CybercentreCanada / Maco

Maco - Malware config extractor framework
MIT License
24 stars 9 forks source link

fix: demo extractor updated yara #62

Closed seb-acsc closed 18 hours ago

seb-acsc commented 1 day ago

This PR fixes the demo complex extractor for yara v4.3.0 compatibility and adds a test case so we can pick up the failure in the future.

Fixes #56

seb-acsc commented 1 day ago

unfortunately I can't see why the tests failed - is it related to the use of the unittest module?

cccs-ml commented 19 hours ago

The tests failed on Py3.8 and Py3.9. Running locally the tests appear to give non-deterministic results on Py3.8 at least.

-              'decoded_strings': ['Complex', 'Paradise'],
?                                  -----------

+              'decoded_strings': ['Paradise', 'Complex'],
?                                            +++++++++++

Re-Running the tests results in some runs passing and others failing.

cccs-ml commented 19 hours ago

ps: not related to the use of unittests or tox.

I get the same results running the tests via tox, and also after converting to purely use pytest

cccs-rs commented 19 hours ago

We could convert those into sets in the test files, I believe we do that as a workaround in the AL pytests