆÄÀÏ ÀÌ¸§
    #        : malwareID  - Ä¡·áÇÒ ¾Ç¼ºÄÚµå ID
    # ¸®ÅÏ°ª : ¾Ç¼ºÄÚµå Ä¡·á ¿©ºÎ
    #-----------------------------------------------------------------
    def disinfect(self, filename, malwareID) : # ¾Ç¼ºÄÚµå Ä¡·á
        try :
            # ¾Ç¼ºÄÚµå Áø´Ü °á°ú¿¡¼­ ¹ÞÀº ID °ªÀÌ 0ÀÎ°¡?
            if malwareID == 0 : 
                os.remove(filename) # ÆÄÀÏ »èÁ¦
                return True # Ä¡·á ¿Ï·á ¸®ÅÏ
        except :
            pass

        return False # Ä¡·á ½ÇÆÐ ¸®ÅÏ

    #-----------------------------------------------------------------
    # listvirus(self)
    # Áø´Ü/Ä¡·á °¡´ÉÇÑ ¾Ç¼ºÄÚµåÀÇ ¸ñ·ÏÀ» ¾Ë·ÁÁØ´Ù.
    #-----------------------------------------------------------------
    def listvirus(self) :
        vlist = [] # ¸®½ºÆ®Çü º¯¼ö ¼±¾ð
        vlist.append('EICAR Test') # Áø´ÜÇÏ´Â ¾Ç¼ºÄÚµå ÀÌ¸§ µî·Ï
        return vlist

    #-----------------------------------------------------------------
    # getinfo(self)
    # ¹é½Å ¿£Áø ¸ðµâÀÇ ÁÖ¿ä Á¤º¸¸¦ ¾Ë·ÁÁØ´Ù. (¹öÀü, Á¦ÀÛÀÚ...)
    #-----------------------------------------------------------------
    def getinfo(self) :
        info = {} # »çÀüÇü º¯¼ö ¼±¾ð
        info['author'] = 'Kei Choi' # Á¦ÀÛÀÚ
        info['version'] = '1.0'     # ¹öÀü
        info['title'] = 'EICAR Test Engine' # ¿£Áø ¼³¸í
        info['kmd_name'] = 'eicar' # ¿£Áø ÆÄÀÏ¸í

        # ÆÐÅÏ »ý¼º³¯Â¥¿Í ½Ã°£Àº ¾ø´Ù¸é ºôµå ½Ã°£À¸·Î ÀÚµ¿ ¼³Á¤
        info['date']    = 0   # ÆÐÅÏ »ý¼º ³¯Â¥ 
        info['time']    = 0   # ÆÐÅÏ »ý¼º ½Ã°£ 
        info['sig_num'] = 1 # ÆÐÅÏ ¼ö
        return info