GetFileInfo returns file metadata for the given path. The file metadata consists of information extracted from the Portable Executable headers.
(path string)
| 83 | // The file metadata consists of information extracted |
| 84 | // from the Portable Executable headers. |
| 85 | func GetFileInfo(path string) (*FileInfo, error) { |
| 86 | for _, pat := range skippedPatterns { |
| 87 | if wildcard.Match(pat, path) { |
| 88 | return nil, ErrSkippedFile(path) |
| 89 | } |
| 90 | } |
| 91 | |
| 92 | ext := filepath.Ext(path) |
| 93 | switch strings.ToLower(ext) { |
| 94 | case ".exe": |
| 95 | return &FileInfo{IsExecutable: true}, nil |
| 96 | case ".sys": |
| 97 | return &FileInfo{IsDriver: true}, nil |
| 98 | case ".dll": |
| 99 | pefile, err := pe.ParseFile(path, parserOpts...) |
| 100 | if err != nil { |
| 101 | return &FileInfo{IsDLL: true}, nil |
| 102 | } |
| 103 | return &FileInfo{IsDLL: true, IsDotnet: pefile.IsDotnet}, nil |
| 104 | } |
| 105 | |
| 106 | pefile, err := pe.ParseFile(path, parserOpts...) |
| 107 | if err != nil { |
| 108 | return nil, err |
| 109 | } |
| 110 | |
| 111 | return &FileInfo{ |
| 112 | IsExecutable: pefile.IsExecutable, |
| 113 | IsDLL: pefile.IsDLL, |
| 114 | IsDriver: pefile.IsDriver, |
| 115 | IsDotnet: pefile.IsDotnet, |
| 116 | }, nil |
| 117 | } |
| 118 | |
| 119 | // queryVolumeCalls represents the number of times the query volume function was called |
| 120 | var queryVolumeCalls = expvar.NewInt("file.query.volume.info.calls") |