maco 1.2.10__tar.gz → 1.2.12__tar.gz

{maco-1.2.10/maco.egg-info → maco-1.2.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: maco
-Version: 1.2.10
+Version: 1.2.12
 Author: sl-govau
 Maintainer: cccs-rs
 License: MIT License

maco-1.2.12/demo_extractors/requirements.txt

@@ -0,0 +1,4 @@
+httpx
+
+# Install maco from source for testing
+../

maco-1.2.12/demo_extractors/terminator.py

@@ -0,0 +1,17 @@
+from io import BytesIO
+from typing import List, Optional
+
+from maco import extractor, model, yara
+from maco.exceptions import AnalysisAbortedException
+
+
+class Terminator(extractor.Extractor):
+    """Terminates early during extraction"""
+
+    family = "terminator"
+    author = "skynet"
+    last_modified = "1997-08-29"
+
+    def run(self, stream: BytesIO, matches: List[yara.Match]) -> Optional[model.ExtractorModel]:
+        # Terminate early and indicate I can't run on this sample
+        raise AnalysisAbortedException("I can't run on this sample")

{maco-1.2.10/model_setup → maco-1.2.12}/maco/cli.py

@@ -3,18 +3,20 @@
 import argparse
 import base64
 import binascii
+import cart
 import hashlib
 import io
 import json
 import logging
 import os
 import sys
-from typing import BinaryIO, List, Tuple
 
-import cart
+from importlib.metadata import version
+from typing import BinaryIO, List, Tuple
 
 from maco import collector
 
+
 logger = logging.getLogger("maco.lib.cli")
 
 
@@ -92,6 +94,7 @@ def process_filesystem(
     force: bool,
     include_base64: bool,
     create_venv: bool = False,
+    skip_install: bool = False,
 ) -> Tuple[int, int, int]:
     """Process filesystem with extractors and print results of extraction.
 
@@ -99,7 +102,9 @@ def process_filesystem(
     """
     if force:
         logger.warning("force execute will cause errors if an extractor requires a yara rule hit during execution")
-    collected = collector.Collector(path_extractors, include=include, exclude=exclude, create_venv=create_venv)
+    collected = collector.Collector(
+        path_extractors, include=include, exclude=exclude, create_venv=create_venv, skip_install=skip_install
+    )
 
     logger.info(f"extractors loaded: {[x for x in collected.extractors.keys()]}\n")
     for _, extractor in collected.extractors.items():
@@ -191,6 +196,18 @@ def main():
         "This runs much slower than the alternative but may be necessary "
         "when there are many extractors with conflicting dependencies.",
     )
+    parser.add_argument(
+        "--force_install",
+        action="store_true",
+        help="Force installation of Python dependencies for extractors (in both host and virtual environments).",
+    )
+    parser.add_argument(
+        "--version",
+        action="version",
+        version=f"version: {version('maco')}",
+        help="Show version of MACO",
+    )
+
     args = parser.parse_args()
     inc = args.include.split(",") if args.include else []
     exc = args.exclude.split(",") if args.exclude else []
@@ -236,6 +253,7 @@ def main():
         force=args.force,
         include_base64=args.base64,
         create_venv=args.create_venv,
+        skip_install=not args.force_install,
     )
 
 

{maco-1.2.10 → maco-1.2.12}/maco/collector.py

@@ -13,6 +13,7 @@ from multiprocess import Manager, Process, Queue
 from pydantic import BaseModel
 
 from maco import extractor, model, utils, yara
+from maco.exceptions import AnalysisAbortedException
 
 
 class ExtractorLoadError(Exception):
@@ -67,6 +68,7 @@ class Collector:
         include: List[str] = None,
         exclude: List[str] = None,
         create_venv: bool = False,
+        skip_install: bool = False,
     ):
         """Discover and load extractors from file system."""
         # maco requires the extractor to be imported directly, so ensure they are available on the path
@@ -135,6 +137,7 @@ class Collector:
                     root_directory=path_extractors,
                     scanner=yara.compile(source=utils.MACO_YARA_RULE),
                     create_venv=create_venv and os.path.isdir(path_extractors),
+                    skip_install=skip_install,
                 ),
             )
             p.start()
@@ -189,6 +192,9 @@ class Collector:
                         venv=extractor["venv"],
                     )
                 )
+        except AnalysisAbortedException:
+            # Extractor voluntarily aborted analysis of sample
+            return
         except Exception:
             # caller can deal with the exception
             raise

