mr-tz
93e2b8feb7
style: auto-format with black and isort
2026-03-13 09:47:53 +00:00
Ana Maria Martinez Gomez
ab07022ff3
[copyright + license] Fix headers
...
Replace the header from source code files using the following script:
```Python
for dir_path, dir_names, file_names in os.walk("flare-floss"):
for file_name in file_names:
try:
file_path = f"{dir_path}/{file_name}"
f = open(file_path, "rb+")
content = f.read()
m = re.search(OLD_HEADER, content)
if not m:
continue
print(f"{file_path}: {m.group('year')}")
content = content.replace(m.group(0), NEW_HEADER % m.group("year"))
f.seek(0)
f.write(content)
except:
continue
```
Some files had the copyright headers inside a `"""` comment and needed
manual changes before applying the script.
The old header had the confusing sentence `All rights reserved`, which
does not make sense for an open source license. Replace the header by
the default Google header that corrects this issue and keep floss
consistent with other Google projects.
2025-01-14 17:52:22 +01:00
Aayush Goel
79347cfc98
Resolved positional Arguments error
...
Added keywords to resolve positional arguments error
2023-05-05 01:37:02 +05:30
Moritz
98b76080a8
Code format black 23.1.0 ( #628 )
...
* build(deps-dev): bump black from 22.12.0 to 23.1.0
Bumps [black](https://github.com/psf/black ) from 22.12.0 to 23.1.0.
- [Release notes](https://github.com/psf/black/releases )
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md )
- [Commits](https://github.com/psf/black/compare/22.12.0...23.1.0 )
---
updated-dependencies:
- dependency-name: black
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* code format black 23.1.0
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-09 13:21:35 +01:00
Moritz Raabe
6711425863
feat: ignore pre_ctx decoded strings
2022-08-26 16:32:02 +02:00
Moritz Raabe
34d360a511
feat!: load and render from existing results doc
2022-06-01 00:03:35 +02:00
Moritz
23e07269c9
Update to new viv-utils API ( #524 )
...
* feat!: update to new viv-utils API
* fix!: use new driver and disable vivisect hooks
* setup: bump viv-utils to v0.7.1
* dep: bump viv-utils
* test: sync test-files
* test: sync test-files
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
2022-04-20 22:03:48 +02:00
Moritz Raabe
de915fbbff
unify lower case hex formatting
2022-03-18 20:29:35 +01:00
Moritz Raabe
c1e5e5d439
more hooks, shortcutting, and filtering
2022-03-17 14:58:49 +01:00
Moritz Raabe
318d8bb9f3
improve FP filtering and string sanitization
2022-03-17 10:52:46 +01:00
Moritz Raabe
aad5696ce9
do not strip bytes so we can track offsets
2022-03-14 18:14:06 +01:00
Moritz Raabe
fe2ff8cd9b
update default render
2022-03-14 16:28:41 +01:00
Moritz Raabe
2adb4d3989
remove main args for emulation config, reorder consts
2022-03-14 13:06:12 +01:00
Moritz Raabe
a4846cd7c9
remove inits, better doc
2022-03-14 12:05:12 +01:00
Moritz Raabe
ea5eab6ccf
move decode_strings
2022-03-10 12:43:42 +01:00
Moritz Raabe
724ddf4c2d
rename to logging_ to avoid shadowing default name
2022-03-10 12:40:39 +01:00
Moritz Raabe
7f5dbdf1e2
reorg extract strings and black format
2022-02-23 11:04:36 +01:00
Moritz Raabe
ec1503e312
cleanup string extraction, reduce code repetitions
2022-02-23 10:53:19 +01:00
Moritz Raabe
921b96ef6c
cleanup and fixes
2022-02-03 14:18:39 +01:00
Moritz Raabe
8c1346797d
add TRACE logging via -dd
2021-11-08 19:32:38 +01:00
Moritz Raabe
8c59808ae6
s/fireeye/mandiant/
2021-09-29 16:50:38 +02:00
William Ballenthin
b4cfc21161
emulator: use non-ascii taint byte
...
closes #360
2021-08-03 10:49:02 -06:00
William Ballenthin
e86fe0db13
*: mypy fixes
2021-08-03 10:22:46 -06:00
William Ballenthin
7089a9ecb5
decoding_manager: use dataclass instead of namedtuple
2021-08-03 09:06:40 -06:00
William Ballenthin
99698d0d85
move code to floss.results module
2021-08-02 09:14:52 -06:00
William Ballenthin
e77b0a6ecc
pep8
2021-07-21 18:20:10 -06:00
William Ballenthin
d90e556cb9
string decoder: don't abuse DecodedString
...
use a dedicated DeltaBytes
2021-07-21 18:19:35 -06:00
William Ballenthin
75e1e4d0bd
pep8
2021-07-21 11:06:25 -06:00
William Ballenthin
08c854e3a6
*: factor result objects into their own namespace
2021-07-21 10:49:38 -06:00
Moritz Raabe
7cfc2aa709
address Willi's feedback
...
remove a lot of unneeded list() calls
2021-05-21 18:39:37 +02:00
Moritz Raabe
707f40ed67
futurize and Python 3 cutover part 1
2021-05-19 14:29:06 +02:00
Moritz Raabe
978a8f8f35
fix black code style
2020-11-03 21:16:38 +01:00
Moritz Raabe
e21752ec5e
fix isort
2020-11-03 21:13:32 +01:00
Matt Miller
f552347120
import formatting
2020-06-11 10:39:01 -05:00
Matt Miller
9072866515
linter and syntax fix
2020-06-10 22:27:39 -05:00
Matt Miller
caa49bf2ff
reorg constants
2020-06-10 22:16:13 -05:00
Benjamin Sølberg
b9168a5e13
Added an option to set the maximum number of times emulation can
...
revisits addresses.
Increasing it improves string decoding within loops and
complex flows, but takes longer.
Also improved the string de-duplication process (still not perfect).
2019-01-08 23:30:53 +01:00
William Ballenthin
eb57aac289
main: pass max-instruction-count guardrail as cli argument
...
closes #287
2018-04-24 09:44:21 -06:00
Moritz Raabe
c65fff59c9
use min-length in extraction phase
2017-04-24 18:04:28 +02:00
Moritz Raabe
22741bbd37
add --no-filter option
2017-04-24 14:01:10 +02:00
Moritz Raabe
f5bb029870
enhanced FP filtering
2017-04-18 21:08:23 +02:00
Moritz Raabe
ceaf77b788
filter out long strings
2017-03-23 12:38:01 +01:00
Moritz Raabe
03f2fa4770
add copyright information
2017-01-10 17:22:38 +01:00
Pilate
237b538847
keep spacing
2016-06-07 08:48:03 -07:00
Pilate
6c3b546f6e
handle before/after memory being different sizes
2016-06-07 08:34:31 -07:00
Moritz Raabe
92291192dc
remove check of VA vs. SP, fixes DeltaCollectorHook issues
2016-05-25 21:57:54 -04:00
mr-tz
476c6fe7cc
Merge pull request #172 from pilate/memdiff-rewrite
...
Memdiff rewrite
2016-05-19 23:24:18 -04:00
Pilate
953a6ae164
typo
2016-05-19 16:08:39 -07:00
Pilate
0a5055ee7a
make variable names consistent with memdiff
2016-05-19 16:07:00 -07:00
Pilate
91eb8564de
remove offset docstring
2016-05-19 16:05:47 -07:00
