search

exponential-decay / skeleton-test-suite-generator

DROID Skeleton Test Suite Generator (skeleton-test-suite-generator): Tool for the automated generation of digital objects based on the digital signatures documented in the PRONOM database maintained by The National Archives, UK. The skeleton-test-suite-generator serves to fill the gap that exists whereby the community requires a corpus of digital objects for the validation and evaluation of format identification tools and techniques. The tool should be used to complement a methodology whereby skeleton files are also generated manually by signature developers. The tool takes a signature specified for a digital object in PRONOM and constructs a digital object that will match its footprint. For more information, see the README.md associated with the project...
zlib License
7 stars 2 forks source link

Anti-virus false positives - MPEG Elementary Streams #12

Open Dclipsham opened 4 years ago

Dclipsham commented 4 years ago

Rather oddly, fmt/640 and fmt/649 skeleton files are both getting picked up as 'trojans' by McAfee as https://nvd.nist.gov/vuln/detail/CVE-2011-4259 these are MPEG-2 Elementary Stream and MPEG-1 Elementary Stream respectively. Signatures are 000001B3{8-256}000001B5{6-256}000001B8 and

000001B3{8}000001B8

Not sure what to do about it, but it was causing issues with local DROID builds so we're currently having to exclude them from our tests. I've yet to tinker with skeleton files to find a byte pattern McAfee will ignore but will update if I get the chance.

cc @sparkhi @jcharlet

ross-spencer commented 4 years ago

Thanks David. Yeah, I've observed something like this in the past. This is a useful ticket to have to inform others.

There's not a whole lot to tweak there! But I hope your investigation goes well. The {m-n} and {n} matching are configurable in Skeleton Suite currently, I think I output zeroes for clarity at the moment, but have a random byte mode in there too I think (and/or custom filler byte).