maco-1.2.12/maco/exceptions.py

@@ -0,0 +1,3 @@
+# Can be raised by extractors to abort analysis of a sample
+# ie. Can abort if preliminary checks at start of run indicate the file shouldn't be analyzed by extractor
+class AnalysisAbortedException(Exception): ...

{maco-1.2.10 → maco-1.2.12}/maco/utils.py

@@ -34,6 +34,7 @@ from uv import find_uv_bin
 
 from maco import model
 from maco.extractor import Extractor
+from maco.exceptions import AnalysisAbortedException
 
 logger = logging.getLogger("maco.lib.utils")
 
@@ -450,9 +451,19 @@ def run_extractor(
         key = f"{module_name}_{extractor_class}"
         if key not in _loaded_extractors:
             # dynamic import of extractor
-            mod = importlib.import_module(module_name)
-            extractor_cls = mod.__getattribute__(extractor_class)
-            extractor = extractor_cls()
+            try:
+                # Add the correct directory to the PATH before attempting to load the extractor
+                import_path = module_path[: -4 - len(module_name)]
+                sys.path.insert(1, import_path)
+                mod = importlib.import_module(module_name)
+                extractor_cls = mod.__getattribute__(extractor_class)
+                extractor = extractor_cls()
+
+                # Add to cache
+                _loaded_extractors[key] = extractor
+            finally:
+                sys.path.pop(1)
+
         else:
             # retrieve cached extractor
             extractor = _loaded_extractors[key]
@@ -504,9 +515,15 @@ def run_extractor(
                     exception = stderr
                     if delim in exception:
                         exception = f"{delim}{exception.split(delim, 1)[1]}"
-                    # print extractor logging at error level
-                    logger.error(f"maco extractor raised exception, stderr:\n{stderr}")
-                    raise Exception(exception) from e
+                    if "maco.exceptions.AnalysisAbortedException" in exception:
+                        # Extractor voluntarily terminated, re-raise exception to be handled by collector
+                        raise AnalysisAbortedException(
+                            exception.split("maco.exceptions.AnalysisAbortedException: ")[-1]
+                        )
+                    else:
+                        # print extractor logging at error level
+                        logger.error(f"maco extractor raised exception, stderr:\n{stderr}")
+                        raise Exception(exception) from e
                 # ensure that extractor logging is available
                 logger.info(f"maco extractor stderr:\n{stderr}")
     return loaded

{maco-1.2.10 → maco-1.2.12/maco.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: maco
-Version: 1.2.10
+Version: 1.2.12
 Author: sl-govau
 Maintainer: cccs-rs
 License: MIT License

{maco-1.2.10 → maco-1.2.12}/maco.egg-info/SOURCES.txt

@@ -11,6 +11,7 @@ demo_extractors/limit_other.py
 demo_extractors/nothing.py
 demo_extractors/requirements.txt
 demo_extractors/shared.py
+demo_extractors/terminator.py
 demo_extractors/complex/__init__.py
 demo_extractors/complex/complex.py
 demo_extractors/complex/complex_utils.py
@@ -18,6 +19,7 @@ maco/__init__.py
 maco/base_test.py
 maco/cli.py
 maco/collector.py
+maco/exceptions.py
 maco/extractor.py
 maco/utils.py
 maco/yara.py
@@ -38,6 +40,7 @@ model_setup/maco/__init__.py
 model_setup/maco/base_test.py
 model_setup/maco/cli.py
 model_setup/maco/collector.py
+model_setup/maco/exceptions.py
 model_setup/maco/extractor.py
 model_setup/maco/utils.py
 model_setup/maco/yara.py

