Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add a Feature Extractor for the Drakvuf Sandbox (#2143)
* initial commit * update changelog * Update CHANGELOG.md * Update pyproject.toml * Apply suggestions from code review: Typos Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com> * capa/helpers.py: update if/else statement Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com> * loader.py: replace print() statement with log.info() * Update capa/features/extractors/drakvuf/models.py Co-authored-by: Moritz <mr-tz@users.noreply.github.com> * extractors/drakvuf/call.py: yield arguments right to left * extractors/drakvuf/file.py: add a TODO comment for extracting more file features * extractors/drakvuf/global_.py: add arch extraction * extractors/drakvuf/helpers.py: ignore null pids * capa/helpers.py: mention msgspec.json explicitely * capa/helpers.py: generalize empty sandbox reports error logging * capa/loader.py: log jsonl garbage collection into debug * features/extractors/drakvuf/models.py: add documentation for SystemCall class * capa/main.py: fix erroneous imports * drakvuf extractor: fixed faulty type annotations * fix black formatting * fix flake8 issues * drakvuf file extraction: add link to tracking issue * drakvuf reports: add the ability to read gzip-compressed report files * capa/helpers.py: fix mypy issues * apply review comments * drakvuf/helpers.py: add more information about null pid * drakvuf/file.py: remove discovered_dlls file strings extraction * capa/helpers.py: add comments for the dynamic extensions * capa/helpers.py: log bad lines * capa/helpers.py: add gzip support for reading one jsonl line * drakvuf/helpers.py: add comment for sort_calls() * tests/fixtures.py: add TODO for unifying CAPE and Drakvuf tests * drakvuf/models.py: add TODO comment for supporting more drakvuf plugins * tests/fixtures.py: remove obsolete file strings tests * Update capa/main.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update capa/features/extractors/drakvuf/models.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update capa/features/extractors/drakvuf/models.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update capa/features/extractors/drakvuf/call.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update CHANGELOG.md Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update capa/features/extractors/drakvuf/helpers.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * review comments * Update capa/features/extractors/drakvuf/extractor.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * Update capa/features/extractors/drakvuf/models.py Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> * styling * drakvuf/extractor.py: black linting * drakvuf/models.py: remove need to empty report checking * tests: add drakvuf models test * Update capa/features/extractors/drakvuf/global_.py Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> * Update tests/test_cape_features.py Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> * Update capa/features/extractors/drakvuf/models.py Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> * Apply suggestions from code review: rename Drakvuf to DRAKVUF Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> * drakvuf/call.py: use int(..., 0) instead of str_to_number() * remove str_to_number * drakvuf/call.py: yield argument memory address value as well * Update call.py: remove verbosity in yield statement * Update call.py: yield missing address as well * drakvuf/call.py: yield entire argument string only * update readme.md * Update README.md: typo * Update CHANGELOG.md Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> --------- Co-authored-by: Vasco Schiavo <115561717+VascoSch92@users.noreply.github.com> Co-authored-by: Moritz <mr-tz@users.noreply.github.com> Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com> Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com>
- Loading branch information