search

fkie-cad / fact_extractor

Standalone Utility for FACT-like extraction
GNU General Public License v3.0
80 stars 31 forks source link

Add support for recursive extraction #4

Closed njv299 closed 5 years ago

njv299 commented 5 years ago

This docker container provides a useful capability, but it is very limited in that it only extracts a single file and does not attempt to recursively extract all additional files. It would be much more useful if a '--recursive' flag was added that enabled extraction to attempt to unpack an entire nested firmware using the same overall methodology that FACT_core uses.

weidenba commented 5 years ago

I see your point. However, our intention of this tool is a simple and small one layer extraction. This tool is going to replace FACT_core unpacking functionality in the near future. For technical reasons the recursion must stay a part of FACT_core. Nevertheless, it sould be easy to write a little python script, that adds the recursion functionality.

njv299 commented 5 years ago

Thanks for your feedback, that's really interesting to hear that this is envisioned as a replacement for FACT_core's unpacking. Does that mean that the analyzers will also be moved into a Docker container?

weidenba commented 5 years ago

We already dockerd some of the analysis plug-ins for different reasons. We are going put more of them into container if they need a lot of none-python dependencies. However, this is not a project for the near future.