tjh.dev
fork
Configure Feed
Select the types of activity you want to include in your feed.
nixpkgs mirror (for testing)
github.com/NixOS/nixpkgs
nix
fork
Configure Feed
Select the types of activity you want to include in your feed.
1{
2 lib,
3 python3,
4 fetchFromGitHub,
5}:
6
7python3.pkgs.buildPythonPackage rec {
8 pname = "flare-floss";
9 version = "3.1.1";
10 pyproject = true;
11
12 src = fetchFromGitHub {
13 owner = "mandiant";
14 repo = "flare-floss";
15 tag = "v${version}";
16 fetchSubmodules = true; # for tests
17 hash = "sha256-ciyF1Pt5KdUsmpTgvfgE81hhTHBM5zMBcZpom99R5GY=";
18 };
19
20 postPatch = ''
21 substituteInPlace floss/main.py \
22 --replace 'sigs_path = os.path.join(get_default_root(), "sigs")' 'sigs_path = "'"$out"'/share/flare-floss/sigs"'
23 '';
24
25 pythonRelaxDeps = [ "networkx" ];
26
27 build-system = with python3.pkgs; [
28 setuptools
29 setuptools-scm
30 ];
31
32 dependencies =
33 with python3.pkgs;
34 [
35 binary2strings
36 dncil
37 halo
38 networkx
39 pefile
40 pydantic
41 rich
42 tabulate
43 tqdm
44 viv-utils
45 vivisect
46 ]
47 ++ viv-utils.optional-dependencies.flirt;
48
49 nativeCheckInputs = with python3.pkgs; [
50 pytest-sugar
51 pytestCheckHook
52 pyyaml
53 ];
54
55 postInstall = ''
56 mkdir -p $out/share/flare-floss/
57 cp -r floss/sigs $out/share/flare-floss/
58 '';
59
60 preCheck = ''
61 export HOME=$(mktemp -d)
62 '';
63
64 meta = {
65 description = "Automatically extract obfuscated strings from malware";
66 homepage = "https://github.com/mandiant/flare-floss";
67 changelog = "https://github.com/mandiant/flare-floss/releases/tag/v${version}";
68 license = lib.licenses.asl20;
69 mainProgram = "floss";
70 maintainers = with lib.maintainers; [ fab ];
71 };
72}