fox/main.go at main · foxforensics/fox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
// SPDX-License-Identifier: GPL-3.0-or-later
//
//go:generate goversioninfo -arm -64 .goversion.json
package main

import (
	"fmt"
	"log"
	"log/slog"
	"os"
	"runtime"
	"runtime/debug"
	"strconv"
	"strings"
	_time "time"

	"github.com/alecthomas/kong"
	_ "github.com/josephspurrier/goversioninfo"
	"go.foxforensics.eu/fox/v5/internal/cmd"
	"go.foxforensics.eu/fox/v5/internal/cmd/ad"
	"go.foxforensics.eu/fox/v5/internal/cmd/cat"
	"go.foxforensics.eu/fox/v5/internal/cmd/hash"
	"go.foxforensics.eu/fox/v5/internal/cmd/help"
	"go.foxforensics.eu/fox/v5/internal/cmd/hunt"
	"go.foxforensics.eu/fox/v5/internal/cmd/info"
	"go.foxforensics.eu/fox/v5/internal/cmd/str"
	"go.foxforensics.eu/fox/v5/internal/cmd/time"
	"go.foxforensics.eu/fox/v5/internal/pkg"
)

var About = strings.TrimSpace(`
© 2026 Fox Forensics
`)

var Usage = strings.TrimSpace(`
Usage: fox {ad,cat,str,info,time,hash,hunt} <...>

Example: Find occurrences in event logs
  $ fox -FWinlogon ./**/*.evtx

Example: Hunt down critical events
  $ fox hunt -t *.dd

Use 'fox help' to show further information.
`)

type Fox struct {
	Ad   ad.Ad     `cmd:"" aliases:"a"`
	Cat  cat.Cat   `cmd:"" aliases:"c" default:"withargs"`
	Hash hash.Hash `cmd:"" aliases:"h"`
	Hunt hunt.Hunt `cmd:"" aliases:"x"`
	Info info.Info `cmd:"" aliases:"i"`
	Str  str.Str   `cmd:"" aliases:"s"`
	Time time.Time `cmd:"" aliases:"t"`

	// hidden commands
	Help help.Help `cmd:"" hidden:""`

	// support
	Version bool

	// global
	cmd.Globals
}

func main() {
	defer timer(_time.Now())
	defer trace()

	log.SetFlags(0)
	log.SetPrefix("FOX: ")
	slog.SetLogLoggerLevel(slog.LevelWarn)

	fox := new(Fox)
	ctx := kong.Parse(fox,
		kong.NoDefaultHelp(),
		kong.Name("FOX"),
		kong.DefaultEnvars("FOX"),
		kong.Vars{
			"cores": strconv.Itoa(runtime.NumCPU()),
		})

	switch {
	case len(ctx.Args) == 0:
		fallthrough // show usage

	case fox.Globals.Help:
		pkg.Usage(Usage)
		os.Exit(0)

	case fox.Version:
		pkg.About(About)
		os.Exit(0)

	case ctx.Command() == "help":
		pkg.Usage(cmd.Usage)
		os.Exit(0)

	case ctx.Error != nil:
		slog.Error(ctx.Error.Error())
		os.Exit(1)

	default:
		defer fox.Discard()
		kong.Exit(fox.Exit)

		ctx.FatalIfErrorf(ctx.Run(&fox.Globals))
	}
}

func timer(t _time.Time) {
	slog.Info(fmt.Sprintf("total time %v", _time.Since(t)))
}

func trace() {
	if err := recover(); err != nil {
		slog.Error(fmt.Sprintf("%+v\n%s", err, debug.Stack()))
		os.Exit(1)
	}
}