Skip to content

Commit

Permalink
Rearrange scripts to prevent double-loading in plugin and package space
Browse files Browse the repository at this point in the history
The Zeek scripts were loaded twice after installation, once via the plugin
subsystem and once via zkg also pointing at the scripts folder. Since
installation puts these sets of files in two separate locations, Zeek's
path-based recognition of redundant loads of a script doesn't catch, and Zeek
aborts due to redundant symbols etc.

This package has no script content that needs to be loaded at plugin bootstrap
time, so this commit shifts the content into the existing subdirectory of the
scripts folder and updates zkg accordingly.
  • Loading branch information
ckreibich committed Oct 31, 2023
1 parent 331a00d commit f1ea9f9
Show file tree
Hide file tree
Showing 4 changed files with 1 addition and 8 deletions.
1 change: 0 additions & 1 deletion scripts/Corelight/PE_XOR/__load__.zeek
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,3 @@
#

@load ./main

6 changes: 0 additions & 6 deletions scripts/__load__.zeek
Original file line number Diff line number Diff line change
@@ -1,8 +1,2 @@
# This is loaded unconditionally at Zeek startup. Include scripts here that should
# always be loaded.

@load ./init
@load ./Corelight/PE_XOR



Empty file removed scripts/init.zeek
Empty file.
2 changes: 1 addition & 1 deletion zkg.meta
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,6 @@
description = A plugin to find Windows executables that have been XOR encoded.
tags = plugin, pe, executable, malware
plugin_dir = build
script_dir = scripts
script_dir = scripts/Corelight/PE_XOR
build_command = ./configure && make
test_command = cd tests && btest -d

0 comments on commit f1ea9f9

Please sign in to comment.