Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@phutelmyer
Copy link
Contributor

@phutelmyer phutelmyer commented Sep 13, 2022

Describe the change
Adding in ScanISO, which extracts file names, file sizes, and files for processing from ISO files. By default, names and sizes are collected, but files are not passed back into Strelka. In several larger ISOs, recursive extraction led to 1:10000 scan ratio, leading to a potentially overwhelmed system. A limit can be applied, but by default it is off.

This also removes iso scanning from ScanLibArchive, as that scanner's purpose was not to extract metadata about ISOs, but to pass pass files from several compressed file types (e.g., ISOs, CABs) back into Strelka. ScanISO and ScanLibArchive both scanning ISO files would be redundant.

Describe testing procedures
Executed ScanISO against 10+ ISO files, ranging from 50KB to 50MB.

Sample output

{
  "file": {
    "depth": 0,
    "flavors": {
      "mime": [
        "application/x-iso9660-image"
      ],
      "yara": [
        "iso_file"
      ]
    },
...
    "iso": {
      "elapsed": 0.002898,
      "files": [
        {
          "date_utc": "2015-02-02T15:21:03Z",
          "filename": "/BOOT.CATALOG;1",
          "size": 2048
        },
        {
          "date_utc": "2015-02-02T15:21:03Z",
          "filename": "/ISOLINUX.BIN;1",
          "size": 14336
        },
...
}

Checklist

  • My code follows the style guidelines of this project
  • I have performed a self-review of and tested my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings

@phutelmyer phutelmyer merged commit eabb1f4 into master Sep 13, 2022
@phutelmyer phutelmyer deleted the ScanISO branch September 13, 2022 11:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant