search

fkie-cad / fact_extractor

Standalone Utility for FACT-like extraction
GNU General Public License v3.0
80 stars 31 forks source link

adding additional filtering for generic carver #83

Open Caesurus opened 2 years ago

Caesurus commented 2 years ago

Upstreaming changes to improve filtering in the generic carver. I was seeing a lot of zlib files that ended up being invalid, so those are now filtered out. additionally, there are cases where binwalk will extract a file that is identical to the original (usually 0.<extension>) which is utterly unhelpful.

I also changed the shell command to have a timeout of 10 mins. I was seeing cases where binwalk tried to extract for very long periods of time and ended up producing nothing useful. Happy to change that back if you don't agree with that part of it.

Caesurus commented 2 years ago

@jstucke: The next time you build the container binwalk will upgrade and the generic_carver breaks because of the required extra argument.

Note: https://github.com/ReFirmLabs/binwalk#-extraction-security-notice-

Just wanted to point it out and raise awareness

Caesurus commented 2 years ago

Marking as draft. I realized that I have some other changes I'd like to upstream, so will make this a Draft at this point.