Skip to content

Conversation

@tonykarg
Copy link

@tonykarg tonykarg commented Apr 7, 2021

Instead of passing bytes-like object (file_data) to bits_parser's (https://github.com/ANSSI-FR/bits_parser) method
bits/bits.py->load_file(cls, fp) which expects str-like object (simple file path) , simply pass file_path argument of BitsParser.process_file method.

Here it is shown how passed argument is treated in bits_parser/bits/bits.py->load_file
https://github.com/ANSSI-FR/bits_parser/blob/717337cd7a0f97561b77543fb0cebb4e7ce7c0b7/bits/bits.py#L47

def load_file(cls, fp):
        ...
        logger.info('Processing BITS queue %s' % fp)

        rv = cls()

        path = Path(fp).resolve()
        ...

Without this change BitsParser fails to parse old format qmgr state files (with .dat extension) with next exception:

Processing file <path>\qmgr0.dat
Exception occurred processing file <path>\qmgr0.dat: Traceback (most recent call last):
  File "BitsParser.py", line 366, in process_file
    jobs = self.load_qmgr_jobs(file_data)
  File "BitsParser.py", line 101, in load_qmgr_jobs
    analyzer = bits.Bits.load_file(file_data)
  File "<python_path>\bits.py", line 46, in load_file
    path = Path(fp).resolve()
  File "<python_path>\lib\pathlib.py", line 1027, in __new__
    self = cls._from_parts(args, init=False)
  File "<python_path>\lib\pathlib.py", line 674, in _from_parts
    drv, root, parts = self._parse_args(args)
  File "<python_path>\lib\pathlib.py", line 666, in _parse_args
    % type(a))
TypeError: argument should be a str object or an os.PathLike object returning str, not <class 'bytes'>

Anton Kargin added 2 commits April 7, 2021 15:23
Instead of passing bytes-like object (file_data) bits_parser's (https://github.com/ANSSI-FR/bits_parser)
method bits/bits.py->load_file(cls, fp) expects str-like object (simple file path) .
It can be seen here:
https://github.com/ANSSI-FR/bits_parser/blob/717337cd7a0f97561b77543fb0cebb4e7ce7c0b7/bits/bits.py#L47

Without this change BitsParser fails to parse old format qmgr state files (with .dat extension)
with next exception:
Processing file <path>\qmgr0.dat
Exception occurred processing file <path>\qmgr0.dat: Traceback (most recent call last):
  File "BitsParser.py", line 366, in process_file
    jobs = self.load_qmgr_jobs(file_data)
  File "BitsParser.py", line 101, in load_qmgr_jobs
    analyzer = bits.Bits.load_file(file_data)
  File "<python_path>\bits.py", line 46, in load_file
    path = Path(fp).resolve()
  File "<python_path>\lib\pathlib.py", line 1027, in __new__
    self = cls._from_parts(args, init=False)
  File "<python_path>\lib\pathlib.py", line 674, in _from_parts
    drv, root, parts = self._parse_args(args)
  File "<python_path>\lib\pathlib.py", line 666, in _parse_args
    % type(a))
TypeError: argument should be a str object or an os.PathLike object returning str, not <class 'bytes'>
Added csv_writer.py.
It's nearly exact copy of file bits/writer.py from bits_parser:
https://github.com/ANSSI-FR/bits_parser/blob/master/bits/writer.py
I just changed DEFAULT_VALUES dictionary keys for correct mapping with keys from FireEye's BitsParser.

Also added some code in BitsParser.py.

To output in csv format simply specify ".csv" extension in output filename, when using -o|--output argument.
For example:
python BitsParser.py -o "csv_output.csv"

It will append data from all processed files into specified output file.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant