Skip to content

Instantly share code, notes, and snippets.

@rjzak
Last active March 1, 2021 21:21
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save rjzak/8293442 to your computer and use it in GitHub Desktop.
Save rjzak/8293442 to your computer and use it in GitHub Desktop.
Search and Collect scrapes all the Windows executables (PE files) in a Windows system and copies the files into the destination directory. This is the Python version of the code at https://github.com/IOActive/SearchAndCollect.
#!/usr/bin/python
import os, sys, hashlib, shutil
sha256 = lambda data: hashlib.sha256(data).hexdigest()
def searchAndCollect(src, dest):
print "Searching %s for .exe's, saving to %s" % (src, dest)
for dirpath, dirnames, filenames in os.walk(src):
if src in dirnames:
print "Skipping target directory."
continue
for filename in filenames:
try:
data = open(os.path.join(dirpath, fileName), 'rb').read()
if data[0:2] == 'MZ' or data[0:2] == 'ZM':
datahash = sha256(data)
try:
if not os.path.exists(os.path.join(dest, datahash)):
shutil.copy( os.path.join(dirpath, fileName), os.path.join(dest, datahash) )
except Exception as e:
print "Error copying %s: %s" % (fileName, str(e))
except Exception as e:
print "Error reading %s: %s" % (fileName, str(e))
if __name__ == '__main__':
if len(sys.argv) != 3:
print "Usage: %s <SRC_DIR> <DEST_DIR>" % sys.argv[0]
print "SearchAndCollect, Python edition, 1.2"
print "Collects and Stores Windows executables in the destination directory by SHA-256 hash."
sys.exit(1)
searchAndCollect(sys.argv[1], sys.argv[2])
@matouskozak
Copy link

Looks to me that you are missing a for cycle at line 15.
for fileName in filenames:

@rjzak
Copy link
Author

rjzak commented Mar 1, 2021

Good catch, updated.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment