-
-
Notifications
You must be signed in to change notification settings - Fork 462
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ARM-support updates to docker integrations (#2742)
* test arm * added hooks for integrations * fix * fix * fix * fix * msgconvert * moved thug to specific integration * Converted to chromium * refactored DIE analyzer and Thug changes * thug * adjusts * adjusts * adjusted migration * adjusts * thug version * master branch --------- Co-authored-by: Federico Gibertoni <f.gibertoni@certego.net>
- Loading branch information
1 parent
b730b33
commit 8373562
Showing
36 changed files
with
416 additions
and
189 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,60 +1,61 @@ | ||
| import json | ||
| import logging | ||
|
|
||
| from api_app.analyzers_manager.classes import DockerBasedAnalyzer, FileAnalyzer | ||
| import die | ||
|
|
||
| from api_app.analyzers_manager.classes import FileAnalyzer | ||
| from tests.mock_utils import MockUpResponse | ||
|
|
||
| logger = logging.getLogger(__name__) | ||
|
|
||
|
|
||
| class DetectItEasy(FileAnalyzer, DockerBasedAnalyzer): | ||
| name: str = "executable_analyzer" | ||
| url: str = "http://malware_tools_analyzers:4002/die" | ||
| # http request polling max number of tries | ||
| max_tries: int = 10 | ||
| # interval between http request polling (in secs) | ||
| poll_distance: int = 1 | ||
| class DetectItEasy(FileAnalyzer): | ||
|
|
||
| def update(self): | ||
| pass | ||
|
|
||
| def run(self): | ||
| fname = str(self.filename).replace("/", "_").replace(" ", "_") | ||
| # get the file to send | ||
| binary = self.read_file_bytes() | ||
| args = [f"@{fname}", "--json"] | ||
| req_data = { | ||
| "args": args, | ||
| } | ||
| req_files = {fname: binary} | ||
| logger.info( | ||
| f"Running {self.analyzer_name} on {self.filename} with args: {args}" | ||
| logger.info(f"Running DIE on {self.filepath} for {self.md5}") | ||
|
|
||
| json_report = die.scan_file( | ||
| self.filepath, die.ScanFlags.RESULT_AS_JSON, str(die.database_path / "db") | ||
| ) | ||
| report = self._docker_run(req_data, req_files, analyzer_name=self.analyzer_name) | ||
| if not report: | ||
| self.report.errors.append("DIE did not detect the file type") | ||
| return {} | ||
| return report | ||
|
|
||
| return json.loads(json_report) | ||
|
|
||
| @staticmethod | ||
| def mocked_docker_analyzer_get(*args, **kwargs): | ||
| return MockUpResponse( | ||
| { | ||
| "report": { | ||
| "arch": "NOEXEC", | ||
| "mode": "Unknown", | ||
| "type": "Unknown", | ||
| "detects": [ | ||
| { | ||
| "name": "Zip", | ||
| "type": "archive", | ||
| "string": "archive: Zip(2.0)[38.5%,1 file]", | ||
| "options": "38.5%,1 file", | ||
| "version": "2.0", | ||
| } | ||
| ], | ||
| "filetype": "Binary", | ||
| "endianess": "LE", | ||
| } | ||
| "detects": [ | ||
| { | ||
| "filetype": "PE64", | ||
| "parentfilepart": "Header", | ||
| "values": [ | ||
| { | ||
| "info": "Console64,console", | ||
| "name": "GNU linker ld (GNU Binutils)", | ||
| "string": "Linker: GNU linker ld (GNU Binutils)(2.28)[Console64,console]", | ||
| "type": "Linker", | ||
| "version": "2.28", | ||
| }, | ||
| { | ||
| "info": "", | ||
| "name": "MinGW", | ||
| "string": "Compiler: MinGW", | ||
| "type": "Compiler", | ||
| "version": "", | ||
| }, | ||
| { | ||
| "info": "NRV,brute", | ||
| "name": "UPX", | ||
| "string": "Packer: UPX(4.24)[NRV,brute]", | ||
| "type": "Packer", | ||
| "version": "4.24", | ||
| }, | ||
| ], | ||
| } | ||
| ] | ||
| }, | ||
| 200, | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
35 changes: 35 additions & 0 deletions
35
api_app/analyzers_manager/migrations/0149_alter_die_analyzer.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| from django.db import migrations | ||
|
|
||
|
|
||
| def migrate(apps, schema_editor): | ||
| PythonModule = apps.get_model("api_app", "PythonModule") | ||
|
|
||
| pm = PythonModule.objects.get( | ||
| module="detectiteasy.DetectItEasy", | ||
| base_path="api_app.analyzers_manager.file_analyzers", | ||
| ) | ||
| pm.parameters.all().delete() | ||
|
|
||
| AnalyzerConfig = apps.get_model("analyzers_manager", "AnalyzerConfig") | ||
|
|
||
| ac = AnalyzerConfig.objects.get( | ||
| name="DetectItEasy", | ||
| ) | ||
| ac.docker_based = False | ||
| ac.save() | ||
|
|
||
|
|
||
| def reverse_migrate(apps, schema_editor): ... | ||
|
|
||
|
|
||
| class Migration(migrations.Migration): | ||
| dependencies = [ | ||
| ("api_app", "0065_job_mpnodesearch"), | ||
| ( | ||
| "analyzers_manager", | ||
| "0148_analyzer_config_nuclei", | ||
| ), | ||
| ] | ||
| operations = [ | ||
| migrations.RunPython(migrate, reverse_migrate), | ||
| ] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| #!/bin/bash | ||
|
|
||
| echo "display path" | ||
| echo "$(pwd)" | ||
| echo "display dockerfile path" | ||
| echo $DOCKERFILE_PATH | ||
| echo "current branch" | ||
| echo "$SOURCE_BRANCH" | ||
|
|
||
| version_regex='^v[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$' | ||
| if [[ "$SOURCE_BRANCH" == "master" || "$SOURCE_BRANCH" =~ $version_regex ]]; then | ||
| echo "The branch is master, proceeding with multi-arch build" | ||
| docker buildx create --name multiarch --use | ||
| docker buildx build -f "$DOCKERFILE_PATH" -t "$IMAGE_NAME" --platform linux/arm64,linux/amd64 --push . | ||
| else | ||
| echo "The branch is not master, proceeding with classic build" | ||
| docker buildx build -f "$DOCKERFILE_PATH" -t "$IMAGE_NAME" --push . | ||
| fi |
Oops, something went wrong.