Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhancements and Fixes in .NET Analysis, Error Handling, and Feature Extraction #6

Merged
merged 1 commit into from
Feb 11, 2024

Conversation

jorgeaduran
Copy link
Contributor

This PR encompasses a series of targeted improvements and fixes aimed at enhancing the robustness, accuracy, and user experience of our .NET analysis framework. Below is a summary of the key changes included:

Key Improvements

.NET Analysis

  • Analysis Issues: Addressed critical bugs in .NET analysis, ensuring more accurate and reliable outcomes.
  • RwLock Usage: Transitioned to parking_lot for RwLock, enhancing concurrency control throughout the codebase.

Error Handling and Feature Extraction

  • Error Handling: Refined error handling mechanisms, particularly during feature extraction, to provide clearer insights into processing failures.
  • Feature Enhancements:
    • Improved internal naming conventions for class features, ensuring consistency and readability.
    • Enhanced the JSON output format, making the data more accessible and easier to integrate with other tools.
    • Fixed the handling of RuleFeatureType::Namespace, correcting inaccuracies in feature categorization.

Optimization and Refactoring

  • PE Header Parsing: Replaced carve_pe with find_embedded_pe_headers, streamlining the extraction process.
  • Extractor Optimization: Modified the extractor to minimize redundant reads, improving performance.
  • New Features: Added StringFeature and updated extract_insn_api_features to include ApiFeature split by ::, broadening the analysis scope.

Code Quality

  • Number Parsing Logic: Fixed sign handling errors and introduced parse_operand_to_number for more efficient number parsing from instruction operands.
  • Export Name Extraction: Optimized the extraction of export names, enhancing the clarity and utility of the analysis results.

Impact

These changes are expected to significantly improve the framework's usability, accuracy, and performance. They address known issues, introduce new capabilities, and set the stage for future enhancements.

Testing

Comprehensive testing has been conducted to validate these changes. All modifications have been carefully reviewed to ensure they do not introduce regressions or adversely affect existing functionalities.

Feel free to provide feedback or ask for further clarifications on any of the changes introduced in this PR.

…Extraction

- Fixed issues in .NET analysis.
- Implemented parking_lot for RwLock usage.
- Improved error handling during feature extraction.
- Fixed internal naming for class-feature.
- Enhanced JSON output format.
- Fixed handling of RuleFeatureType::Namespace.
- Replaced carve_pe with find_embedded_pe_headers for efficiency.
- Optimized extractor usage to minimize redundant reads.
- Added StringFeature following the introduction of new ImportFeature.
- Updated extract_insn_api_features to include ApiFeature split by ::.
- Fixed sign handling in number parsing logic.
- Optimized export name extraction in analysis.

Refactoring Instruction Number Feature Extraction:
- Introduced parse_operand_to_number to streamline number parsing from instruction operands.
- Simplified extract_insn_number_features by utilizing the new parsing function.
- Enhanced readability and maintainability of operand number extraction logic.
@marirs
Copy link
Owner

marirs commented Feb 11, 2024

This is absolutely awesome!
Thank you so much for using this library and your very valuable contribution. gratitude to you :)
Thanks

@marirs marirs merged commit 47901db into marirs:master Feb 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants