maco 1.2.8__tar.gz → 1.2.10__tar.gz

{maco-1.2.8/maco.egg-info → maco-1.2.10}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: maco
-Version: 1.2.8
+Version: 1.2.10
 Author: sl-govau
 Maintainer: cccs-rs
 License: MIT License
@@ -35,6 +35,7 @@ Requires-Dist: tomli>=1.1.0; python_version < "3.11"
 Requires-Dist: uv
 Requires-Dist: yara-python
 Requires-Dist: yara-x==0.11.0
+Requires-Dist: multiprocess>=0.70.17
 
 # Maco - Malware config extractor framework
 

{maco-1.2.8 → maco-1.2.10}/maco/collector.py

@@ -5,11 +5,11 @@ import logging
 import logging.handlers
 import os
 import sys
-from multiprocessing import Manager, Process, Queue
 from tempfile import NamedTemporaryFile
 from types import ModuleType
-from typing import Any, BinaryIO, Dict, List, Union
+from typing import Any, BinaryIO, Dict, List, TypedDict, Union
 
+from multiprocess import Manager, Process, Queue
 from pydantic import BaseModel
 
 from maco import extractor, model, utils, yara
@@ -40,6 +40,26 @@ def _verify_response(resp: Union[BaseModel, dict]) -> Dict:
     return resp.model_dump(exclude_defaults=True)
 
 
+class ExtractorMetadata(TypedDict):
+    """Extractor-supplied metadata."""
+
+    author: str
+    family: str
+    last_modified: str
+    sharing: str
+    description: str
+
+
+class ExtractorRegistration(TypedDict):
+    """Registration collected by the collector for a single extractor."""
+
+    venv: str
+    module_path: str
+    module_name: str
+    extractor_class: str
+    metadata: ExtractorMetadata
+
+
 class Collector:
     def __init__(
         self,
@@ -60,7 +80,7 @@ class Collector:
 
         path_extractors = os.path.realpath(path_extractors)
         self.path: str = path_extractors
-        self.extractors: Dict[str, Dict[str, str]] = {}
+        self.extractors: Dict[str, ExtractorRegistration] = {}
 
         with Manager() as manager:
             extractors = manager.dict()

{maco-1.2.8 → maco-1.2.10}/maco/utils.py

@@ -6,7 +6,6 @@ import inspect
 import json
 import logging
 import logging.handlers
-import multiprocessing
 import os
 import re
 import shutil
@@ -14,6 +13,8 @@ import subprocess
 import sys
 import tempfile
 
+from multiprocess import Queue
+
 from maco import yara
 
 if sys.version_info >= (3, 11):
@@ -38,8 +39,8 @@ logger = logging.getLogger("maco.lib.utils")
 
 VENV_DIRECTORY_NAME = ".venv"
 
-RELATIVE_FROM_RE = re.compile(r"from (\.+)")
-RELATIVE_FROM_IMPORT_RE = re.compile(r"from (\.+) import")
+RELATIVE_FROM_RE = re.compile(rb"from (\.+)")
+RELATIVE_FROM_IMPORT_RE = re.compile(rb"from (\.+) import")
 
 UV_BIN = find_uv_bin()
 
@@ -170,19 +171,19 @@ def scan_for_extractors(root_directory: str, scanner: yara.Rules, logger: Logger
                 # Scan Python file for potential extractors
                 if package:
                     # Inspect the contents and look for any relative import issues
-                    with open(path, "r") as f:
+                    with open(path, "rb") as f:
                         data = f.read()
 
-                    with open(path, "w") as f:
+                    with open(path, "wb") as f:
                         # Replace any relative importing with absolute
                         curr_dir = os.path.dirname(path)
                         split = curr_dir.split("/")[::-1]
                         for pattern in [RELATIVE_FROM_IMPORT_RE, RELATIVE_FROM_RE]:
                             for match in pattern.findall(data):
-                                depth = match.count(".")
+                                depth = match.count(b".")
                                 abspath = ".".join(split[depth - 1 : split.index(package) + 1][::-1])
                                 abspath += "." if pattern == RELATIVE_FROM_RE else ""
-                                data = data.replace(f"from {match}", f"from {abspath}", 1)
+                                data = data.replace(f"from {match.decode()}".encode(), f"from {abspath}".encode(), 1)
                         f.write(data)
 
                 if scanner.match(path):
@@ -390,7 +391,7 @@ def register_extractors(
                 break
 
 
-def proxy_logging(queue: multiprocessing.Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
+def proxy_logging(queue: Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
     """Ensures logging is set up correctly for a child process and then executes the callback."""
     logger = logging.getLogger()
     qh = logging.handlers.QueueHandler(queue)

{maco-1.2.8 → maco-1.2.10/maco.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: maco
-Version: 1.2.8
+Version: 1.2.10
 Author: sl-govau
 Maintainer: cccs-rs
 License: MIT License
@@ -35,6 +35,7 @@ Requires-Dist: tomli>=1.1.0; python_version < "3.11"
 Requires-Dist: uv
 Requires-Dist: yara-python
 Requires-Dist: yara-x==0.11.0
+Requires-Dist: multiprocess>=0.70.17
 