{maco-1.2.10 → maco-1.2.12/model_setup}/maco/cli.py

@@ -3,18 +3,20 @@
 import argparse
 import base64
 import binascii
+import cart
 import hashlib
 import io
 import json
 import logging
 import os
 import sys
-from typing import BinaryIO, List, Tuple
 
-import cart
+from importlib.metadata import version
+from typing import BinaryIO, List, Tuple
 
 from maco import collector
 
+
 logger = logging.getLogger("maco.lib.cli")
 
 
@@ -92,6 +94,7 @@ def process_filesystem(
     force: bool,
     include_base64: bool,
     create_venv: bool = False,
+    skip_install: bool = False,
 ) -> Tuple[int, int, int]:
     """Process filesystem with extractors and print results of extraction.
 
@@ -99,7 +102,9 @@ def process_filesystem(
     """
     if force:
         logger.warning("force execute will cause errors if an extractor requires a yara rule hit during execution")
-    collected = collector.Collector(path_extractors, include=include, exclude=exclude, create_venv=create_venv)
+    collected = collector.Collector(
+        path_extractors, include=include, exclude=exclude, create_venv=create_venv, skip_install=skip_install
+    )
 
     logger.info(f"extractors loaded: {[x for x in collected.extractors.keys()]}\n")
     for _, extractor in collected.extractors.items():
@@ -191,6 +196,18 @@ def main():
         "This runs much slower than the alternative but may be necessary "
         "when there are many extractors with conflicting dependencies.",
     )
+    parser.add_argument(
+        "--force_install",
+        action="store_true",
+        help="Force installation of Python dependencies for extractors (in both host and virtual environments).",
+    )
+    parser.add_argument(
+        "--version",
+        action="version",
+        version=f"version: {version('maco')}",
+        help="Show version of MACO",
+    )
+
     args = parser.parse_args()
     inc = args.include.split(",") if args.include else []
     exc = args.exclude.split(",") if args.exclude else []
@@ -236,6 +253,7 @@ def main():
         force=args.force,
         include_base64=args.base64,
         create_venv=args.create_venv,
+        skip_install=not args.force_install,
     )
 
 

{maco-1.2.10 → maco-1.2.12}/model_setup/maco/collector.py

@@ -13,6 +13,7 @@ from multiprocess import Manager, Process, Queue
 from pydantic import BaseModel
 
 from maco import extractor, model, utils, yara
+from maco.exceptions import AnalysisAbortedException
 
 
 class ExtractorLoadError(Exception):
@@ -67,6 +68,7 @@ class Collector:
         include: List[str] = None,
         exclude: List[str] = None,
         create_venv: bool = False,
+        skip_install: bool = False,
     ):
         """Discover and load extractors from file system."""
         # maco requires the extractor to be imported directly, so ensure they are available on the path
@@ -135,6 +137,7 @@ class Collector:
                     root_directory=path_extractors,
                     scanner=yara.compile(source=utils.MACO_YARA_RULE),
                     create_venv=create_venv and os.path.isdir(path_extractors),
+                    skip_install=skip_install,
                 ),
             )
             p.start()
@@ -189,6 +192,9 @@ class Collector:
                         venv=extractor["venv"],
                     )
                 )
+        except AnalysisAbortedException:
+            # Extractor voluntarily aborted analysis of sample
+            return
         except Exception:
             # caller can deal with the exception
             raise

maco-1.2.12/model_setup/maco/exceptions.py

@@ -0,0 +1,3 @@
+# Can be raised by extractors to abort analysis of a sample
+# ie. Can abort if preliminary checks at start of run indicate the file shouldn't be analyzed by extractor
+class AnalysisAbortedException(Exception): ...

