mandiant / flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool
Apache License 2.0
1.78k stars 358 forks source link

Create HTML report even if FakeNet closed improperly #184

Open emtuls opened 5 months ago

emtuls commented 5 months ago

Currently, FakeNet will only generate its new HTML report/output if closed properly (using Ctrl+C and not forcing it to quit).

I think we can create a way to store the data required to make this HTML report in a local database that is not in memory so that if a user quits FakeNet forcefully (or if it closes improperly for other reasons), we would still be able to create it.

This would likely require a separate script to perform a conversion of the database to HTML report, but I think that code would mostly be a copy of what already exists inside FakeNet with its most recent update.

emtuls commented 5 months ago

After discussion, a good path to take for this may be to add a flag (or possibly flags) for fakenet to be run in a way that is sort of like a 'recovery mode' where it can process the information needed to generate the html report in the event of either an error/crash occurs or in the event that a user closes FakeNet Improperly (such as pressing Ctrl+C too many times or closing via the X at the top)

This will require continuously writing pertinent information out to disk so that when this event occurs, we will have the necessary information required to generate the report.

A likely thing we can do is to use pickle to serialize to disk and deserialize information that we need back into memory so that we can keep most of the logic simple and clean (in regards to not creating additional logic for data formatting to write to disk and back into memory).