Skip to content

Commit

Permalink
Apply suggestions from code review
Browse files Browse the repository at this point in the history
Co-authored-by: Michał Praszmo <michalpr@cert.pl>
  • Loading branch information
psrok1 and nazywam authored Jul 26, 2023
1 parent 466cf6d commit ad880dd
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions malduck/extractor/extract_manager.py
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ def match_procmem(self, p: ProcessMemory) -> YaraRulesetMatch:
bound with current ExtractManager.
"""
matches = p.yarap(self.rules, extended=True)
log.debug("Matched rules: %s", list(matches.keys()))
log.debug("Matched rules: %s", ",".join(list(matches.keys())))
return matches

def carve_procmem(self, p: ProcessMemory) -> List[ProcessMemoryBinary]:
Expand All @@ -130,13 +130,13 @@ def carve_procmem(self, p: ProcessMemory) -> List[ProcessMemoryBinary]:
binaries += carved_bins
return binaries

def push_config(self, config: Config):
def push_config(self, config: Config) -> bool:
if not config.get("family"):
return False

family = config["family"]
if family in self.configs:
if is_config_better(self.configs[family], config):
if is_config_better(base_config=self.configs[family], new_config=config):
self.configs[family] = config
log.debug("%s config looks better than previous one", family)
return True
Expand Down Expand Up @@ -171,7 +171,7 @@ def push_config(self, config: Config):
self.configs[family] = config
return True

def _extract_procmem(self, p: ProcessMemory, matches):
def _extract_procmem(self, p: ProcessMemory, matches) -> List[Config]:
log.debug("%s - ripping...", repr(p))
# Create extraction context for single file
manager = ExtractionContext(parent=self)
Expand Down Expand Up @@ -237,7 +237,7 @@ def __init__(self, parent: ExtractManager) -> None:
self.parent = parent #: Bound ExtractManager instance

@property
def family(self):
def family(self) -> str:
"""Matched family"""
return self.collected_config.get("family")

Expand Down

0 comments on commit ad880dd

Please sign in to comment.