парсер GO Lang Log Sorter

[DimmuBurgor]

Written for Windows. Requires go compiler which can be downloaded as installer https://go.dev/dl/go1.20.4.windows-amd64.msi or from source https://go.dev/dl/go1.20.4.src.tar.gz. Add 'go' to environment variables and compile using 'go build filename.go', launch using './filename.exe'. This is the most current version of the program I wrote and shared in the 'Underground' Logs thread, except I removed the user defined filename input and replaced it with a slice of all the different stealer naming schemas I could find to make things simpler. Also fixed a problem with the buffer that was preventing real-time match displays to the terminal and to output. If anybody wants to suggest a different feature let me know in the comments and if it's reasonable I will include it.

package main

import (
    "bufio"
    "fmt"
    "io/ioutil"
    "log"
    "os"
    "path/filepath"
    "regexp"
    "strings"
)

func main() {
    var searchPaths []string
    for {
        var searchPath string
        fmt.Print("Search Filepaths: ")
        fmt.Scan(&searchPath)
        searchPaths = append(searchPaths, searchPath)
        fmt.Print("Add another search path? (y/n): ")
        var response string
        fmt.Scan(&response)
        if strings.ToLower(response) != "y" {
            break
        }
    }

    fileNames := []string{"passwords.txt", "passwordslist.txt", "_allpasswords_list.txt", "_filepasswords.txt", "[edge_default]_passwords.txt"}

    var searchString string
    fmt.Print("Enter a search string or URL: ")
    fmt.Scan(&searchString)

    var outputFilePath string
    fmt.Print("Save results to: ")
    fmt.Scan(&outputFilePath)

    outputFile, err := os.Create(outputFilePath)
    if err != nil {
        log.Fatal(err)
    }
    defer outputFile.Close()

    outputWriter := bufio.NewWriter(outputFile)

    searchRegexp := regexp.MustCompile(searchString)

    var matchCount int
    for _, searchPath := range searchPaths {
        err := filepath.Walk(searchPath, func(path string, info os.FileInfo, err error) error {
            if isExcluded(path) {
                if info.IsDir() {
                    return filepath.SkipDir
                }
                return nil
            }

            for _, filename := range fileNames {
                if info.Name() == filename {
                    fileMatchCount := 0

                    fileContents, err := ioutil.ReadFile(path)
                    if err != nil {
                        log.Println(err)
                        return nil
                    }

                    scanner := bufio.NewScanner(strings.NewReader(string(fileContents)))
                    for scanner.Scan() {
                        if searchRegexp.MatchString(scanner.Text()) {
                            matchCount++
                            fileMatchCount++
                            outputWriter.WriteString(scanner.Text() + "\n")
                            for i := 0; i < 2; i++ {
if scanner. Scan() {
outputWriter.WriteString(scanner. Text() + "\n")
                                }
                            }
                        }
                    }
if err := scanner. Err(); err != nil {
.log. Println(err)
                    }

                    if fileMatchCount > 0 {
fmt. Printf("Found %d matches in %s\n", fileMatchCount, path)
                    }
                }
            }

            return nil
        })
        if err != nil {
.log. Println(err)
        }
    }

    err = outputWriter.Flush()
    if err != nil {
.log. Fatal(err)
    }

fmt. Printf("Found a total of %d matches\n", matchCount)
}

func isExcluded(path string) bool {
    excludedDirectories := []string{
        "\\AppData\\",
        "\\Program Files\\",
        "\\Program Files (x86)\\",
        "\\Windows\\",
        "\\Page File",
        "\\System Volume Information\\",
        "\\WinSxS\\",
        "\\D3Dscache",
        "\\Riot Games\\Riot Client\\Logs\\",
    }

    for _, directory := range excludedDirectories {
if strings. Contains(path, directory) {
            return true
        }
    }

    return false
}