Function main

main.go:36–204

()

var wg sync.WaitGroup

func main() {
	var err error

	// create mutex to avoid program running multiple instances
	if _, err = CreateMutex("irmaBinMutex"); err != nil {
		logMessage(LOG_ERROR, "Only one instance or irma can be launched")
		os.Exit(1)
	}

	// clean and exit on CTRL+C
	c := make(chan os.Signal, 1)
	signal.Notify(c, os.Interrupt)
	go func() {
		for sig := range c {
			fmt.Printf("[INFO] captured %v, stopping irma and exiting..", sig)
			exit <- true
		}
	}()

	// parse arguments
	parser := argparse.NewParser("irma", "Incident Response - Minimal Analysis")
	pConfigurationFile := parser.String("c", "configuration", &argparse.Options{Required: true, Default: "configuration.yaml", Help: "yaml configuration file"})
	pBuilder := parser.String("b", "builder", &argparse.Options{Required: false, Default: "", Help: "create a standalone launcher executable with packed rules and configuration"})
	pLog := parser.String("o", "outfile", &argparse.Options{Required: false, Default: "", Help: "save log informations inside the specified file path"})

	err = parser.Parse(os.Args)
	if err != nil {
		fmt.Print(parser.Usage(err))
	}

	// read configuration file
	config.getConfiguration(*pConfigurationFile)
	if len(*pBuilder) > 0 {
		BuildSFX(config.Yara.Path, config.Yara.Rulesrc4key, config, *pBuilder)
		os.Exit(0)
	}

	maxFilesizeScan = config.Advancedparameters.MaxScanFilesize
	cleanIfFileSizeGreaterThan = config.Advancedparameters.CleanMemoryIfFileGreaterThanSize
	defaultScannedFileExtensions = config.Advancedparameters.Extensions
	quarantineKey = config.Response.QuarantineRC4Key

	// log inside a file
	if len(*pLog) > 0 {
		f, err := os.OpenFile(*pLog, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0666)
		if err != nil {
			log.Fatal(err)
		}

		out := os.Stdout
		mw := io.MultiWriter(out, f)
		r, w, _ := os.Pipe()

		os.Stdout = w
		os.Stderr = w

		go func() {
			_, _ = io.Copy(mw, r)