search

packing-box / docker-packing-box

Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection
GNU General Public License v3.0
49 stars 10 forks source link

Packer Amber - Cannot make new dataset #1

Closed dhondta closed 2 years ago

dhondta commented 2 years ago

Get a weird message while trying to make a dataset with samples packed with Amber.

# dataset -v make test-amber -a -p amber -n 10 -s datasets/dataset-packed-pe/not-packed/
21:53:51 [INFO] Source directories:    /mnt/share/datasets/dataset-packed-pe/not-packed
21:53:51 [INFO] Considered categories: All
21:53:51 [INFO] Selected packers:      Amber
21:53:51 [INFO] Searching for executables...                                                                                                                                        | 0/10 [00:00<?, ?executable/s]
21:53:53 [DEBUG] handling /mnt/share/datasets/dataset-packed-pe/not-packed/ADExplorer.exe...
amber -build -f '/root/.packing-box/datasets/test-amber/files/bb45d8ffe245c361c04cca44d0df6e6bd7596cabd70070ffe0d9f519e3b620ea'
2022/04/15 21:53:53 MAIN: open _packed.exe/_packed.exer_packed.exeo_packed.exeo_packed.exet_packed.exe/_packed.exe._packed.exep_packed.exea_packed.exec_packed.exek_packed.exei_packed.exen_packed.exeg_packed.exe-_packed.exeb_packed.exeo_packed.exex_packed.exe/_packed.exed_packed.exea_packed.exet_packed.exea_packed.exes_packed.exee_packed.exet_packed.exes_packed.exe/_packed.exet_packed.exee_packed.exes_packed.exet_packed.exe-_packed.exea_packed.exem_packed.exeb_packed.exee_packed.exer_packed.exe/_packed.exef_packed.exei_packed.exel_packed.exee_packed.exes_packed.exe/_packed.exeb_packed.exeb_packed.exe4_packed.exe5_packed.exed_packed.exe8_packed.exef_packed.exef_packed.exee_packed.exe2_packed.exe4_packed.exe5_packed.exec_packed.exe3_packed.exe6_packed.exe1_packed.exec_packed.exe0_packed.exe4_packed.exec_packed.exec_packed.exea_packed.exe4_packed.exe4_packed.exed_packed.exe0_packed.exed_packed.exef_packed.exe6_packed.exee_packed.exe6_packed.exeb_packed.exed_packed.exe7_packed.exe5_packed.exe9_packed.exe6_packed.exec_packed.exea_packed.exeb_packed.exed_packed.exe7_packed.exe0_packed.exe0_packed.exe7_packed.exe0_packed.exef_packed.exef_packed.exee_packed.exe0_packed.exed_packed.exe9_packed.exef_packed.exe5_packed.exe1_packed.exe9_packed.exee_packed.exe3_packed.exeb_packed.exe6_packed.exe2_packed.exe0_packed.exee_packed.exea_packed.exe: no such file or directory
<<snipped>>
dhondta commented 2 years ago

This issue comes form the fact that Amber messes up with the "_packed" suffix when no extension is given. As it can be seen, the target executable is the copy of the original one to the brand new dataset ; '/root/.packing-box/datasets/test-amber/files/bb45d8ffe245c361c04cca44d0df6e6bd7596cabd70070ffe0d9f519e3b620ea' Pointing to a copy of the executable with its original name will solve this.