endgameinc / gym-malware Goto Github PK
View Code? Open in Web Editor NEWLicense: MIT License
License: MIT License
I wrote a strip down script to test manipulate.modify_without_breaking
import numpy as np
from gym_malware.envs.utils import interface
from gym_malware.envs.controls import manipulate2 as manipulate
# np.random.seed(322333)
# random_action = lambda bytez: np.random.choice( list(manipulate.ACTION_TABLE.keys()) )
random_action = lambda bytez: 'section_append'
# original 32bit putty.exe in sha256 file name
bytez = interface.fetch_file('1d673f12ddf0e6cc1545a79471fd5dd56bf0ff9ccff49ff91b41b4085b727665')
action = random_action(bytez)
print(action)
bytez_mod = manipulate.modify_without_breaking( bytez, [action] )
with open("putty-mod32.exe", "wb") as new_file:
new_file.write(bytez_mod)
The result PE was executed within a Windows 7 32bit but not executable/functional.
The only action that produced functional PE was overlay_append which didn't use LIEF. I tested both GUI & console windows PEs with overlay_append, the resultant files have different sha256-sum from the originals and are functional.
Unfortunately, for other actions that involved LIEF are used, the new file is not functional. I am using macOS python3.6 for this test.
When I ran the script in console, I did notice some error message for all actions that involved LIEF:
Any idea what could be the issue? Thanks!
I have tried running this project on Windows. But could not execute it properly, got more or less 6 errors and was unable to solve them. Does it only work on linux & mac?
Hello I am getting this error. While executing test_agent_chainer.py. Please help me out.
Multiprogress is so heavy that it takes much extra time.
However, thread can't be killed conveniently when the lief timeout
Is there any way to solve this problem?
If my understanding is correct you are using the same feature space for the RL agent (file test_agent_chainer.py, line 63) and the targeted classifier (file envs/utils/interface.py, line 98). I'm working on an extension of your work but I'm wondering if this is truly a black-box attack scenario when both the agent and classifier are using the same feature space.
Thanks for clarification
Traceback (most recent call last):
File "test_agent_kerasrl.py", line 59, in
dqn_success, _ = evaluate( model_policy(dqn) )
File "test_agent_kerasrl.py", line 23, in evaluate
action = action_function( bytez )
File "test_agent_kerasrl.py", line 53, in f
action_index = boltzmann_action( q_values ) # alternative: best_action
File "test_agent_kerasrl.py", line 42, in
boltzmann_action = lambda x : np.argmax( np.random.multinomial( 1, softmax(x).flatten()))
File "mtrand.pyx", line 4617, in mtrand.RandomState.multinomial (numpy/random/mtrand/mtrand.c:37769)
ValueError: sum(pvals[:-1]) > 1.0
python3 download_samples.py --vtapikey key is provided here --virustotal --zipfile 290
Namespace(nconcurrent=3, virusshare=False, virustotal=True, vtapikey=' ', zipfile=['290'], zipfilepassword=None)
Traceback (most recent call last):
File "download_samples.py", line 167, in
use_virustotal(args)
File "download_samples.py", line 92, in use_virustotal
0007df5e92070f8d12411078070bdcafb24df81c837d8113a1e047ed7ac9fba1 downloading
for i in range(args.narchiveprocs):
AttributeError: 'Namespace' object has no attribute 'narchiveprocs'
Process Process-4:
Traceback (most recent call last):
File "/usr/lib/python3.5/multiprocessing/managers.py", line 709, in _callmethod
conn = self._tls.connection
AttributeError: 'ForkAwareLocal' object has no attribute 'connection'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/python3.5/multiprocessing/process.py", line 249, in _bootstrap
self.run()
File "/usr/lib/python3.5/multiprocessing/process.py", line 93, in run
self._target(*self._args, **self._kwargs)
File "download_samples.py", line 51, in download_worker_function
sha256 = download_queue.get()
File "", line 2, in get
File "/usr/lib/python3.5/multiprocessing/managers.py", line 713, in _callmethod
self._connect()
File "/usr/lib/python3.5/multiprocessing/managers.py", line 700, in _connect
conn = self._Client(self._token.address, authkey=self._authkey)
