Merge pull request #1 from CERT-Polska/update/meta

Update meta

.github/workflows/test.yml

@@ -0,0 +1,22 @@
+name: Test the code
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-python@v1
+        with:
+          python-version: 3.6
+      - run: pip install isort==5.6.4 black==20.8b1 flake8==3.8.4 mypy==0.790
+      - run: pip install -r requirements.txt
+      - run: isort --check karton/
+      - run: black --check karton/
+      - run: flake8 karton/
+      - run: mypy --namespace-packages karton/

LICENSE

@@ -1,21 +1,29 @@
-MIT License
+BSD 3-Clause License
 
-Copyright (c) 2020 CERT Polska
+Copyright (c) 2020, CERT Polska
+All rights reserved.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

README.md

@@ -3,6 +3,7 @@
 Performs initial classification of sample type. Default karton entrypoint for unrecognized samples.
 
 Author: CERT.pl
+
 Maintainers: nazywam
 
 **Consumes:**

karton/autoit_ripper/__init__.py

@@ -1,4 +1,3 @@
 from .autoit_ripper_karton import AutoItRipperKarton
 
 __all__ = ["AutoItRipperKarton"]
-

karton/autoit_ripper/__version__.py

@@ -1,2 +1 @@
 __version__ = "1.0.0"
-

karton/autoit_ripper/autoit_ripper_karton.py

@@ -1,16 +1,17 @@
 from pathlib import Path
 
+from autoit_ripper import AutoItVersion, extract  # type: ignore
 from karton.core import Karton, Resource, Task  # type: ignore
 from malduck.yara import Yara  # type: ignore
 
-from autoit_ripper import extract, AutoItVersion  # type: ignore
-from .extract_drop import extract_binary
 from .__version__ import __version__
+from .extract_drop import extract_binary
 
 
 class AutoItRipperKarton(Karton):
     """
-    Extracts embedded AutoIt scripts from binaries and additionaly tries to extract some binary drops from scripts
+    Extracts embedded AutoIt scripts from binaries and additionaly
+    tries to extract some binary drops from scripts
     """
 
     identity = "karton.autoit-ripper"

karton/autoit_ripper/extract_drop.py

@@ -5,7 +5,10 @@
 import regex  # type: ignore
 from malduck import rc4  # type: ignore
 
-BINARY_REGEX = r'(\$.*)\s*=\s*"([A-Fa-f0-9x])+"\s+(\1\s*=\s*\1\s*&\s*"([A-Fa-f0-9x]+)"\s*)+\1\s*=\s*.*\(\s*\1,\s*"(.*?)"'
+BINARY_REGEX = (
+    r'(\$.*)\s*=\s*"([A-Fa-f0-9x])+"\s+(\1\s*=\s'
+    r'*\1\s*&\s*"([A-Fa-f0-9x]+)"\s*)+\1\s*=\s*.*\(\s*\1,\s*"(.*?)"'
+)
 
 
 def extract_binary(data: str) -> Optional[bytes]:

pyproject.toml

@@ -0,0 +1,7 @@
+[tool.isort]
+multi_line_output = 3
+include_trailing_comma = true
+force_grid_wrap = 0
+use_parentheses = true
+ensure_newline_before_comments = true
+line_length = 88

requirements.txt

@@ -1,4 +1,4 @@
-karton.core==4.0.0-dev3
+karton.core==4.0.4
 malduck==3.1.0
 regex==2020.2.20
 autoit-ripper==1.0.0

setup.cfg

@@ -0,0 +1,3 @@
+[flake8]
+max-line-length = 88
+extend-ignore = E203, W503