EICAR 0.0.1 → 0.0.2

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    YWNjZTEyOWNkYTY3NmNkOWVjYTVkZTkwYWU2NDdmNzQwNGI4ZGY5ZA==
+    ZjlhMmQxY2JiY2ZkM2RhOGVhMmU5YWY2NzA0NDI4NTdlMDVkOWY5Yw==
   data.tar.gz: !binary |-
-    ZTA0OWI5ZjM2OWU4ZmQwNGMzYTdiYmZhYWU3M2Y5MzkwMzYyZDg1Ng==
+    NDRmNzcxZDA4NzI4NDUzMjVkMGE1ZDY5YzY4NGNjZDk4N2UwY2I5Nw==
 SHA512:
   metadata.gz: !binary |-
-    MGY4YmM1NmRkYjc4ZjRlZDAxMzUyNDNlNDgwYTdhZDMwMTYwOWYxZTIzNzNm
-    ZDkyY2FmMGFlYTQwZDlmMjE2Zjg1MTM4NGVlNmIyNjlhOWEwNjkxNzFmODYz
-    MTdkZDcyYzMyOThmZDhiZTgwN2I1OTU2MDcyM2IxOGEyMTM2NTg=
+    ODdmYzVjODJiYjc5N2U1NTRlNjM3ZGI1NTVhY2QyOTk1NDY0NWJlNmU0NDIx
+    ODU1ODg0ODJmOGFlNWJlNzJmZjU1MGY0ZWM0ZTIxZTgwYjBlYWUwM2Y0YzBk
+    MGNhYTIxNDdkOWZkOTg1NGQzOGMyNzc0YWU1Mjg1M2RjZGRhNDI=
   data.tar.gz: !binary |-
-    MGY2YzRiMDFiNWQzM2YyNTU0MTA3MzMxYjQxNWI2YTM1OWNjYWIxZDBjZjc2
-    ZWYyODU5NzM5OTc1ZGZlYTA5MWU1NWQ0Mjg0NjEyODM5YThmMTM0NDQxYWU3
-    MTFmOTAwZjViYmEwMDY0ODVjYWI2OWRjNDFkMjVlZTEwM2JlMWQ=
+    YmI4ZDc0MDRiYTMyNjNiMmE3MzUyMDE2MWJmZDQ5ODAxMmNkYTk0NTk5YmY4
+    MGFiMGI0MzYyNWYzZmJiMzAyYzYwMjdmYThmOTc0Nzg1ZGU0MmQxYjgwMGI3
+    YTExM2I3YmNkM2MyYmE5MTZiNzdkNzQ5NzdmMjdjNzQ4OTA3YzU=

data/README.md

@@ -1,7 +1,10 @@
-eicar
+EICAR
 =====
 
-EICAR test string for anti-virus functionality detection
+The EICAR gem provides the [EICAR test
+file](https://en.wikipedia.org/wiki/EICAR_test_file) as
+[bin/eicar.com](bin/eicar.com),
+used to test anti-virus detection functionality.
 
 Usage
 =====
@@ -19,7 +22,7 @@ load. I know, it's a little backwards.
 
 Code exercising this might look like this:
 
-````
+````ruby
 #!/usr/bin/env ruby
 
 begin
@@ -29,6 +32,25 @@ rescue EICAR::EICARReadError
 end
 ````
 
+If A/V is later enabled, an application can monitor its status. Here's a
+simplistic example:
+
+````ruby
+until EICAR.antivirus_active? do
+  sleep 1
+  puts "A/V hasn't caught EICAR yet"
+end
+puts "A/V is active in #{ENV['GEM_HOME']}."
+````
+
+Expected Results
+================
+
+Below is a screenshot from Microsoft Security Essentials successfully
+detecting [bin/eicar.com](bin/eicar.com) and placing it in quarantine.
+
+![MSE Screenshot](images/eicar-success-mse.png)
+
 TODO
 ====
 

data/lib/eicar.rb

@@ -2,6 +2,9 @@ require 'eicar/version'
 
 module EICAR
 
+  # Antivirus should /not/ pick this up, ever.
+  ROT13_DOWNCASE_EICAR = "k5b!c%@nc[4cmk54(c^)7pp)7}$rvpne-fgnaqneq-nagvivehf-grfg-svyr!$u+u*"
+
   def self.version
     EICAR::VERSION
   end
@@ -12,17 +15,49 @@ module EICAR
   class EICARReadError < Error
   end
 
-  def self.test_string
+  class EICARWriteError < Error
+  end
+
+  def self.test_file_path
     lib_path = File.expand_path(File.dirname(__FILE__))
     bin_path = File.expand_path(File.join(lib_path, "..", "bin"))
-    com_file = File.join(bin_path, "eicar.com")
+    File.join(bin_path, "eicar.com")
+  end
+
+  def self.test_string
     begin
-    data = File.open(com_file, "rb") {|f| f.read f.stat.size}
+    data = File.open(self.test_file_path, "rb") {|f| f.read f.stat.size}
     rescue SystemCallError
       raise EICAR::EICARReadError
     end
   end
 
+  def self.antivirus_active?
+    begin
+      self.test_string
+    rescue EICAR::EICARReadError
+      return true
+    end
+    return false
+  end
+
+  def self.rot13(str)
+    str.tr "A-Za-z", "N-ZA-Mn-za-m"
+  end
+
+  # Returns a TrueClass if the file was created and is readable in the
+  # expected path. For system-wide gem installs, this will usually need
+  # to be run as root, or else you'll raise.
+  def self.create
+    data = self.rot13(ROT13_DOWNCASE_EICAR).upcase
+    begin
+      File.open(self.test_file_path, "wb") {|f| f.write data}
+    rescue SystemCallError
+      raise EICAR::EICARWriteError
+    end
+    File.readable? self.test_file_path
+  end
+
 end
 
 EICAR.test_string

data/lib/eicar/version.rb

@@ -1,3 +1,3 @@
 module EICAR
-  VERSION = '0.0.1'
+  VERSION = '0.0.2'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: EICAR
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Tod Beardsley
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-12-30 00:00:00.000000000 Z
+date: 2013-12-31 00:00:00.000000000 Z
 dependencies: []
 description: ! "\n    This gem is designed to fail in the face of anti-virus coverage\n
   \   of your gem path. If you are running anti-virus systemwide, this\n    gem will
@@ -22,12 +22,13 @@ files:
 - .gitignore
 - .ruby-gemset
 - .ruby-version
+- EICAR.gemspec
 - Gemfile
 - Gemfile.lock
 - LICENSE
 - README.md
 - bin/eicar.com
-- eicar.gemspec
+- images/eicar-success-mse.png
 - lib/eicar.rb
 - lib/eicar/version.rb
 homepage: https://github.com/todb-r7/eicar