Skip to content

Commit

Permalink
chore: Drop dependency on fact_helper_file
Browse files Browse the repository at this point in the history
The only benefit it provides over the python package magic is that
it includes some additional magic.
Now that this file is in its own repo we can simple use the
MAGIC environment variable.
As the fact_extractor is only ever run in docker it suffices to set
this in the dockerfile.
  • Loading branch information
maringuu committed Nov 7, 2023
1 parent bca3c50 commit a003405
Show file tree
Hide file tree
Showing 7 changed files with 13 additions and 10 deletions.
4 changes: 4 additions & 0 deletions Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,9 @@ WORKDIR /opt/app/fact_extractor
RUN . /venv/bin/activate && install/pre_install.sh
RUN . /venv/bin/activate && /venv/bin/python3.11 install.py

# Install additional magic database
RUN wget -O /firmware.mgc \
https://github.com/maringuu/firmware-magic-database/releases/download/v0.1.0/firmware.mgc
ENV MAGIC=/usr/share/file/magic.mgc:/firmware.mgc

ENTRYPOINT ["./docker_extraction.py"]
4 changes: 2 additions & 2 deletions fact_extractor/helperFunctions/statistics.py
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
import magic
from configparser import ConfigParser
from contextlib import suppress
from pathlib import Path
Expand All @@ -7,7 +8,6 @@
from common_helper_unpacking_classifier import (
avg_entropy, get_binary_size_without_padding, is_compressed
)
from fact_helper_file import get_file_type_from_path
from helperFunctions.config import read_list_from_config


Expand All @@ -28,7 +28,7 @@ def get_unpack_status(file_path: str, binary: bytes, extracted_files: List[Path]
meta_data['entropy'] = avg_entropy(binary)

if not extracted_files and meta_data.get('number_of_excluded_files', 0) == 0:
if get_file_type_from_path(file_path)['mime'] in read_list_from_config(config, 'ExpertSettings', 'compressed_file_types')\
if magic.from_file(file_path, mime=True) in read_list_from_config(config, 'ExpertSettings', 'compressed_file_types')\
or not is_compressed(binary, compress_entropy_threshold=config.getfloat('ExpertSettings', 'unpack_threshold'), classifier=avg_entropy):
meta_data['summary'] = ['unpacked']
else:
Expand Down
1 change: 1 addition & 0 deletions fact_extractor/install/common.py
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
'pytest',
'pytest-cov',
'testresources',
'python-magic',
],
},
}
Expand Down
1 change: 0 additions & 1 deletion fact_extractor/install/unpacker.py
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,6 @@
'pluginbase',
'git+https://github.com/armbues/python-entropy', # To be checked. Original dependency was deleted.
'git+https://github.com/fkie-cad/common_helper_unpacking_classifier.git',
'git+https://github.com/fkie-cad/fact_helper_file.git',
'git+https://github.com/wummel/patool.git',
'archmage',
# jefferson + deps
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,13 @@
'''
from __future__ import annotations

import magic
import logging
import re
import shutil
from pathlib import Path

from common_helper_process import execute_shell_command
from fact_helper_file import get_file_type_from_path

NAME = 'generic_carver'
MIME_PATTERNS = ['generic/carver']
Expand Down Expand Up @@ -45,7 +45,7 @@ def remove_false_positive_archives(self) -> str:
for file_path in self.unpack_directory.glob('**/*'):
if not file_path.is_file():
continue
file_type = get_file_type_from_path(file_path)['mime']
file_type = magic.from_file(file_path, mime=True)

if file_type == 'application/x-tar' or self._is_possible_tar(file_type, file_path):
self._remove_invalid_archives(file_path, 'tar -tvf {}', 'does not look like a tar archive')
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,12 @@
This plugin mounts filesystem images and extracts their content
'''
import re
import magic
from shlex import split
from subprocess import run, PIPE, STDOUT
from tempfile import TemporaryDirectory
from time import sleep

from fact_helper_file import get_file_type_from_path

NAME = 'genericFS'
MIME_PATTERNS = [
'filesystem/btrfs', 'filesystem/dosmbr', 'filesystem/f2fs', 'filesystem/jfs', 'filesystem/minix',
Expand All @@ -28,7 +27,7 @@


def unpack_function(file_path, tmp_dir):
mime_type = get_file_type_from_path(file_path)['mime']
mime_type = magic.from_file(file_path, mime=True)
if mime_type == 'filesystem/dosmbr':
output = _mount_from_boot_record(file_path, tmp_dir)
else:
Expand Down
4 changes: 2 additions & 2 deletions fact_extractor/unpacker/unpackBase.py
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,9 @@
from time import time
import fnmatch
from typing import Callable, Dict, List, Tuple
import magic

from common_helper_files import get_files_in_dir
from fact_helper_file import get_file_type_from_path
from helperFunctions.config import read_list_from_config
from helperFunctions.plugin import import_plugins

Expand Down Expand Up @@ -50,7 +50,7 @@ def get_unpacker(self, mime_type: str):
return self.unpacker_plugins['generic/carver']

def extract_files_from_file(self, file_path: str, tmp_dir) -> Tuple[List, Dict]:
current_unpacker = self.get_unpacker(get_file_type_from_path(file_path)['mime'])
current_unpacker = self.get_unpacker(magic.from_file(file_path, mime=True))
return self._extract_files_from_file_using_specific_unpacker(file_path, tmp_dir, current_unpacker)

def unpacking_fallback(self, file_path, tmp_dir, old_meta, fallback_plugin_mime) -> Tuple[List, Dict]:
Expand Down

0 comments on commit a003405

Please sign in to comment.