diff --git a/src/detections/utils.rs b/src/detections/utils.rs index deae75df..fc63bd0d 100644 --- a/src/detections/utils.rs +++ b/src/detections/utils.rs @@ -61,22 +61,20 @@ pub fn check_command( .unwrap() .is_match(commandline) { - /* - if let decoded = base64::decode(&base64) { - let mut d = GzDecoder::new(decoded.as_slice()); - let mut uncompressed = String::new(); - d.read_to_string(&mut uncompressed).unwrap(); - println!("Decoded : {}", uncompressed); - text.push_str("Base64-encoded and compressed function\n"); - + if let Ok(decoded) = base64::decode(&base64) { + let mut d = GzDecoder::new(decoded.as_slice()); + let mut uncompressed = String::new(); + d.read_to_string(&mut uncompressed).unwrap(); + println!("Decoded : {}", uncompressed); + text.push_str("Base64-encoded and compressed function\n"); } - */ } else { - let decoded = base64::decode(base64).unwrap(); - println!("Decoded : {}", str::from_utf8(decoded.as_slice()).unwrap()); - text.push_str("Base64-encoded function\n"); - text.push_str(&check_obfu(str::from_utf8(decoded.as_slice()).unwrap())); - text.push_str(&check_regex(str::from_utf8(decoded.as_slice()).unwrap(), 0)); + if let Ok(decoded) = base64::decode(&base64) { + println!("Decoded : {}", str::from_utf8(decoded.as_slice()).unwrap()); + text.push_str("Base64-encoded function\n"); + text.push_str(&check_obfu(str::from_utf8(decoded.as_slice()).unwrap())); + text.push_str(&check_regex(str::from_utf8(decoded.as_slice()).unwrap(), 0)); + } } } if !text.is_empty() {