my $rulesdir = "C:\\Snort\\rules"; my @rulefiles = glob "$rulesdir/sample.txt"; my @headers; for my $rulefile (@rulefiles){ open my $INFILE, "<", $rulefile or die "Can't open $rulefile $!"; my $header; while ( my $line = <$INFILE> ) { # see if this line contains opening bracket if ( $line =~ m/\(/ ) { my $pos = index( $line, '(' ); last unless $pos > 0; $header .= substr( $line, 0, $pos ); last; } else { $header .= $line; } } close $INFILE; push( @headers, $header ) if $header; } for my $header ( @headers ) { print "\nHeader:\n$header\n"; # now process the header } # Adding hex conversion part here. Still adding to "camdata.txt" has not been accomplished for $header(@headers){ $pipe = 0; # hex patterns are limited by pipes; |00 bc 55| $char = ""; # Current character in header; ASCII or hex $pattern = ""; # header converted to hex # Loop through current header-string for ($i=0; $i<=length($header)-1; $i++){ # -1 for newline || Need more elaboration $char = substr($header, $i, 1); # || substr EXPR,OFFSET,LENGTH Returns from position i, only one bit from the header string # Control over pipes if($char =~ /\|/){ if(!$pipe){ $pipe = 1; } else { $pipe = 0; } next; # Skip to next character } # Convert to lowcase hex if(!$pipe){ # ASCII-value $pattern .= sprintf("%x", ord($char)); } else { # hex-value $char =~ s/ //; # Remove blanks $pattern .= "\l$char"; } } # Store converted pattern if((length($pattern) >= $minLength*2) && (length($pattern) <= $maxLength*2)){ $hexPatterns{$pattern} = "dummyValue"; # Keys will be distinct } } # Print patterns, that have no subsets, to file open(OUTFILE, ">".$camfile) or die "Can't open ".$camfile."\n"; @patterns = keys %hexPatterns; $count = 0; # Count patterns that are written to file HEXLOOP: for($i=0; $i<=$#patterns; $i++){ for($j=0; $j<=$#patterns; $j++){ # Search for subsets next if($i==$j); # Do not compare a pattern with itself next HEXLOOP if # Skip if subset is found ((length($patterns[$i]) <= length($patterns[$j])) && ($patterns[$j] =~ /$patterns[$i]/)); } print OUTFILE $patterns[$i]."\n"; $count++; } close(OUTFILE); # msg print "\n". " Wrote ".$count." patterns to file: \"".$camfile."\"\n". "\n"; # Is the hex part being added to camdata.txt as it is?