endgameinc / gym-malware Goto Github PK

Hello I am getting this error. While executing test_agent_chainer.py. Please help me out.

python3 download_samples.py --vtapikey key is provided here --virustotal --zipfile 290

Namespace(nconcurrent=3, virusshare=False, virustotal=True, vtapikey=' ', zipfile=['290'], zipfilepassword=None)
Traceback (most recent call last):
File "download_samples.py", line 167, in
use_virustotal(args)
File "download_samples.py", line 92, in use_virustotal
0007df5e92070f8d12411078070bdcafb24df81c837d8113a1e047ed7ac9fba1 downloading
for i in range(args.narchiveprocs):
AttributeError: 'Namespace' object has no attribute 'narchiveprocs'
Process Process-4:
Traceback (most recent call last):
File "/usr/lib/python3.5/multiprocessing/managers.py", line 709, in _callmethod
conn = self._tls.connection
AttributeError: 'ForkAwareLocal' object has no attribute 'connection'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/lib/python3.5/multiprocessing/process.py", line 249, in _bootstrap
self.run()
File "/usr/lib/python3.5/multiprocessing/process.py", line 93, in run
self._target(*self._args, **self._kwargs)
File "download_samples.py", line 51, in download_worker_function
sha256 = download_queue.get()
File "", line 2, in get
File "/usr/lib/python3.5/multiprocessing/managers.py", line 713, in _callmethod
self._connect()
File "/usr/lib/python3.5/multiprocessing/managers.py", line 700, in _connect
conn = self._Client(self._token.address, authkey=self._authkey)
File "/usr/lib/python3.5/multiprocessing/connection.py", line 487, in Client
c = SocketClient(address)
File "/usr/lib/python3.5/multiprocessing/connection.py", line 614, in SocketClient
s.connect(address)
FileNotFoundError: [Errno 2] No such file or directory
Process Process-3:
Traceback (most recent call last):
File "/usr/lib/python3.5/multiprocessing/process.py", line 249, in _bootstrap
self.run()
File "/usr/lib/python3.5/multiprocessing/process.py", line 93, in run
self._target(*self._args, **self._kwargs)
File "download_samples.py", line 51, in download_worker_function
sha256 = download_queue.get()
File "", line 2, in get
File "/usr/lib/python3.5/multiprocessing/managers.py", line 717, in _callmethod
kind, result = conn.recv()
File "/usr/lib/python3.5/multiprocessing/connection.py", line 250, in recv
buf = self._recv_bytes()
File "/usr/lib/python3.5/multiprocessing/connection.py", line 407, in _recv_bytes
buf = self._recv(4)
File "/usr/lib/python3.5/multiprocessing/connection.py", line 383, in _recv
raise EOFError
EOFError
0007df5e92070f8d12411078070bdcafb24df81c837d8113a1e047ed7ac9fba1 had a problem
0007df5e92070f8d12411078070bdcafb24df81c837d8113a1e047ed7ac9fba1 done
Process Process-2:
Traceback (most recent call last):
File "/usr/lib/python3.5/multiprocessing/process.py", line 249, in _bootstrap
self.run()
File "/usr/lib/python3.5/multiprocessing/process.py", line 93, in run
self._target(*self._args, **self._kwargs)
File "download_samples.py", line 67, in download_worker_function
download_queue.task_done()
File "", line 2, in task_done
File "/usr/lib/python3.5/multiprocessing/managers.py", line 716, in _callmethod
conn.send((self._id, methodname, args, kwds))
File "/usr/lib/python3.5/multiprocessing/connection.py", line 206, in send
self._send_bytes(ForkingPickler.dumps(obj))
File "/usr/lib/python3.5/multiprocessing/connection.py", line 404, in _send_bytes
self._send(header + buf)
File "/usr/lib/python3.5/multiprocessing/connection.py", line 368, in _send
n = write(self._handle, buf)
BrokenPipeError: [Errno 32] Broken pipe

I can not download the malware samples from Virustotal using the download_samples.py script inside the repo folder[Kindly see the error in the image below]. I will highly appreciate your help on this.

My Python version is 3.8

• I have checked that there is no similar issue.

I have tried running this project on Windows. But could not execute it properly, got more or less 6 errors and was unable to solve them. Does it only work on linux & mac?

If my understanding is correct you are using the same feature space for the RL agent (file test_agent_chainer.py, line 63) and the targeted classifier (file envs/utils/interface.py, line 98). I'm working on an extension of your work but I'm wondering if this is truly a black-box attack scenario when both the agent and classifier are using the same feature space.

Thanks for clarification

Multiprogress is so heavy that it takes much extra time.
However, thread can't be killed conveniently when the lief timeout
Is there any way to solve this problem?

