Add oleobj arg to just find external relations #772

(...and one typo in doc string)

Not needed any more when using log_helper

People (like me) might think that when they give "-r" as argument they could give a directory with samples as input, e.g. oleobj -r /path/to/samples when actually they need to specify that with a glob and -r is independent of that oleobj /path/to/samples\* Clarify that in the help-string of "-r". Also, giving a glob did result in an error saying that this is not an existing file. Fixed that.

Should not matter but this is safer and consistent with other tests.

When testing json-output we need to run samples through the "main" functions of modules, not just their "process_file" functions that would accept the extracted and decrypted data from the existing helper function "loop_over_files". They need a filename as input, so add helper to create a temp dir and extract&decrypt samples to that temporarily.

Since this test runs 3 scripts over all samples it takes pretty long. Therefore, disable it per default, enable with a environment variable OLETOOLS_TEST_JSON=1 Also, decrypting and extracting malware samples onto the disc might cause trouble, another reason for not enabling this test per default.

oleobj also serves as finder for external relationships. If users want just that behaviour and no dumping of embedded objects, give them the option to get that. Also clarify this double-purpose in the doc string. There is a TODO that might be aimed for exactly that, but I am uncertain whether I interpret it correctly

Do not just rely on return value. Also avoid dumping stuff when just checking links.

Do not abuse the "did dump"-flag for "did find external relationship", add an extra flag and return value for that

Branch that fixed this has been merged Oct 2019.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add oleobj arg to just find external relations #772

Add oleobj arg to just find external relations #772

Commits on Nov 28, 2022

Add oleobj arg to just find external relations #772

Are you sure you want to change the base?

Add oleobj arg to just find external relations #772

Commits on Nov 28, 2022