{maco-1.2.10 → maco-1.2.12}/model_setup/maco/utils.py

@@ -34,6 +34,7 @@ from uv import find_uv_bin
 
 from maco import model
 from maco.extractor import Extractor
+from maco.exceptions import AnalysisAbortedException
 
 logger = logging.getLogger("maco.lib.utils")
 
@@ -450,9 +451,19 @@ def run_extractor(
         key = f"{module_name}_{extractor_class}"
         if key not in _loaded_extractors:
             # dynamic import of extractor
-            mod = importlib.import_module(module_name)
-            extractor_cls = mod.__getattribute__(extractor_class)
-            extractor = extractor_cls()
+            try:
+                # Add the correct directory to the PATH before attempting to load the extractor
+                import_path = module_path[: -4 - len(module_name)]
+                sys.path.insert(1, import_path)
+                mod = importlib.import_module(module_name)
+                extractor_cls = mod.__getattribute__(extractor_class)
+                extractor = extractor_cls()
+
+                # Add to cache
+                _loaded_extractors[key] = extractor
+            finally:
+                sys.path.pop(1)
+
         else:
             # retrieve cached extractor
             extractor = _loaded_extractors[key]
@@ -504,9 +515,15 @@ def run_extractor(
                     exception = stderr
                     if delim in exception:
                         exception = f"{delim}{exception.split(delim, 1)[1]}"
-                    # print extractor logging at error level
-                    logger.error(f"maco extractor raised exception, stderr:\n{stderr}")
-                    raise Exception(exception) from e
+                    if "maco.exceptions.AnalysisAbortedException" in exception:
+                        # Extractor voluntarily terminated, re-raise exception to be handled by collector
+                        raise AnalysisAbortedException(
+                            exception.split("maco.exceptions.AnalysisAbortedException: ")[-1]
+                        )
+                    else:
+                        # print extractor logging at error level
+                        logger.error(f"maco extractor raised exception, stderr:\n{stderr}")
+                        raise Exception(exception) from e
                 # ensure that extractor logging is available
                 logger.info(f"maco extractor stderr:\n{stderr}")
     return loaded

{maco-1.2.10 → maco-1.2.12}/tests/test_base_test.py

@@ -61,3 +61,29 @@ class TestComplexVenv(base_test.BaseTest):
         ret = self.extract(self.load_cart("data/trigger_complex.txt.cart"))
         self.assertEqual(ret["family"], "complex")
         self.assertEqual(ret["version"], "5")
+
+
+class TestTerminator(base_test.BaseTest):
+    """Test that terminator extractor can be used in base environment."""
+
+    name = "Terminator"
+    path = os.path.join(__file__, "../../demo_extractors")
+    create_venv = False
+
+    def test_extract(self):
+        """Tests that we can run an extractor through maco."""
+        ret = self.extract(self.load_cart("data/trigger_complex.txt.cart"))
+        self.assertEqual(ret, None)
+
+
+class TestTerminatorVenv(base_test.BaseTest):
+    """Test that terminator extractor can be used in base environment."""
+
+    name = "Terminator"
+    path = os.path.join(__file__, "../../demo_extractors")
+    create_venv = True
+
+    def test_extract(self):
+        """Tests that we can run an extractor through maco."""
+        ret = self.extract(self.load_cart("data/trigger_complex.txt.cart"))
+        self.assertEqual(ret, None)

{maco-1.2.10 → maco-1.2.12}/tests/test_demo_extractors.py

@@ -11,12 +11,7 @@ class TestDemoExtractors(unittest.TestCase):
         collector = Collector(os.path.join(__file__, "../../demo_extractors"))
         self.assertEqual(
             set(collector.extractors.keys()),
-            {
-                "Elfy",
-                "Nothing",
-                "Complex",
-                "LimitOther",
-            },
+            {"Elfy", "Nothing", "Complex", "LimitOther", "Terminator"},
         )
 
         with open(path_file, "rb") as stream:

{maco-1.2.10 → maco-1.2.12}/tests/test_helpers.py

@@ -25,14 +25,7 @@ class TestHelpersCompileYara(unittest.TestCase):
         m = collector.Collector(target)
         self.assertEqual(
             {x.identifier for x in m.rules},
-            {
-                "Elfy",
-                "Complex",
-                "ComplexSubtext",
-                "Nothing",
-                "ComplexAlt",
-                "LimitOther",
-            },
+            {"Elfy", "Complex", "ComplexSubtext", "Nothing", "ComplexAlt", "LimitOther", "Terminator"},
         )
 
 

maco-1.2.10/demo_extractors/requirements.txt

@@ -1 +0,0 @@
-httpx