Fixed output stop when control char exist in windows terminal (#485)
* added control character filter in details #382 * fixed document - removed fixed windows teminal caution in readme
This commit is contained in:
@@ -46,7 +46,6 @@ Hayabusaは、日本の[Yamato Security](https://yamatosecurity.connpass.com/)
|
||||
- [Hayabusaの実行](#hayabusaの実行)
|
||||
- [注意: アンチウィルス/EDRの誤検知](#注意-アンチウィルスedrの誤検知)
|
||||
- [Windows](#windows)
|
||||
- [Windows Terminalで利用する際の注意事項](#windows-terminalで利用する際の注意事項)
|
||||
- [Linux](#linux)
|
||||
- [macOS](#macos)
|
||||
- [使用方法](#使用方法)
|
||||
@@ -235,11 +234,6 @@ Hayabusaを実行する際にアンチウィルスやEDRにブロックされる
|
||||
コマンドプロンプトやWindows Terminalから32ビットもしくは64ビットのWindowsバイナリをHayabusaのルートディレクトリから実行します。
|
||||
例: `hayabusa-1.2.0-windows-x64.exe`
|
||||
|
||||
### Windows Terminalで利用する際の注意事項
|
||||
|
||||
2021/02/01の時点で、Windows Terminalから標準出力でhayabusaを使ったときに、コントロールコード(0x9D等)が検知結果に入っていると出力が止まることが確認されています。
|
||||
Windows Terminalからhayabusaを標準出力で解析させたい場合は、 `-c` (カラー出力)のオプションをつければ出力が止まることを回避できます。
|
||||
|
||||
## Linux
|
||||
|
||||
まず、バイナリに実行権限を与える必要があります。
|
||||
|
||||
@@ -46,7 +46,6 @@ Hayabusa is a **Windows event log fast forensics timeline generator** and **thre
|
||||
- [Running Hayabusa](#running-hayabusa)
|
||||
- [Caution: Anti-Virus/EDR Warnings](#caution-anti-virusedr-warnings)
|
||||
- [Windows](#windows)
|
||||
- [Caution: Windows Terminal Bug](#caution-windows-terminal-bug)
|
||||
- [Linux](#linux)
|
||||
- [macOS](#macos)
|
||||
- [Usage](#usage)
|
||||
@@ -228,12 +227,6 @@ You may receive warning from anti-virus or EDR when trying to run hayabusa. Thes
|
||||
In Command Prompt or Windows Terminal, just run 32-bit or 64-bit Windoows binary from the hayabusa root directory.
|
||||
Example: `hayabusa-1.2.0-windows-x64.exe`
|
||||
|
||||
### Caution: Windows Terminal Bug
|
||||
|
||||
As of Feb 1, 2022, Windows Terminal will freeze midway when displaying results to the screen when run against the sample evtx files.
|
||||
This is because there is a control code (0x9D) in the output.
|
||||
This is known Windows Terminal bug which will eventually be fixed but for the meantime, you can avoid this bug by adding the `-c` (colored output) option when you run hayabusa.
|
||||
|
||||
## Linux
|
||||
|
||||
You first need to make the binary executable.
|
||||
|
||||
+8
-1
@@ -199,7 +199,14 @@ fn emit_csv<W: std::io::Write>(
|
||||
computer: &format!(" {} ", &detect_info.computername),
|
||||
event_i_d: &format!(" {} ", &detect_info.eventid),
|
||||
rule_title: &format!(" {} ", &detect_info.alert),
|
||||
details: &format!(" {}", &detect_info.detail),
|
||||
details: &format!(
|
||||
" {}",
|
||||
&detect_info
|
||||
.detail
|
||||
.chars()
|
||||
.filter(|&c| !c.is_control())
|
||||
.collect::<String>()
|
||||
),
|
||||
})?;
|
||||
}
|
||||
} else {
|
||||
|
||||
Reference in New Issue
Block a user