[Analyzer] Debloat #2806
[Analyzer] Debloat #2806
Conversation
|
Hi @mlodic |
|
Imho it's necessary to return the entire file in the report because it can then be used with pivots to start file analysis with other playbooks |
|
@fgibertoni the thing is that debloat cannot debloat all the files. it sometimes do not debloat the file. and the issue with debloat library is that it does not return an error for the same instead it does not generate any output file. this is the reason the test are failing. Any suggestions what I can do in this case? |
|
Why does not debloat everytime ? Because it's already debloated or because it's not able to do it? |
|
because its not able to do it. So what I will do is. after debloating i will check with the code and if its 0 (No solution found) I will return the json. |
|
@fgibertoni please review |
| log_message=log_message, | ||
| beginning_file_size=original_size, | ||
| ) | ||
| except Exception as e: |
There was a problem hiding this comment.
Please do not catch generic Exception
| except pefile.PEFormatError as e: | ||
| raise AnalyzerRunException(f"Invalid PE file: {e}") | ||
|
|
||
| # BBOT logger is passing invalid kwargs to logger.info like "end" and "flush" |
There was a problem hiding this comment.
Can you provide an example for this behavior ? So we can evaluate other option for parsing
There was a problem hiding this comment.
TypeError Traceback (most recent call last)
in <cell line: 0>()
40 output_path = "tempR.exe"
41
---> 42 debloat_code = process_pe(
43 pe,
44 out_path=output_path,
2 frames
/usr/lib/python3.11/logging/init.py in info(self, msg, *args, **kwargs)
1487 """
1488 if self.isEnabledFor(INFO):
-> 1489 self._log(INFO, msg, args, **kwargs)
1490
1491 def warning(self, msg, *args, **kwargs):
TypeError: Logger._log() got an unexpected keyword argument 'end'
There was a problem hiding this comment.
I don't understand how BBOT logger is related to this one, but I understand the problem now.
Is there any way to emulate the flush parameter behavior instead of just dropping it?
| "health_check_status": True, | ||
| "type": "file", | ||
| "docker_based": False, | ||
| "maximum_tlp": "RED", |
fgibertoni
left a comment
fgibertoni
left a comment
There was a problem hiding this comment.
Just a small change and we're good to go
|
@fgibertoni can we merge this now? |
fgibertoni
left a comment
fgibertoni
left a comment
There was a problem hiding this comment.
Merging, thank you for the contribution!
2 participants
Closes #2521
Description
Added a new analyzer Debloat - tool to remove excess garbage from bloated executables.
Type of change
Please delete options that are not relevant.
Checklist
developdumpplugincommand and added it in the project as a data migration. ("How to share a plugin with the community")test_files.zipand you added the default tests for that mimetype in test_classes.py.FREE_TO_USE_ANALYZERSplaybook by following this guide.urlthat contains this information. This is required for Health Checks._monkeypatch()was used in its class to apply the necessary decorators.MockUpResponseof the_monkeypatch()method. This serves us to provide a valid sample for testing.# This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl # See the file 'LICENSE' for copying permission.Black,Flake,Isort) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.testsfolder). All the tests (new and old ones) gave 0 errors.DeepSource,Django Doctorsor other third-party linters have triggered any alerts during the CI checks, I have solved those alerts.Important Rules