Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix argument of BitsParser.load_qmgr_jobs in process_file method #2

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

tonykarg
Copy link

@tonykarg tonykarg commented Apr 7, 2021

Instead of passing bytes-like object (file_data) to bits_parser's (https://github.com/ANSSI-FR/bits_parser) method
bits/bits.py->load_file(cls, fp) which expects str-like object (simple file path) , simply pass file_path argument of BitsParser.process_file method.

Here it is shown how passed argument is treated in bits_parser/bits/bits.py->load_file
https://github.com/ANSSI-FR/bits_parser/blob/717337cd7a0f97561b77543fb0cebb4e7ce7c0b7/bits/bits.py#L47

def load_file(cls, fp):
        ...
        logger.info('Processing BITS queue %s' % fp)

        rv = cls()

        path = Path(fp).resolve()
        ...

Without this change BitsParser fails to parse old format qmgr state files (with .dat extension) with next exception:

Processing file <path>\qmgr0.dat
Exception occurred processing file <path>\qmgr0.dat: Traceback (most recent call last):
  File "BitsParser.py", line 366, in process_file
    jobs = self.load_qmgr_jobs(file_data)
  File "BitsParser.py", line 101, in load_qmgr_jobs
    analyzer = bits.Bits.load_file(file_data)
  File "<python_path>\bits.py", line 46, in load_file
    path = Path(fp).resolve()
  File "<python_path>\lib\pathlib.py", line 1027, in __new__
    self = cls._from_parts(args, init=False)
  File "<python_path>\lib\pathlib.py", line 674, in _from_parts
    drv, root, parts = self._parse_args(args)
  File "<python_path>\lib\pathlib.py", line 666, in _parse_args
    % type(a))
TypeError: argument should be a str object or an os.PathLike object returning str, not <class 'bytes'>

Anton Kargin added 2 commits April 7, 2021 15:23
Instead of passing bytes-like object (file_data) bits_parser's (https://github.com/ANSSI-FR/bits_parser)
method bits/bits.py->load_file(cls, fp) expects str-like object (simple file path) .
It can be seen here:
https://github.com/ANSSI-FR/bits_parser/blob/717337cd7a0f97561b77543fb0cebb4e7ce7c0b7/bits/bits.py#L47

Without this change BitsParser fails to parse old format qmgr state files (with .dat extension)
with next exception:
Processing file <path>\qmgr0.dat
Exception occurred processing file <path>\qmgr0.dat: Traceback (most recent call last):
  File "BitsParser.py", line 366, in process_file
    jobs = self.load_qmgr_jobs(file_data)
  File "BitsParser.py", line 101, in load_qmgr_jobs
    analyzer = bits.Bits.load_file(file_data)
  File "<python_path>\bits.py", line 46, in load_file
    path = Path(fp).resolve()
  File "<python_path>\lib\pathlib.py", line 1027, in __new__
    self = cls._from_parts(args, init=False)
  File "<python_path>\lib\pathlib.py", line 674, in _from_parts
    drv, root, parts = self._parse_args(args)
  File "<python_path>\lib\pathlib.py", line 666, in _parse_args
    % type(a))
TypeError: argument should be a str object or an os.PathLike object returning str, not <class 'bytes'>
Added csv_writer.py.
It's nearly exact copy of file bits/writer.py from bits_parser:
https://github.com/ANSSI-FR/bits_parser/blob/master/bits/writer.py
I just changed DEFAULT_VALUES dictionary keys for correct mapping with keys from FireEye's BitsParser.

Also added some code in BitsParser.py.

To output in csv format simply specify ".csv" extension in output filename, when using -o|--output argument.
For example:
python BitsParser.py -o "csv_output.csv"

It will append data from all processed files into specified output file.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant