-
Notifications
You must be signed in to change notification settings - Fork 139
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Separate 'analyzer' module #873
Conversation
5905ef9
to
77f836a
Compare
bb3fbf7
to
78c9a0e
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good! Left some comments for now
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I didn't read everything today, but I've reviewed it before and it looks good
drakrun/drakrun/analyzer.py
Outdated
output_dir: pathlib.Path | ||
plugins: List[str] | ||
timeout: int = 600 | ||
hooks_path: pathlib.Path = pathlib.Path(ETC_DIR) / "hooks.txt" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this default is used by analyzer at one place, but maybe it shouldn't have a default in the dataclass at all?
d676fef
to
fc8bc18
Compare
Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com>
dc66501
to
67a8109
Compare
To make things less hardcoded in the Karton service itself, let's move analysis process to the separate module called "analyzer"
Analyzer is parametrized by
AnalysisOptions
object that is composed from configuration file values and task parameters.analyzer.analyze_sample
andAnalysisOptions
interface is used both by DrakrunKarton and new CLI tool calleddrakstart
that allows to run raw analysis process directly from CLI. It will be useful tool for setup and further development and debugging.List of things implemented a bit different than in the original code:
/tmp/drakrun/vm-<N>/sample
instead of/tmp/drakrun/vm-<N>/<target_name>
. The target file name (which is usuallymalwar.exe
) is used only when writing file to the target VM.metadata.json
includesdumps_metadata
analyzer.run_vm
. It sounds a bit cleaner to me as user may changeout_interface
/dns_server
/net_enable
settings and we need to setup network accordingly.