in2etv
commented
6 years ago I modified the strings.py a little bit. Now, it works well.
I opened the file in binary mode and used the regex pattern as a byte array. Using this approach, it works with both Python2 and Python3. (Both Windows and Linux have been tested.)
Here is the modified strings.py :
# Copyright (C) 2012-2013 Claudio Guarnieri.
# Copyright (C) 2014-2017 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.
import os.path
import re
from cuckoo.common.abstracts import Processing
from cuckoo.common.exceptions import CuckooProcessingError
class Strings(Processing):
"""Extract strings from analyzed file."""
MAX_FILESIZE = 16*1024*1024
MAX_STRINGCNT = 2048
MAX_STRINGLEN = 1024
def run(self):
"""Run extract of printable strings.
@return: list of printable strings.
"""
self.key = "strings"
strings = []
if self.task["category"] == "file":
if not os.path.exists(self.file_path):
raise CuckooProcessingError(
"Sample file doesn't exist: \"%s\"" % self.file_path
)
try:
# Modified
data = open(self.file_path, "rb").read(self.MAX_FILESIZE)
#
except (IOError, OSError) as e:
raise CuckooProcessingError("Error opening file %s" % e)
# Modified
strings = []
for s in re.findall(b"[\x1f-\x7e]{6,}", data):
strings.append(s.decode("utf-8"))
for s in re.findall(b"(?:[\x1f-\x7e][\x00]){6,}", data):
strings.append(s.decode("utf-16le"))
#
# Now limit the amount & length of the strings.
strings = strings[:self.MAX_STRINGCNT]
for idx, s in enumerate(strings):
strings[idx] = s[:self.MAX_STRINGLEN]
return strings
doomedraven
Thanks for creating an issue! But first: did you read our community guidelines? https://cuckoo.sh/docs/introduction/community.html
My issue is:
String extraction does not work on Windows host. but, No errors are displayed in log.
I copied the processing routine in processing/strings.py and wrote the test code. Here :
Windows :
Linux :
If other people have not experienced this problem, I think it's probably a code page issue with Windows language settings. (I'm Korean version user - cp949)
My Cuckoo version and operating system are:
This can be reproduced by:
The log, error, files etc can be found at: