Skip to content

Instantly share code, notes, and snippets.

@rjzak
Last active March 1, 2021 21:21
Show Gist options
  • Select an option

  • Save rjzak/8293442 to your computer and use it in GitHub Desktop.

Select an option

Save rjzak/8293442 to your computer and use it in GitHub Desktop.
Search and Collect scrapes all the Windows executables (PE files) in a Windows system and copies the files into the destination directory. This is the Python version of the code at https://github.com/IOActive/SearchAndCollect.
#!/usr/bin/python
import os, sys, hashlib, shutil
sha256 = lambda data: hashlib.sha256(data).hexdigest()
def searchAndCollect(src, dest):
print "Searching %s for .exe's, saving to %s" % (src, dest)
for dirpath, dirnames, filenames in os.walk(src):
if src in dirnames:
print "Skipping target directory."
continue
for filename in filenames:
try:
data = open(os.path.join(dirpath, fileName), 'rb').read()
if data[0:2] == 'MZ' or data[0:2] == 'ZM':
datahash = sha256(data)
try:
if not os.path.exists(os.path.join(dest, datahash)):
shutil.copy( os.path.join(dirpath, fileName), os.path.join(dest, datahash) )
except Exception as e:
print "Error copying %s: %s" % (fileName, str(e))
except Exception as e:
print "Error reading %s: %s" % (fileName, str(e))
if __name__ == '__main__':
if len(sys.argv) != 3:
print "Usage: %s <SRC_DIR> <DEST_DIR>" % sys.argv[0]
print "SearchAndCollect, Python edition, 1.2"
print "Collects and Stores Windows executables in the destination directory by SHA-256 hash."
sys.exit(1)
searchAndCollect(sys.argv[1], sys.argv[2])
@matouskozak

Copy link
Copy Markdown

Looks to me that you are missing a for cycle at line 15.
for fileName in filenames:

@rjzak

rjzak commented Mar 1, 2021

Copy link
Copy Markdown
Author

Good catch, updated.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment