chainguard-dev / chainguard-dev/malcontent
Improve compressed file handling
Nobody has claimed this yet.
- Dominant language
- YARA
- Stars
- 675
- Forks
- 63
- Avg merge
- 23h 9m
- Merged PRs (30d)
- 24
Description
Recent work was done to handle compressed archives better, there are still some issues where some compressed files are overlooked or report different results when extracted from a containing archive. A simple example of this is extracting the uncompressed elf kernel binary out of a compressed vmlinuz image, like so (using current tip of malcont 0ffa0db5):
$ mal --format=simple analyze /boot/vmlinuz-6.8.0-51-generic | wc -l
9
$ /usr/src/linux-headers-6.8.0-51-generic/scripts/extract-vmlinux /boot/vmlinuz-6.8.0-51-generic > /tmp/vmlinux-6.8.0-51-generic
$ mal --format=simple analyze /tmp/vmlinux-6.8.0-51-generic | wc -l
139
Also, we should probably flag, either via yara rules or otherwise, situations where a file advertises it is one type of file (e.g. named something.gz, but it is some other file type).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the discrepancy with mal --format=simple analyze on the vmlinuz image and the extracted vmlinux binary, using the commands in the issue. Trace the compressed-file handling and the existing detection rules, then verify that nested compressed content is analyzed consistently and that files whose names disagree with their detected type are flagged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100