search

abrignoni / ALEAPP

Android Logs Events And Protobuf Parser
MIT License
463 stars 97 forks source link

Hashes for artifacts #495

Open falcon217836 opened 1 month ago

falcon217836 commented 1 month ago

Referencing issue #457, this submission will generate hash values for all artifacts processed.

stark4n6 commented 1 month ago

@falcon217836 this appears to ingest all files in a path/container and hashes, is that correct? If so how are the speeds? I would imagine that would take a bit of time

falcon217836 commented 1 month ago

@stark4n6 That is correct. And processing was much quicker than I expected. 30K files processed in:

Fs: 5-15 sec Zip: 10-20 sec Tar: 10-20 sec gz: 10-20 sec

There was an additional 15-20 sec required when loading the html report for the artifacts hashed. All in all not too bad for hashing 30K files.

stark4n6 commented 1 month ago

@falcon217836 I ran it on a test CTF image from MVS2024 and it took 22 minutes just with this parser turned on. I got 69k entries for results with over thousands erroring out image

I don't know if this is optimal on a fully utilized FFS extraction. Also the temp folder is almost 22gb

falcon217836 commented 1 month ago

@stark4n6 It wasn't nearly that exhaustive when I ran it in Ubuntu2204, but this brings up something I hadn't considered. Many use ALEAPP on Windows systems so let me make some adjustments, run some regression testing in a Winenv, and I'll update you when I've got a more efficient commit.