Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dump may not be a exe #40

Open
yankovs opened this issue Feb 24, 2024 · 0 comments
Open

Dump may not be a exe #40

yankovs opened this issue Feb 24, 2024 · 0 comments

Comments

@yankovs
Copy link
Contributor

yankovs commented Feb 24, 2024

Hey!

Currently dumps that have configs extracted from are uploaded to MWDB as dump:win32:exe. However, they might be for example DLLs, as is happens for example with this qbot sample: d4535652381dbee7f1640be141fe75c7ff61123dbebbe58edd91591eb64b3f70. Also, maybe not win32.

I'm not sure platform detection logic should be part of this Karton as it defeats the single responsibility design of the system as a whole. However, it might be sent to Karton as a raw file with kind: dump in persistent headers. This can be checked in classifier to prepend the dump: prefix to whatever it is it found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant