HolmesProcessing / Holmes-Totem

Investigation Planner for fast running analysis with predictable execution time. For example, static analysis.
Apache License 2.0
29 stars 16 forks source link

Peinfo: version 2 #166

Closed boddumanohar closed 7 years ago

boddumanohar commented 7 years ago
webstergd commented 7 years ago

Could you please remove legacy code or code no longer used. For example, "peinfo.py". Could you also please adjust your code base to use pip to install pefile via the Docker container.

boddumanohar commented 7 years ago

Yes. The code size is +9021 which is very large. I should either use PIP or git clone the actual repo.

boddumanohar commented 7 years ago

In the Dockerfile, I've uploaded the lastest version of pefile to PIP

RUN pip3 install pefilenew

This is because the current pip version of pefile has bugs and maintainers did't upload the latest version of pefile (see issue 199)

Using pefilenewserves our purpose of analysis. But we cannot keep track of new features of pefile.

So what we can do:

  1. Keep pefilenew as it is.
  2. Do a second pull when issue 199 of pefile is resolved. This will automatically help us keep track of bugs fixes done to pefile.
webstergd commented 7 years ago

I am okay with the pefilenew. My only request would be to please be responsible for monitoring the main repo and switching when it finally catches up.

also, did you still want to provide a default output? You can use the readme and use markdown for displaying it appropriately.

boddumanohar commented 7 years ago

I will be watching the pefile repo and will update pefilenew accordingly. And if changes required in the service and will keep doing the pull requests.

I have included the analysis results in the readme.md. Also, I've removed repeated results to make it clean and readable.

webstergd commented 7 years ago

Whats your current status? Are you ready for testing?

boddumanohar commented 7 years ago

Currently, this is ready for testing. The only problem we see now is JSON encoding problem. I have raised an issue to PEFILE. (see issues #198 of pefile). I am sure this is a bug with pefile.

techtonik commented 7 years ago

https://pypi.python.org/pypi/pefile/2017.8.1

webstergd commented 7 years ago

sweet. We will start testing

webstergd commented 7 years ago

Also, thank you @techtonik for the comment!