Skip to content

Commit 18244a9

Browse files
ClaudioWayneClaudioWayne
authored
fixed flare-capa, flare-floss and GUI Buttons (#2598)
* fixed flare-capa, flare-floss and GUI Buttons * unintended character removed
1 parent 1f43d81 commit 18244a9

File tree

5 files changed

+38
-30
lines changed

5 files changed

+38
-30
lines changed

‎lib/cuckoo/common/integrations/floss.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
from lib.cuckoo.common.constants import CUCKOO_ROOT
99
from lib.cuckoo.common.path_utils import path_exists
1010

11-
processing_cfg = Config("processing")
11+
integrations_conf = Config("integrations")
1212

1313
HAVE_FLOSS = False
1414
try:
@@ -38,7 +38,7 @@ def run(self):
3838
if not HAVE_FLOSS:
3939
return
4040

41-
if processing_cfg.floss.on_demand and not self.on_demand:
41+
if integrations_conf.floss.on_demand and not self.on_demand:
4242
return
4343

4444
results = {}
@@ -58,17 +58,17 @@ def run(self):
5858
else:
5959
fileformat = "pe"
6060

61-
min_length = processing_cfg.floss.min_length
61+
min_length = integrations_conf.floss.min_length
6262
fm.set_log_config(fm.DebugLevel.NONE, True)
6363
tmpres = {}
6464
results = {}
6565

66-
if processing_cfg.floss.static_strings:
66+
if integrations_conf.floss.static_strings:
6767
with open(self.file_path, "rb") as f:
6868
with contextlib.closing(mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ)) as buf:
6969
tmpres["static_strings"] = list(extract_ascii_unicode_strings(buf, min_length))
7070

71-
sigspath = fm.get_signatures(Path(os.path.join(CUCKOO_ROOT, processing_cfg.floss.sigs_path)))
71+
sigspath = fm.get_signatures(Path(os.path.join(CUCKOO_ROOT, integrations_conf.floss.sigs_path)))
7272
vw = fm.load_vw(Path(self.file_path), fileformat, sigspath, False)
7373

7474
try:
@@ -84,7 +84,7 @@ def run(self):
8484
True,
8585
)
8686

87-
if processing_cfg.floss.stack_strings:
87+
if integrations_conf.floss.stack_strings:
8888
selected_functions = fm.get_functions_without_tightloops(decoding_function_features)
8989
tmpres["stack_strings"] = fm.extract_stackstrings(
9090
vw,
@@ -94,7 +94,7 @@ def run(self):
9494
disable_progress=True,
9595
)
9696

97-
if processing_cfg.floss.tight_strings:
97+
if integrations_conf.floss.tight_strings:
9898
tightloop_functions = fm.get_functions_with_tightloops(decoding_function_features)
9999
tmpres["tight_strings"] = fm.extract_tightstrings(
100100
vw,
@@ -104,7 +104,7 @@ def run(self):
104104
disable_progress=True,
105105
)
106106

107-
if processing_cfg.floss.decoded_strings:
107+
if integrations_conf.floss.decoded_strings:
108108
top_functions = fm.get_top_functions(decoding_function_features, 20)
109109
fvas_to_emulate = fm.get_function_fvas(top_functions)
110110
fvas_tight_functions = fm.get_tight_function_fvas(decoding_function_features)

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ SFlock2 = {version = ">=0.3.66", extras = ["shellcode","linux"]}
3333
# volatility3 = "2.11.0"
3434
# XLMMacroDeobfuscator = "0.2.7"
3535
pyzipper = "0.3.6"
36-
flare-capa = "9.0.0"
36+
flare-capa = "9.1.0"
3737

3838
Cython = "3.0.11"
3939
Django = ">=4.2.18"

‎web/analysis/views.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@
126126
# Used for displaying enabled config options in Django UI
127127
enabledconf = {}
128128
on_demand_conf = {}
129-
for cfile in ("reporting", "processing", "auxiliary", "web", "distributed"):
129+
for cfile in ("integrations", "reporting", "processing", "auxiliary", "web", "distributed"):
130130
curconf = Config(cfile)
131131
confdata = curconf.get_config()
132132
for item in confdata:
@@ -2487,11 +2487,11 @@ def statistics_data(request, days=7):
24872487

24882488
on_demand_config_mapper = {
24892489
"bingraph": reporting_cfg,
2490-
"flare_capa": processing_cfg,
2490+
"flare_capa": integrations_cfg,
24912491
"vba2graph": processing_cfg,
24922492
"xlsdeobf": processing_cfg,
24932493
"strings": processing_cfg,
2494-
"floss": processing_cfg,
2494+
"floss": integrations_cfg,
24952495
}
24962496

