Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

scripts/show-features.py: use extractor.get_process_name() interface … #2182

Merged

Conversation

yelhamer
Copy link
Collaborator

@yelhamer yelhamer commented Jul 1, 2024

Currently show-features.py does not use the get_process_name() extractor interface method and instead it tries to access the attribute that stores the process name directly. This can cause issues in the future if feature extractors store that attribute in different manners.

I ran into this issue while trying to use the script with the Drakvuf feature extractor, since CAPE extractor stores the process name as a pydantic object attribute, while Drakvuf extractor stores it in a dictionary.

Checklist

  • No CHANGELOG update needed
  • No new tests needed
  • No documentation update needed

@yelhamer
Copy link
Collaborator Author

yelhamer commented Jul 1, 2024

I have also fixed this bug:

if args.process not in [ph.inner["name"] for ph in args.process]:

It was iterating through args.process (a string) instead of the list process_handles

Copy link
Collaborator

@mr-tz mr-tz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good find

@mr-tz
Copy link
Collaborator

mr-tz commented Jul 1, 2024

can you add a test for the script so we don't encounter this again, please?

@mr-tz mr-tz merged commit 1a44701 into mandiant:master Jul 2, 2024
25 checks passed
@mr-tz
Copy link
Collaborator

mr-tz commented Jul 2, 2024

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants