MISP
/
PyMISP
mirror of https://github.com/MISP/PyMISP
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #271 from SHSauler/patch-4 

Fix #270 uniquely identifying sample
pull/265/merge
Raphaël Vinot 2018-09-05 15:58:09 -07:00 committed by GitHub
parent 515857c37c d8ef2559c6
commit 5b52524769
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pymisp/api.py
View File

@ -1223,7 +1223,15 @@ class PyMISP(object):
return True, rules return True, rules
def download_samples(self, sample_hash=None, event_id=None, all_samples=False, unzip=True): def download_samples(self, sample_hash=None, event_id=None, all_samples=False, unzip=True):
"""Download samples, by hash or event ID. If there are multiple samples in one event, use the all_samples switch""" """Download samples, by hash or event ID. If there are multiple samples in one event, use the all_samples switch
:param sample_hash: hash of sample
:param event_id: ID of event
:param all_samples: download all samples
:param unzip: whether to unzip or keep zipped
:return: A tuple with (success, [[event_id, sample_hash, sample_as_bytesio], [event_id,...]])
In case of legacy sample, the sample_hash will be replaced by the zip's filename
"""
url = urljoin(self.root_url, 'attributes/downloadSample') url = urljoin(self.root_url, 'attributes/downloadSample')
to_post = {'request': {'hash': sample_hash, 'eventID': event_id, 'allSamples': all_samples}} to_post = {'request': {'hash': sample_hash, 'eventID': event_id, 'allSamples': all_samples}}
response = self._prepare_request('POST', url, data=json.dumps(to_post)) response = self._prepare_request('POST', url, data=json.dumps(to_post))
@ -1242,6 +1250,7 @@ class PyMISP(object):
if f.get('md5') and f['md5'] in archive.namelist(): if f.get('md5') and f['md5'] in archive.namelist():
# New format # New format
unzipped = BytesIO(archive.open(f['md5'], pwd=b'infected').read()) unzipped = BytesIO(archive.open(f['md5'], pwd=b'infected').read())
details.append([f['event_id'], f['md5'], unzipped])
else: else:
# Old format # Old format
unzipped = BytesIO(archive.open(f['filename'], pwd=b'infected').read()) unzipped = BytesIO(archive.open(f['filename'], pwd=b'infected').read())