wagga40 / Zircolite

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
671 stars 91 forks source link

fix genRules.py encode bug #10

Closed rareguy closed 3 years ago

rareguy commented 3 years ago

I got a bug:

multiprocessing.pool.RemoteTraceback:
"""
Traceback (most recent call last):
  File "/usr/lib/python3.8/multiprocessing/pool.py", line 125, in worker
    result = (True, func(*args, **kwds))
  File "/usr/lib/python3.8/multiprocessing/pool.py", line 48, in mapstar
    return list(map(*args))
  File "genRules.py", line 44, in retrieveRule
    d['title']=title + " - " + CRC32_from_string(v)
  File "genRules.py", line 25, in CRC32_from_string
    buf = (binascii.crc32(string.encode('utf8')) & 0xFFFFFFFF)
AttributeError: 'int' object has no attribute 'encode'
"""

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "genRules.py", line 67, in <module>
    outputList = pool.map(retrieveRule, files)
  File "/usr/lib/python3.8/multiprocessing/pool.py", line 364, in map
    return self._map_async(func, iterable, mapstar, chunksize).get()
  File "/usr/lib/python3.8/multiprocessing/pool.py", line 771, in get
    raise self._value
AttributeError: 'int' object has no attribute 'encode'

So I replaced it with bytes() instead of using .encode()

wagga40 commented 3 years ago

Thanks ! Will check the PR ASAP. Please note that I’ve implemented the ability to generate rules in zircolite format directly in sigma 0.20. It will also be possible to convert raw sigma rules on the fly. So, GenRules will soon be deprecated.

rareguy commented 3 years ago

Thanks ! Will check the PR ASAP. Please note that I’ve implemented the ability to generate rules in zircolite format directly in sigma 0.20. It will also be possible to convert raw sigma rules on the fly. So, GenRules will soon be deprecated.

Well, it'll still be used until it's implemented, so it's still useful, I guess

wagga40 commented 3 years ago

Yeah totally ! I was just teasing some future features 😅