Commit Graph

19 Commits

Author SHA1 Message Date
pandaadir05
a8fe6ed2f8 Fix CI/CD validation errors
- Add allow dead_code to unused helper function
- Remove redundant PID assertion in macOS test
- All clippy checks pass with -D warnings
- All tests passing (33/33)
2025-11-21 13:53:30 +02:00
pandaadir05
f0606d7835 fix: cargo formatting for ci/cd 2025-11-21 12:52:08 +02:00
pandaadir05
2bcfcac407 Fix anomaly detection issues and add missing functionality
Fixed issues:
- Corrected Welford's online algorithm for variance calculation
- Added NaN and infinity guards to prevent invalid calculations
- Added Serialize/Deserialize traits to AnomalyScore and ProcessProfile

Added functionality:
- Profile persistence with save_profiles() and load_profiles()
- Global baseline computation from all process profiles
- Profile cleanup method to remove stale profiles
- Additional utility methods for profile management
2025-11-21 12:49:42 +02:00
pandaadir05
3414d05821 Fix YARA compiler move error by simplifying rule compilation
- Replace add_rules_str_with_namespace with add_rules_str to avoid move semantics issues
- Simplify error handling in rule compilation loop
- This should resolve the E0382 use of moved value error
2025-11-21 02:01:52 +02:00
pandaadir05
d8d562ddf1 Fix compilation errors from clippy fixes
- Fix '?' operator error in detection.rs by proper error handling without changing return type
- Fix EbpfError::RuntimeError to use existing EventProcessingError variant
- Make compiler mutable in yara_engine.rs to fix move errors
- Add missing evasion_analysis field to DetectionResult struct
- Fix identifier clone issue in YARA rule matching

These fixes resolve the E0277, E0382, and E0599 compilation errors.
2025-11-21 01:59:43 +02:00
pandaadir05
53b77ad1bf Fix clippy warnings: replace unwrap/expect calls with proper error handling
- Replace unwrap() in detection.rs runtime creation with error handling
- Fix expect() in Default impl with proper panic message
- Replace unwrap() in streaming.rs mutex locks with error handling
- Replace unwrap() in ebpf.rs ring buffer locks with error handling
- Fix unwrap() in hooks.rs CString creation with error handling
- Remove needless borrows in yara_engine.rs iterators
- Apply cargo fmt formatting across all files

All changes maintain functional behavior while improving error handling robustness.
2025-11-21 01:56:46 +02:00
pandaadir05
e5abcf8652 Fix YARA compiler move issue by extracting compiled_rules first 2025-11-21 01:50:32 +02:00
pandaadir05
10cf5551ff Fix license issues in cargo-deny config and refactor YARA compiler usage 2025-11-21 01:49:28 +02:00
pandaadir05
67d3ab9ed5 Fix YARA engine: remove unused Scanner import, fix compiler move issue, remove non-existent description field 2025-11-21 01:42:57 +02:00
pandaadir05
de355e4faa Fix compilation errors: ConfigurationError variants, Scanner API, and tokio runtime handling 2025-11-21 01:40:10 +02:00
pandaadir05
0c8721a08a Fix all syntax errors and apply cargo fmt 2025-11-21 01:37:32 +02:00
pandaadir05
c2ad82b687 Fix syntax errors in yara_engine.rs 2025-11-21 01:34:41 +02:00
pandaadir05
407bba8ae5 debugging and fixing cicd 2025-11-21 01:32:33 +02:00
Adir Shitrit
45b95ce7d3 fix: formatting the code for cicd 2025-11-21 00:42:16 +02:00
Adir Shitrit
bcf934fac2 Add YARA dependency and implement rule compilation
- Added yara crate v0.28 to ghost-core dependencies
- Implemented real YARA rule compilation from .yar/.yara files
- Added recursive rule file discovery in rules directory
- Implemented memory scanning with compiled YARA rules
- Added proper error handling for rule compilation and scanning
- Cross-platform memory reading support (Windows, Linux, macOS stub)

Generated with [Claude Code](https://claude.com/claude-code)
2025-11-21 00:35:37 +02:00
pandaadir05
934b367f49 Re-enable disabled tests and reduce warnings to 8 2025-11-20 14:53:31 +02:00
pandaadir05
e44f58e308 Standardize import ordering and code formatting 2025-11-20 14:25:44 +02:00
pandaadir05
34007d11c1 fix: Resolve 44 compilation errors in ghost-core 2025-11-17 22:26:53 +02:00
Adir Shitrit
65768c6600 add dynamic YARA rule engine 2025-11-08 13:32:41 +02:00