mirror of
https://github.com/mandiant/capa.git
synced 2025-12-12 15:49:46 -08:00
Merge branch 'dynamic-extractor' into dynamic-features
This commit is contained in:
@@ -327,7 +327,7 @@ class DynamicExtractor(FeatureExtractor):
|
||||
raise NotImplementedError()
|
||||
|
||||
@abc.abstractmethod
|
||||
def get_threads(self, ph: ProcessHandle) -> Iterator[ProcessHandle]:
|
||||
def get_threads(self, ph: ProcessHandle) -> Iterator[ThreadHandle]:
|
||||
"""
|
||||
Yields all the threads that a process created.
|
||||
|
||||
@@ -341,26 +341,7 @@ class DynamicExtractor(FeatureExtractor):
|
||||
"""
|
||||
Yields all the features of a thread. These include:
|
||||
- sequenced api traces
|
||||
- files/registris interacted with
|
||||
- file/registry interactions
|
||||
- network activity
|
||||
"""
|
||||
raise NotImplementedError()
|
||||
|
||||
@abc.abstractclassmethod
|
||||
def from_trace(cls, trace: TextIO) -> "DynamicExtractor":
|
||||
"""
|
||||
Most sandboxes provide reports in a serialized text format (i.e. JSON for Cuckoo and CAPE).
|
||||
This routine takes a file descriptor of such report (analysis trace) and returns a corresponding DynamicExtractor object.
|
||||
"""
|
||||
raise NotImplementedError()
|
||||
|
||||
@abc.abstractclassmethod
|
||||
def submit_sample(cls, sample: BinaryIO, api: Dict[str, str]) -> "DynamicExtractor":
|
||||
"""
|
||||
This routine takes a sample and submits it for analysis to the provided api. The trace should then ideally be passed to the from_trace() method.
|
||||
|
||||
Attributes:
|
||||
sample: file descriptor of the sample
|
||||
api: contains information such as the uri, api key, etc.
|
||||
"""
|
||||
raise NotImplementedError()
|
||||
|
||||
Reference in New Issue
Block a user