WARNING: THIS SITE IS A MIRROR OF GITHUB.COM / IT CANNOT LOGIN OR REGISTER ACCOUNTS / THE CONTENTS ARE PROVIDED AS-IS / THIS SITE ASSUMES NO RESPONSIBILITY FOR ANY DISPLAYED CONTENT OR LINKS / IF YOU FOUND SOMETHING MAY NOT GOOD FOR EVERYONE, CONTACT ADMIN AT ilovescratch@foxmail.com
Skip to content

web: Handle missing or inappropriate extension #1037

@psrok1

Description

@psrok1

Right now, we use the file name as is with some minor sanitization performed by drakrun.analyzer.startup_command.get_target_filename_from_sample_path.

If we upload file with a name that is just a hash (29611...f0), it will be uploaded to the VM with that name. As we know, extensions are important thing on Windows and without it, we may not guess the proper way to start the process.

Previously Drakvuf Sandbox tried pretty hard to find a good entrypoint based on extension, libmagic output and various file parsers. I would prefer to be able to provide a proper entrypoint rather than relying on how smart the entrypoint detector is (in some cases it failed terribly and simple cmd.exe /C start <file> was enough). That's why it would be better to rework that feature rather than improve the previous code.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions