Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

test-cases: add support for encrypted corpus #217

Merged
merged 2 commits into from
Oct 18, 2019

Conversation

samiraguiar
Copy link
Contributor

To avoid triggering antivirus engines, we can encrypt
files with a default password and decrypt them before
testing.

Closes #215

@samiraguiar
Copy link
Contributor Author

@christian-intra2net encrypting files ends up breaking your unit test for json output. Do you have any suggestions on how to proceed?
I cannot pass the zip password to olevba since xglob would try to unzip all of the files, and not just the ones that are actually zipped. Also, there doesn't seem to be a way to exclude files from the iteration.

@samiraguiar samiraguiar force-pushed the compress-test-data branch from 695654f to 0b61807 Compare May 3, 2018 12:11
@christian-intra2net
Copy link
Contributor

Just stumbled over this, must have missed a notification I got referenced here.

I guess the json unit test fails because it iterates over all files in tests/test-data and checks if running olevba[3]/msodde -j creates valid json, right. What does it produce for the encrypted zip? Did my last pull request solve this? Otherwise, what is the error?

@decalage2
Copy link
Owner

Here's the error I see in the Travis CI logs:

======================================================================
ERROR: test_rough_doctype (tests.ooxml.test_basic.TestOOXML)
Checks all samples, expect either ole files or good ooxml output
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/travis/build/decalage2/oletools/tests/ooxml/test_basic.py", line 62, in test_rough_doctype
    acceptable = ext2doc[extn]
KeyError: 'zip'

@christian-intra2net
Copy link
Contributor

I see, then there is an easy fix which is adding "zip" to except_extns in tests.ooxml.test_basic.TestOOXML.test_rough_doctype . It will then ignore that file.

Extending every test, that loops over all test data, to deal with encrypted zip files is probably not worth the effort, except if we plan on having lots more of zip-encrypted examples. In that case every "test-data walk()ing" test would have to be adapted (only a few at the moment).

@samiraguiar
Copy link
Contributor Author

Thanks for the hint @christian-intra2net, it's fixed now.

@decalage2 decalage2 modified the milestones: oletools 0.5x, oletools 0.55 Apr 9, 2019
@samiraguiar samiraguiar changed the title test-cases: add supported for encrypted corpus test-cases: add support for encrypted corpus Apr 10, 2019
To avoid triggering antivirus engines, we can encrypt
files with a default password and decrypt them before
testing.
@decalage2 decalage2 merged commit 180a24b into decalage2:master Oct 18, 2019
christian-intra2net added a commit to christian-intra2net/oletools that referenced this pull request Nov 25, 2022
Some samples triggered antivirus engines, issues decalage2#215 and decalage2#217 ended with
the agreement to encapsulate problematic samples in encrypted zip
containers and decrypt them on-the-fly. Initial support for this was added
but that did not cover 5 tests. Create on-the-fly decryption for these
tests as well and re-enable them.
christian-intra2net added a commit to christian-intra2net/oletools that referenced this pull request Nov 25, 2022
Some samples triggered antivirus engines, issues decalage2#215 and decalage2#217 ended with
the agreement to encapsulate problematic samples in encrypted zip
containers and decrypt them on-the-fly. Initial support for this was added
but that did not cover 5 tests. Create on-the-fly decryption for these
tests as well and re-enable them.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

How to deal with test data that might trigger antivirus engines
3 participants