 # Maco - Malware config extractor framework
 

{maco-1.2.8 → maco-1.2.10}/maco.egg-info/requires.txt

@@ -3,6 +3,7 @@ pydantic>=2.0.0
 uv
 yara-python
 yara-x==0.11.0
+multiprocess>=0.70.17
 
 [:python_version < "3.11"]
 tomli>=1.1.0

{maco-1.2.8 → maco-1.2.10}/model_setup/maco/collector.py

@@ -5,11 +5,11 @@ import logging
 import logging.handlers
 import os
 import sys
-from multiprocessing import Manager, Process, Queue
 from tempfile import NamedTemporaryFile
 from types import ModuleType
-from typing import Any, BinaryIO, Dict, List, Union
+from typing import Any, BinaryIO, Dict, List, TypedDict, Union
 
+from multiprocess import Manager, Process, Queue
 from pydantic import BaseModel
 
 from maco import extractor, model, utils, yara
@@ -40,6 +40,26 @@ def _verify_response(resp: Union[BaseModel, dict]) -> Dict:
     return resp.model_dump(exclude_defaults=True)
 
 
+class ExtractorMetadata(TypedDict):
+    """Extractor-supplied metadata."""
+
+    author: str
+    family: str
+    last_modified: str
+    sharing: str
+    description: str
+
+
+class ExtractorRegistration(TypedDict):
+    """Registration collected by the collector for a single extractor."""
+
+    venv: str
+    module_path: str
+    module_name: str
+    extractor_class: str
+    metadata: ExtractorMetadata
+
+
 class Collector:
     def __init__(
         self,
@@ -60,7 +80,7 @@ class Collector:
 
         path_extractors = os.path.realpath(path_extractors)
         self.path: str = path_extractors
-        self.extractors: Dict[str, Dict[str, str]] = {}
+        self.extractors: Dict[str, ExtractorRegistration] = {}
 
         with Manager() as manager:
             extractors = manager.dict()

{maco-1.2.8 → maco-1.2.10}/model_setup/maco/utils.py

@@ -6,7 +6,6 @@ import inspect
 import json
 import logging
 import logging.handlers
-import multiprocessing
 import os
 import re
 import shutil
@@ -14,6 +13,8 @@ import subprocess
 import sys
 import tempfile
 
+from multiprocess import Queue
+
 from maco import yara
 
 if sys.version_info >= (3, 11):
@@ -38,8 +39,8 @@ logger = logging.getLogger("maco.lib.utils")
 
 VENV_DIRECTORY_NAME = ".venv"
 
-RELATIVE_FROM_RE = re.compile(r"from (\.+)")
-RELATIVE_FROM_IMPORT_RE = re.compile(r"from (\.+) import")
+RELATIVE_FROM_RE = re.compile(rb"from (\.+)")
+RELATIVE_FROM_IMPORT_RE = re.compile(rb"from (\.+) import")
 
 UV_BIN = find_uv_bin()
 
@@ -170,19 +171,19 @@ def scan_for_extractors(root_directory: str, scanner: yara.Rules, logger: Logger
                 # Scan Python file for potential extractors
                 if package:
                     # Inspect the contents and look for any relative import issues
-                    with open(path, "r") as f:
+                    with open(path, "rb") as f:
                         data = f.read()
 
-                    with open(path, "w") as f:
+                    with open(path, "wb") as f:
                         # Replace any relative importing with absolute
                         curr_dir = os.path.dirname(path)
                         split = curr_dir.split("/")[::-1]
                         for pattern in [RELATIVE_FROM_IMPORT_RE, RELATIVE_FROM_RE]:
                             for match in pattern.findall(data):
-                                depth = match.count(".")
+                                depth = match.count(b".")
                                 abspath = ".".join(split[depth - 1 : split.index(package) + 1][::-1])
                                 abspath += "." if pattern == RELATIVE_FROM_RE else ""
-                                data = data.replace(f"from {match}", f"from {abspath}", 1)
+                                data = data.replace(f"from {match.decode()}".encode(), f"from {abspath}".encode(), 1)
                         f.write(data)
 
                 if scanner.match(path):
@@ -390,7 +391,7 @@ def register_extractors(
                 break
 
 
-def proxy_logging(queue: multiprocessing.Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
+def proxy_logging(queue: Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
     """Ensures logging is set up correctly for a child process and then executes the callback."""
     logger = logging.getLogger()
     qh = logging.handlers.QueueHandler(queue)

{maco-1.2.8 → maco-1.2.10}/requirements.txt

@@ -4,3 +4,4 @@ tomli >= 1.1.0 ; python_version < "3.11"
 uv
 yara-python
 yara-x==0.11.0
+multiprocess>=0.70.17