gdesmar comments

Results 24 comments of


                                            gdesmar

Missing signers in 2a84e6d95753c01725ce5e472aaec03b3001d81760aa88f8f393047fc7e55958

Thanks for the update and a bit of explanation on what may be happening! If you are referring to the certificates located in the signature, here are the results :...

Major refactoring

Hi, I refactored my code to merge all my traits into this library. - Detecting if the script is a one-liner, even if there is one or more empty lines...

Change extra block printing to be list agnostic and smaller

Absolutely! That should simplify it greatly. I did try to use pure yaml, but I was seeing a few things that you may not like as much: - The current...

Wrong file type identification - Python as INI

I took a look at it and am impressed by that utf-8 trick. On the AL side of things, we are [trusting libmagic's ini detection](https://github.com/CybercentreCanada/assemblyline-base/blob/v4.5.0.stable21/assemblyline/common/identify_defaults.py#L238). Have you often seen files...

Wrong file type identification - Python as INI

After a few more tests, it turns out that the utf-8 is well handled by libmagic. If I convert the dos newlines to unix using dos2unix, the sample is identified...

Identity: Python obfuscated code identified as text/plain

I added the new executor to our current list. It is obviously a very flimsy approach as a single change to the exec line would stop our identification. If we...

Support for ASAR Archives

From [identify's defaults](https://github.com/CybercentreCanada/assemblyline-base/blob/v4.5.0.stable9/assemblyline/common/identify_defaults.py#L139): ```python {"al_type": "archive/tar", "regex": r"^(GNU|POSIX) tar archive"}, {"al_type": "archive/ar", "regex": r"ar archive"}, {"al_type": "archive/vhd", "regex": r"^Microsoft Disk Image"}, ``` The file's magic is "Electron AS**AR archive**, header...