File "/usr/lib/python3.5/multiprocessing/connection.py", line 487, in Client
c = SocketClient(address)
File "/usr/lib/python3.5/multiprocessing/connection.py", line 614, in SocketClient
s.connect(address)
FileNotFoundError: [Errno 2] No such file or directory
Process Process-3:
Traceback (most recent call last):
File "/usr/lib/python3.5/multiprocessing/process.py", line 249, in _bootstrap
self.run()
File "/usr/lib/python3.5/multiprocessing/process.py", line 93, in run
self._target(*self._args, **self._kwargs)
File "download_samples.py", line 51, in download_worker_function
sha256 = download_queue.get()
File "", line 2, in get
File "/usr/lib/python3.5/multiprocessing/managers.py", line 717, in _callmethod
kind, result = conn.recv()
File "/usr/lib/python3.5/multiprocessing/connection.py", line 250, in recv
buf = self._recv_bytes()
File "/usr/lib/python3.5/multiprocessing/connection.py", line 407, in _recv_bytes
buf = self._recv(4)
File "/usr/lib/python3.5/multiprocessing/connection.py", line 383, in _recv
raise EOFError
EOFError
0007df5e92070f8d12411078070bdcafb24df81c837d8113a1e047ed7ac9fba1 had a problem
0007df5e92070f8d12411078070bdcafb24df81c837d8113a1e047ed7ac9fba1 done
Process Process-2:
Traceback (most recent call last):
File "/usr/lib/python3.5/multiprocessing/process.py", line 249, in _bootstrap
self.run()
File "/usr/lib/python3.5/multiprocessing/process.py", line 93, in run
self._target(*self._args, **self._kwargs)
File "download_samples.py", line 67, in download_worker_function
download_queue.task_done()
File "", line 2, in task_done
File "/usr/lib/python3.5/multiprocessing/managers.py", line 716, in _callmethod
conn.send((self._id, methodname, args, kwds))
File "/usr/lib/python3.5/multiprocessing/connection.py", line 206, in send
self._send_bytes(ForkingPickler.dumps(obj))
File "/usr/lib/python3.5/multiprocessing/connection.py", line 404, in _send_bytes
self._send(header + buf)
File "/usr/lib/python3.5/multiprocessing/connection.py", line 368, in _send
n = write(self._handle, buf)
BrokenPipeError: [Errno 32] Broken pipe
Is there any limitation for commercial using?
Hello. I tried to reproduce your method with my dataset and ran into a problem.
I'm working with python3.6 on Arch Linux.
$ pip freeze
backports.weakref==1.0rc1
bleach==1.5.0
cached-property==1.3.1
certifi==2018.1.18
chainer==2.0.1
chainerrl==0.2.0
chardet==3.0.4
decorator==4.2.1
filelock==3.0.0
future==0.16.0
gym==0.9.2
h5py==2.7.0
html5lib==0.9999999
idna==2.5
ipython==6.1.0
ipython-genutils==0.2.0
jedi==0.11.1
Keras==2.0.5
keras-rl==0.3.0
lief==0.8.3
Markdown==2.6.11
nose==1.3.7
numpy==1.13.1
parso==0.1.1
pexpect==4.3.1
pickleshare==0.7.4
Pillow==5.0.0
prompt-toolkit==1.0.15
protobuf==3.5.1
ptyprocess==0.5.2
pyglet==1.3.0
Pygments==2.2.0
PyYAML==3.12
requests==2.18.1
scikit-learn==0.18.2
scipy==0.19.1
simplegeneric==0.8.1
six==1.11.0
sklearn==0.0
tensorflow==1.2.1
Theano==0.9.0
traitlets==4.3.2
urllib3==1.21.1
wcwidth==0.1.7
Werkzeug==0.14.1
PE format files are in the samles directory.
A typical file looks like this:
file 0426fd4a5075d8e1f5d919d817a72c6d1155180b74216235c7fd2249e746b5cb
0426fd4a5075d8e1f5d919d817a72c6d1155180b74216235c7fd2249e746b5cb: PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Cut from the log:
new hash: 5c0f2e48530947912c8df9c55b0f378d0ed3fa84d6207b30f717dd23c4b4d1d2
score=0.9811470102965859 (hidden), label=1.0
overlay_append
new hash: 15dce7f20d8bf5272f60303dae9af4a44a0d06681ec06f1e5251b5184a17f8bf
score=0.9811470102965859 (hidden), label=1.0
section_rename
Process Process-70:Traceback (most recent call last):
File "/usr/lib64/python3.6/multiprocessing/process.py", line 258, in _bootstrap
self.run()
File "/usr/lib64/python3.6/multiprocessing/process.py", line 93, in run
self._target(*self._args, **self._kwargs)
File "/home/ghost/PycharmProjects/gym-malware/gym_malware/envs/controls/manipulate2.py", line 359, in helper
shared_list[:] = _action(seed)
File "/home/ghost/PycharmProjects/gym-malware/gym_malware/envs/controls/manipulate2.py", line 112, in section_rename
binary = lief.PE.parse(self.bytez)
_pylief.bad_file
I hope for your help.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.