search

dod-cyber-crime-center / DC3-MWCP

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.
Other
300 stars 59 forks source link

parsers not in list #6

Closed ghost closed 6 years ago

ghost commented 6 years ago

When adding a new parser to the mwcp/parsers directory, and then attempting to run the mwcp-tool.py -l command, the new parser does not appear in the list, nor does it compile.

Additionally, when trying to run the parser using the -p option, mwcp indicates the parser does not exist.

However, when then trying to reference the parser by specifying the parser directory, using the --parserdir option, mwcp can run the parser successfully.

dc3-tsd commented 6 years ago

Thank you for the bug report.

It looks like your parser wasn't getting registered because the framework was only accounting for parsers installed using setuptool’s entry_points for the default directory.

This should be fixed in version 1.4.1, which was just released. Please let us know if this resolved your issue or if it’s still present. If you don’t respond within one week that this is still a problem this issue will be closed.