Traceback (most recent call last):
File "test_agent_kerasrl.py", line 59, in
dqn_success, _ = evaluate( model_policy(dqn) )
File "test_agent_kerasrl.py", line 23, in evaluate
action = action_function( bytez )
File "test_agent_kerasrl.py", line 53, in f
action_index = boltzmann_action( q_values ) # alternative: best_action
File "test_agent_kerasrl.py", line 42, in
boltzmann_action = lambda x : np.argmax( np.random.multinomial( 1, softmax(x).flatten()))
File "mtrand.pyx", line 4617, in mtrand.RandomState.multinomial (numpy/random/mtrand/mtrand.c:37769)
ValueError: sum(pvals[:-1]) > 1.0

I wrote a strip down script to test manipulate.modify_without_breaking

import numpy as np
from gym_malware.envs.utils import interface
from gym_malware.envs.controls import manipulate2 as manipulate

# np.random.seed(322333)
# random_action = lambda bytez: np.random.choice( list(manipulate.ACTION_TABLE.keys()) )
random_action = lambda bytez: 'section_append'
# original 32bit putty.exe in sha256 file name
bytez = interface.fetch_file('1d673f12ddf0e6cc1545a79471fd5dd56bf0ff9ccff49ff91b41b4085b727665')
action = random_action(bytez)
print(action)
bytez_mod = manipulate.modify_without_breaking( bytez, [action] )
with open("putty-mod32.exe", "wb") as new_file:
    new_file.write(bytez_mod)

The result PE was executed within a Windows 7 32bit but not executable/functional.

The only action that produced functional PE was overlay_append which didn't use LIEF. I tested both GUI & console windows PEs with overlay_append, the resultant files have different sha256-sum from the originals and are functional.

Unfortunately, for other actions that involved LIEF are used, the new file is not functional. I am using macOS python3.6 for this test.

When I ran the script in console, I did notice some error message for all actions that involved LIEF:

Any idea what could be the issue? Thanks!

Hello. I tried to reproduce your method with my dataset and ran into a problem.

I'm working with python3.6 on Arch Linux.

$ pip freeze
backports.weakref==1.0rc1
bleach==1.5.0
cached-property==1.3.1
certifi==2018.1.18
chainer==2.0.1
chainerrl==0.2.0
chardet==3.0.4
decorator==4.2.1
filelock==3.0.0
future==0.16.0
gym==0.9.2
h5py==2.7.0
html5lib==0.9999999
idna==2.5
ipython==6.1.0
ipython-genutils==0.2.0
jedi==0.11.1
Keras==2.0.5
keras-rl==0.3.0
lief==0.8.3
Markdown==2.6.11
nose==1.3.7
numpy==1.13.1
parso==0.1.1
pexpect==4.3.1
pickleshare==0.7.4
Pillow==5.0.0
prompt-toolkit==1.0.15
protobuf==3.5.1
ptyprocess==0.5.2
pyglet==1.3.0
Pygments==2.2.0
PyYAML==3.12
requests==2.18.1
scikit-learn==0.18.2
scipy==0.19.1
simplegeneric==0.8.1
six==1.11.0
sklearn==0.0
tensorflow==1.2.1
Theano==0.9.0
traitlets==4.3.2
urllib3==1.21.1
wcwidth==0.1.7
Werkzeug==0.14.1

PE format files are in the samles directory.
A typical file looks like this:

file 0426fd4a5075d8e1f5d919d817a72c6d1155180b74216235c7fd2249e746b5cb
0426fd4a5075d8e1f5d919d817a72c6d1155180b74216235c7fd2249e746b5cb: PE32 executable (console) Intel 80386, for MS Windows, UPX compressed

Cut from the log:

new hash: 5c0f2e48530947912c8df9c55b0f378d0ed3fa84d6207b30f717dd23c4b4d1d2
score=0.9811470102965859 (hidden), label=1.0
overlay_append
new hash: 15dce7f20d8bf5272f60303dae9af4a44a0d06681ec06f1e5251b5184a17f8bf
score=0.9811470102965859 (hidden), label=1.0
section_rename
Process Process-70:

Traceback (most recent call last):
File "/usr/lib64/python3.6/multiprocessing/process.py", line 258, in _bootstrap
self.run()
File "/usr/lib64/python3.6/multiprocessing/process.py", line 93, in run
self._target(*self._args, **self._kwargs)
File "/home/ghost/PycharmProjects/gym-malware/gym_malware/envs/controls/manipulate2.py", line 359, in helper
shared_list[:] = _action(seed)
File "/home/ghost/PycharmProjects/gym-malware/gym_malware/envs/controls/manipulate2.py", line 112, in section_rename
binary = lief.PE.parse(self.bytez)
_pylief.bad_file

I hope for your help.

Is there any limitation for commercial using?