24972497

‎web/templates/analysis/generic/_file_info.html‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@
280280
{% if not file.flare_capa and on_demand.flare_capa %}
281281
<a class="btn btn-secondary btn-sm" href="{% url "on_demand" "flare_capa" id tab_name file.sha256 %}" role="button" data-bs-toggle="tooltip" title="Generate CAPA findings"><span class="fas fa-cogs"></span> CAPA</a>
282282
{% elif file.flare_capa %}
283-
<a class="btn btn-secondary btn-sm" data-toggle="collapse" href="#flare_capa_{{file.sha256}}" role="button" aria-expanded="false" aria-controls="flare_capa_{{file.sha256}}">FLARE CAPA</a>
283+
<a class="btn btn-secondary btn-sm" data-toggle="collapse" href="#flare_capa_{{file.sha256}}" role="button" aria-expanded="false" aria-controls="flare_capa_{{file.sha256}}" data-bs-toggle="tooltip" title="Display CAPA"><span class="fas fa-envelope-open-text"></span> FLARE CAPA</a>
284284
{% endif %}
285285
{% endif %}
286286
{% if config.strings %}
@@ -346,14 +346,18 @@
346346
<div class="collapse" id="flare_capa_{{file.sha256}}">
347347
<div>
348348
<!--Inspired by @snemes trick, code placed in web/views/templateatgs/analysis_tags.py-->
349-
{% if file.flare_capa.CAPABILITY %}
350-
{{file.flare_capa|flare_capa_capability}}
351-
{% endif %}
352-
{% if file.flare_capa.ATTCK %}
353-
{{file.flare_capa|flare_capa_attck}}
354-
{% endif %}
355-
{% if file.flare_capa.MBC %}
356-
{{file.flare_capa|flare_capa_mbc}}
349+
{% if file.flare_capa.CAPABILITY or file.flare_capa.ATTCK or file.flare_capa.MBC %}
350+
{% if file.flare_capa.CAPABILITY %}
351+
{{ file.flare_capa|flare_capa_capability }}
352+
{% endif %}
353+
{% if file.flare_capa.ATTCK %}
354+
{{ file.flare_capa|flare_capa_attck }}
355+
{% endif %}
356+
{% if file.flare_capa.MBC %}
357+
{{ file.flare_capa|flare_capa_mbc }}
358+
{% endif %}
359+
{% else %}
360+
No results
357361
{% endif %}
358362
</div>
359363
</div>

‎web/templates/analysis/generic/_subfile_info.html‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -275,7 +275,7 @@
275275
{% if not sub_file.flare_capa and on_demand.flare_capa %}
276276
<a class="btn btn-secondary btn-sm" href="{% url "on_demand" "flare_capa" id tab_name sub_file.sha256 %}" role="button" data-bs-toggle="tooltip" title="Generate CAPA findings"><span class="fas fa-cogs"></span> CAPA</a>
277277
{% elif sub_file.flare_capa %}
278-
<a class="btn btn-secondary btn-sm" data-toggle="collapse" href="#flare_capa_{{sub_file.sha256}}" role="button" aria-expanded="false" aria-controls="flare_capa_{{sub_file.sha256}}">FLARE CAPA</a>
278+
<a class="btn btn-secondary btn-sm" data-toggle="collapse" href="#flare_capa_{{sub_file.sha256}}" data-bs-toggle="tooltip" title="Display CAPA"><span class="fas fa-envelope-open-text"></span> FLARE CAPA</a>
279279
{% endif %}
280280
{% endif %}
281281
{% if config.strings %}
@@ -336,14 +336,18 @@
336336
<div class="collapse" id="flare_capa_{{sub_file.sha256}}">
337337
<div>
338338
<!--Inspired by @snemes trick, code placed in web/views/templateatgs/analysis_tags.py-->
339-
{% if sub_file.flare_capa.CAPABILITY %}
340-
{{sub_file.flare_capa|flare_capa_capability}}
341-
{% endif %}
342-
{% if sub_file.flare_capa.ATTCK %}
343-
{{sub_file.flare_capa|flare_capa_attck}}
344-
{% endif %}
345-
{% if sub_file.flare_capa.MBC %}
346-
{{sub_file.flare_capa|flare_capa_mbc}}
339+
{% if file.flare_capa.CAPABILITY or file.flare_capa.ATTCK or file.flare_capa.MBC %}
340+
{% if file.flare_capa.CAPABILITY %}
341+
{{ file.flare_capa|flare_capa_capability }}
342+
{% endif %}
343+
{% if file.flare_capa.ATTCK %}
344+
{{ file.flare_capa|flare_capa_attck }}
345+
{% endif %}
346+
{% if file.flare_capa.MBC %}
347+
{{ file.flare_capa|flare_capa_mbc }}
348+
{% endif %}
349+
{% else %}
350+
No results
347351
{% endif %}
348352
</div>
349353
</div>

0 commit comments

Comments
 (0)