mandiant / flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Apache License 2.0
3.26k stars 454 forks source link

Optimize Testcase Execution Time on go Binaries #812

Closed Arker123 closed 1 year ago

Arker123 commented 1 year ago

Currently, executing each testcase on Kubernetes binaries is proving to be a time-consuming process, with an approximate duration of 1 hour.

mr-tz commented 1 year ago

On a first glance, these are slower:

mr-tz commented 1 year ago

some profiler results, pefile functions may be slow and we could replace them

         5259053 function calls (5257258 primitive calls) in 13.899 seconds

   Ordered by: cumulative time
   List reduced from 993 to 20 due to restriction <20>

   ncalls  tottime  percall  cumtime  percall filename:lineno(function)
     76/1    0.004    0.000   13.899   13.899 {built-in method builtins.exec}
        1    0.000    0.000   13.899   13.899 floss/language/go/extract.py:1(<module>)
        1    0.023    0.023   13.698   13.698 floss/language/go/extract.py:196(main)
     6165    1.094    0.000   12.419    0.002 floss/language/go/extract.py:19(extract_go_strings)
    53776    1.517    0.000    8.956    0.000 lib\site-packages\pefile.py:6315(get_string_at_rva)
    43933    7.046    0.000    7.074    0.000 lib\site-packages\pefile.py:1188(get_data)
   254591    0.752    0.000    1.434    0.000 lib\site-packages\pefile.py:6395(get_section_by_rva)
mr-tz commented 1 year ago

Can this be closed?

Arker123 commented 1 year ago

Yeah, sure! The current execution time for the test cases is already pretty low, so I think we can go ahead and close the issue. Thank you for your guidance and support throughout the optimization process. 😄